Brakeman – Static Analysis Rails Security Scanner

Last updated: june 9, 2018 | 1,738 views

Brakeman is a Rails security scanner – unlike many web security scanners, Brakeman looks at the source code of your application. This means you do not need to set up your whole application stack to use it. Once Brakeman scans the application code, it produces a report of all security issues it has found.

It works with Rails 2.x, 3.x, and 4.x.

The only other Ruby-centric tool we’ve covered is:

– Codesake::Dawn – Static Code Analysis Security Scanner For Ruby

If you are interested in more tools of this type you can find our complete list here (which covers various languages) – Code Auditing Tools.

Advantages

No Configuration Necessary

Brakeman requires zero setup or configuration once it is installed. Just run it.

Run It Anytime

Because all Brakeman needs is source code, Brakeman can be run at any stage of development: you can generate a new application with rails new and immediately check it with Brakeman.

Better Coverage

Since Brakeman does not rely on spidering sites to determine all their pages, it can provide more complete coverage of an application. This includes pages which may not be ‘live’ yet. In theory, Brakeman can find security vulnerabilities before they become exploitable.

Best Practices

Brakeman is specifically built for Ruby on Rails applications, so it can easily check configuration settings for best practices.

Flexible Testing

Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

Speed

While Brakeman may not be exceptionally speedy, it is much faster than “black box” website scanners. Even large applications should not take more than a few minutes to scan.

Installation

Using RubyGems:

1	gem install brakeman

Using Bundler, add to development group in Gemfile and set to not be required automatically:

1 2 3

group :development do   gem 'brakeman', :require => false end

From source:

1 2	gem build brakeman.gemspec gem install brakeman*.gem

You can download Brakeman 2.6.3 here:

https://github.com/presidentbeef/brakeman/archive/v2.6.3.zip

Drupwn – Drupal Enumeration Tool & Security Scanner

Last updated: june 11, 2018 | 2,047 views0

Drupwn is a Python-based Drupal Enumeration Tool that also includes an exploit mode, which can check for and exploit relevant CVEs.

Drupwn Drupal Enumeration Tool Hacking Features

Drupwn can be run, using two separate modes which are enum and exploit. The enum mode allows performing enumerations whereas the exploit mode allows checking and exploiting CVEs.

Enum mode

• User enumeration
• Node enumeration
• Default files enumeration
• Module enumeration
• Theme enumeration
• Cookies support
• User-Agent support
• Basic authentication support
• Request delay
• Enumeration range
• Logging

Exploit mode

• Vulnerability checker
• CVE exploiter
• You can download Drupwn here:

For scanning Drupal sites there is also:Droopescan – Plugin Based CMS Security Scanner