Sitadel – An Open Source Tool for Finding Web Application Vulnerabilities

  • 502
  •  
  •  
  •  
  •  
  •  
  •  
    502
    Shares

Sitadel is a python based web application scanner. It’s flexible and has many different scanning options. It can get a full fingerprint of a server and bruteforce directories, admin pages, files etc. Also, it can search for injection type attacks (slq, html, xss, rfi, ldap and more), other information disclosures and popular vulnerabilities.

Installing Sitadel

Let’s first clone the repo from Github.

git clone https://github.com/shenril/Sitadel.git

After that go inside the folder and run the setup script in python3.

cd Sitadel/

python3 setup.py install

After that you are good to go.

Running Sitadel

To run sitadel simply type the command below.

python3 sitadel.py

Let’s run the scanner against a vulnerable server to see what data we get back. The basic scan command is pretty straightforward. Just type this command and the scan will start. Give it some time for the script to complete.

python3 sitadel.py [target]

At first we get some basic fingerprinting about the target (x-frame options, headers, server version). Then it starts crawling the website. After that the scanner launches some basic attacks against the target. We got many different results. We can now search them manually for false positives. In our example we can see that our server is vulnerable to HTML injection and SQL injection, which is correct, we didn’t get any false positives for this particular test.

What Bunny rating does it get?

Sitadel is very flexible and easy to use. On the other hand, you get a lot of data in your terminal that is not of much use. In my opinion, I prefer GUI interfaces for Web Application scanning as the data feels more organised. However, it’s good to have a variety of tools to scan for vulnerabilities. I’m giving it 3.5 out of 5 bunnies.

Want to learn more about ethical hacking?

We have a  networking hacking course that is of a similar level to OSCP, get an exclusive 95% discount HERE

Do you know of another GitHub related hacking tool?

Get in touch with us via the contact form if you would like us to look at any other GitHub ethical hacking tools.

 

 

The following two tabs change content below.
Avatar

Unallocated Author

Please note that the article you are reading has an unallocated author as the original author is no longer employed at latesthackingnews.com, this has been put in place to adhere with general data protection regulations (GDPR). If you have any further queries, please contact: [email protected]
Avatar

Unallocated Author

Please note that the article you are reading has an unallocated author as the original author is no longer employed at latesthackingnews.com, this has been put in place to adhere with general data protection regulations (GDPR). If you have any further queries, please contact: [email protected]

Do NOT follow this link or you will be banned from the site!