0 
0 Sitadel is a python based web application scanner. It’s flexible and has many different scanning options. It can get a full fingerprint of a server and bruteforce directories, admin pages, files etc. Also, it can search for injection type attacks (slq, html, xss, rfi, ldap and more), other information disclosures and popular vulnerabilities tools more.
- Frontend framework detection
- Content Delivery Network detection
- Define Risk Level to allow for scans
- Plugin system
- Docker image available to build and run
Features
Fingerprints
- Server
- Web Frameworks (CakePHP,CherryPy,…)
- Frontend Frameworks (AngularJS,MeteorJS,VueJS,…)
- Web Application Firewall (Waf)
- Content Management System (CMS)
- Operating System (Linux,Unix,..)
- Language (PHP,Ruby,…)
- Cookie Security
- Content Delivery Networks (CDN)
Attacks:
Bruteforce
- Admin Interface
- Common Backdoors
- Common Backup Directory
- Common Backup File
- Common Directory
- Common File
- Log File
Injection
- HTML Injection
- SQL Injection
- LDAP Injection
- XPath Injection
- Cross Site Scripting (XSS)
- Remote File Inclusion (RFI)
- PHP Code Injection
Other
- HTTP Allow Methods
- HTML Object
- Multiple Index
- Robots Paths
- Web Dav
- Cross Site Tracing (XST)
- PHPINFO
- Listing
Vulnerabilities
- ShellShock
- Anonymous Cipher (CVE-2007-1858)
- Crime (SPDY) (CVE-2012-4929)
- Struts-Shock
Installtion
Let’s first clone the repo from Github.
git clone https://github.com/shenril/Sitadel.gitAfter that go inside the folder and run the setup script in python3.
cd Sitadel/ python3 setup.py install
python3 setup.py installAfter that you are good to go.
Running Sitadel
To run sitadel simply type the command below.
python3 sitadel.py https://linuxtips.inAt first we get some basic fingerprinting about the target (x-frame options, headers, server version). Then it starts crawling the website. After that the scanner launches some basic attacks against the target. We got many different results. We can now search them manually for false positives. In our example we can see that our server is vulnerable to HTML injection and SQL injection, which is correct, we didn’t get any false positives for this particular test.
More Information About This Tool Github
