morty - Privacy aware web content sanitizer proxy as a service

Web content sanitizer proxy as a service.

Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks.
The main goal of morty is to provide a result proxy for searx , but it can be used as a standalone sanitizer service too.

Features:

• HTML sanitization
• Rewrites HTML/CSS external references to locals
• JavaScript blocking
• No Cookies forwarded
• No Referrers
• No Caching/Etag
• Supports GET/POST forms and IFrames
• Optional HMAC URL verifier key to prevent service abuse

Installation and setup

$ go get github.com/asciimoo/morty
$ "$GOPATH/bin/morty" --help

Test

$ cd "$GOPATH/src/github.com/asciimoo/morty"
$ go test

Benchmark

$ cd "$GOPATH/src/github.com/asciimoo/morty"
$ go test -benchmem -bench .

Download morty

Read More

Hyperfox - HTTP and HTTPs Traffic Interceptor

Hyperfox is a security tool for proxying and recording HTTP and HTTPs communications on a LAN.

Hyperfox is capable of forging SSL certificates on the fly using a root CA certificate and its corresponding key (both provided by the user). If the target machine recognizes the root CA as trusted, then HTTPs traffic can be succesfully intercepted and recorded.

Hyperfox saves captured data to a SQLite database for later inspection and also provides a web interface for watching live traffic and downloading wire formatted messages.

Download Hyperfox

Read More

DNSCrypt - A tool for securing communications between a client and a DNS resolver

dnscrypt-proxy provides local service which can be used directly as your local resolver or as a DNS forwarder, encrypting and authenticating requests using the DNSCrypt protocol and passing them to an upstream server.

The DNSCrypt protocol uses high-speed high-security elliptic-curve cryptography and is very similar to DNSCurve, but focuses on securing communications between a client and its first-level resolver.

While not providing end-to-end security, it protects the local network, which is often the weakest point of the chain, against man-in-the-middle attacks. It also provides some confidentiality to DNS queries.

Download DNSCrypt

Read More

[OWASP Zed Attack Proxy 2.2.1] Tool for finding vulnerabilities in web applications (Now supports CWE)

OWASP Zed Attack Proxy (ZAP) An easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.

Some of ZAP’s features:

• Intercepting Proxy
• Automated scanner
• Passive scanner
• Brute Force scanner
• Spider
• Fuzzer
• Port scanner
• Dynamic SSL certificates
• API
• Beanshell integration

Some of ZAP’s characteristics:

• Easy to install (just requires java 1.6)
• Ease of use a priority
• Comprehensive help pages
• Fully internationalized
• Under active development
• Open source
• Free (no paid for ‘Pro’ version)
• Cross platform
• Involvement actively encouraged

Download OWASP Zed Attack Proxy 2.2.1

Read More