Adapt : A Tool To Performs Automated Penetration Testing for WebApps

ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts.

ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outputs categorized findings based on these potential vulnerabilities.

ADAPT also uses the functionality from OWASP ZAP to perform automated active and passive scans, and auto-spidering. Due to the flexible nature of the ADAPT tool, all of theses features and tests can be enabled or disabled from the configuration file.

Also Read : Killcast : Manipulate Chromecast Devices in your Network

Installation

  • Download latest version of ADAPT by clicking here.
  • Extract ADAPT via terminal

a. tar -xvfz adapt.tar.gz

  • Open a new terminal (ctrl+alt+t)
  • Navigate to the newly decompressed ADAPT folder
  • a. Ensure your environment has network access
  • Execute the install script(install.sh)
  • a. Type ‘./install.sh’
  • b. When prompted, enter your administrator’s password
  • ADAPT should now be ready for configuration

How it Works?

ADAPT uses Python to create an automated framework to use industry standard tools, such as OWASP ZAP and Nmap, to perform repeatable, well-designed procedures with anticipated results to create an easly understandable report listing vulnerabilities detected within the web application.

Automated Tests:

  • OTG-IDENT-004 – Account Enumeration
  • OTG-AUTHN-001 – Testing for Credentials Transported over an Encrypted Channel
  • OTG-AUTHN-002 – Default Credentials
  • OTG-AUTHN-003 – Testing for Weak lock out mechanism
  • OTG-AUTHZ-001 – Directory Traversal
  • OTG-CONFIG-002 – Test Application Platform Configuration
  • OTG-CONFIG-006 – Test HTTP Methods
  • OTG-CRYPST-001 – Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection
  • OTG-CRYPST-002 – Testing for Padding Oracle
  • OTG-ERR-001 – Testing for Error Code
  • OTG-ERR-002 – Testing for Stack Traces
  • OTG-INFO-002 – Fingerprinting the Webserver
  • OTG-INPVAL-001 – Testing for Reflected Cross site scripting
  • OTG-INPVAL-002 – Testing for Stored Cross site scripting
  • OTG-INPVAL-003 – HTTP Verb Tampering
  • OTG-SESS-001 – Testing for Session Management Schema
  • OTG-SESS-002 – Cookie Attributes
R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

5 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

6 days ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

6 days ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago