Comparison of all those are presented in a table at the end of this post.

Security Perspective: If you are an info sec guy, esp. in forensics, you can utilize the features of the these tools to identify the presence of hidden large files/archives which might possibly contain some sensitive data in it. Most of the time secret truecrypt files are hidden inside some OS folders to make it look genuine.

Note: Most of the apps mentioned here can be downloaded in a portable format. The others can be made portable using the method mentioned here

Comparison Table – here.

HDGraph

SpaceSniffer

DiskSpaceFan

WinDirStat

TreeSizeFree

SpaceMonger

OverDisk

JDiskReport

Disktective

Xinorbis

Scanner

FilePro

FolderSize

Comparison Table

[Go To Top]

Installation on Ubuntu/BackTrack (via Redspin)

Use the following commands in the terminal windows to install and run Skipfish. Replace OUTPUT_FOLDER and TARGETSITE with the domain name and the target’s URL respectively. Also change the wget URL to the URL of the latest version of Skipfish download available.

wget http://skipfish.googlecode.com/files/skipfish-1.29b.tgz
tar zxvf skipfish-1.01b.tgz
sudo apt-get install libidn11-dev
cd skipfish
make
cp dictionaries/default.wl skipfish.wl
./skipfish -o OUTPUT_FOLDER http://www.TARGETSITE.com

Trial Run

Installed SkipFish and ran on the target site, specs below.

Guest OS : BackTrack4 VM

Host OS : Windows Vista

RAM : 512MB

Application Size : Medium ( < 1000 Unique Pages )

Internet Speed : 1 MBPS

Skipfish Verbose

Skipfish displays the scan run statistics continuously during the run. Once the scan run is complete, we get to see the scan summary (shown in the below screenshot).

Skipfish Console (Click to Enlarge)

Scan Output

Once the scan is complete, results are saved in HTML format. Its a simple tree interface that displays the details of the vulnerability along with the HTTP Header trace for each request.

NOTE: The target application which was used to test the application is a custom and private application and has been removed from the server. Please do not run scanner on any of the domains you dont own.

Skipfish Scan Report (Click to Enlarge)

Observations

• Installation and setup is super easy.
• Definitely not a heavy weight, memory hogging scanner.
• Did not find some of the basic vulnerabilities other scanners had found.
• Scan ran for ~14hours for that medium sized app.

Features

• High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint – easily achieving 2000 requests per second with responsive targets.

• Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.

• Cutting-edge security logic: high quality, low false positive, differential security checks, capable of spotting a range of subtle flaws, including blind injection vectors.

The tool is believed to support Linux, FreeBSD 7.0+, MacOS X, and Windows (Cygwin) environments.

List of High and Medium Vulnerabilities Skipfish Attempts to Identify

A rough list of the security checks, for High and Medium vulnerabilties, offered by the tool is outlined below.

• High risk flaws (potentially leading to system compromise):
  • Server-side SQL injection (including blind vectors, numerical parameters).
  • Explicit SQL-like syntax in GET or POST parameters.
  • Server-side shell command injection (including blind vectors).
  • Server-side XML / XPath injection (including blind vectors).
  • Format string vulnerabilities.
  • Integer overflow vulnerabilities.
  • Locations accepting HTTP PUT.

• Medium risk flaws (potentially leading to data compromise):
  • Stored and reflected XSS vectors in document body (minimal JS XSS support present).
  • Stored and reflected XSS vectors via HTTP redirects.
  • Stored and reflected XSS vectors via HTTP header splitting.
  • Directory traversal (including constrained vectors).
  • Assorted file POIs (server-side sources, configs, etc).
  • Attacker-supplied script and CSS inclusion vectors (stored and reflected).
  • External untrusted script and CSS inclusion vectors.
  • Mixed content problems on script and CSS resources (optional).
  • Incorrect or missing MIME types on renderables.
  • Generic MIME types on renderables.
  • Incorrect or missing charsets on renderables.
  • Conflicting MIME / charset info on renderables.
  • Bad caching directives on cookie setting responses.

Google Skipfish Info
App Name	Google Skipfish
License	free
Type	code
App URL
More Info	link

As per their FAQ it takes around half an hour to scan normal sized websites, but as soon as I initiated scan for my website, I got a notification mail saying that it takes around 72 hours to complete the scan but I got the results emailed in about 5 hours.

Start the Scan

1. Create a text file with the name ‘zerodayscan.txt’ which contains the unique random key generated at zerodayscan.com site.
2. Submit the  Site URL and Email Id to which the scan results are to be mailed.
3. Start the scan. (Scan results will be emailed once its complete)

Scan Results

Output of the scan result is a pdf document which will be emailed to the user and contains the following information

1. Summary of the Scan (check the above pic)
2. Details of the Critical, High, Medium and Low Vulnerabilities
3. Whois information of the website.

Sample Summary Table in the Report

ZeroDay Scan Summary Table

The results gives us an approximate idea on the vulnerabilities of the target though it obviously does not have as much capabilities as a commercial webapp scanner.

Features

• No installation is required. It is an online service
• Detects Cross Site Scripting attacks (XSS)
• Detects Hidden Directories and Backup Files
• Looks for Known Security Vulnerabilities
• Searches for SQL Injection Vulnerabilities
• Automatically detects zero day bugs
• Performs Website Fingerprinting
• Generates free reports

Features

There are a number of features which CAT has to enable a wide variety of testing to be conducted:

• Request Repeater – Used for repeating a single request
• Proxy – Classic Inline proxy
• Fuzzer – Allows for batch of tests to be sent to a server for brute forcing, parameter fuzzing, forced browsing etc.
• Log – View a list of requests to sort, search repeat etc. Allows for a sequence of requests to be repeated and modified.
• Authentication Checker – Two synchronised proxies which can be used to check authentication and authorisation controls.
• SSL Checker – Request a specific page with various SSL ciphers and versions.
• Notepad – A text/RTF editor which can be used as a scratch pad for conversions etc.
• Web Browser – An integrated web browser with proxy pre-configured based on the Internet Explorer’s rendering engine.

Reasons to use CAT

There are a number of differences between CAT and currently available web proxies. Some key differences are:

• Uses Internet Explorer’s rendering engine for accurate HTML representation
• Supports many different types of text conversions including: URL, Base64, Hex, Unicode, HTML/XML, SQL and JavaScript no Quotes
• Integrated SQL Injection and XSS Detection
• Synchronised Proxies for Authentication and Authorisation checking
• Faster due to HTTP connection caching
• SSL Version and Cipher checker using OpenSSL
• Greater flexibility for importing/exporting logs and saving projects
• Tabbed Interface allowing for multiple tools at once e.g. multiple repeaters and different logs
• The ability to repeat and modify a sequence of requests (particularly useful in SSO testing)
• Free!

Proxy & Authentication Checker

I generally use multiple browsers during web app assessments. This helps me to analyze the difference in the responses received from the server for same requests sent with different login credentials. This can also help me during the tests performed for horizontal/vertical privilege escalations. CAT listens to multiple ports at the same time, which means that you can use 2 browsers (or browser profiles) and direct the traffic to one proxy – CAT. CAT displays the traffic from different sources in different tabs.

Multiple Browsers Via Proxies

CAT Listening Via Multiple Proxies

While doing the authentication testing, we can login with the user having higher privilege in browser 1 and user with lower privilege in browser 2. Access various pages in browser 1 and identical requests are sent using the cookies stored in browser 2. CAT leaves us the response pairs behind for manual analysis.

Auth Checker

SSL Strength Check

Why use SSLDigger/Open SSL if your proxy has built-in SSL strength checking feature.

SSL Strength Checker

Download:   (More Info here )

Using Speedyfox is easy.

1. Download SpeedyFox
2. Run the program and click on ‘Speed Up My Firefox’ button, thats it!

TIP! : For Portable Firefox Users

1. Choose Custom from the Profile dropdown.
2. Browse to ‘PortableFirefox\Data\profiledir’ on your portable drive
3. Now Click on the ‘Speed Up My Firefox’ button

Download SpeedyFox :

Go To SpeedyFox Homepage

This attracts more people to try and test dropbox. Nice move…

Download Dropbox Portable : (Size : ~15MB)

More Info at Dropbox Home

This tool takes a snapshot of our files and registry (current state) and will be compared with the snapshot after installing any software.This can help us finding the leftovers and completely removing them.

Features

• Portable and Free
• Tiny app (~100KB)
• Scans both files and registry for changes
• Changes can be saved in text format

TIP:

This tool can also help in understanding the installation sequences and files distributed in our system which can be reverse engineering to create portable apps.

Download WhatChanged :

More Info at WhatChanged Homepage [via PenDriveApps]

Optimization with RIOT is very simple. Drag-n-drop the image to be processed onto RIOT and it does everything for you. If you are not satisfied with the default settings, tweak the options available to fine tune further. Use the Resize/Resample option to change the image dimensions and quality.

RIOT Resample

Making RIOT Portable:

Use the method mentioned in this post, to make this application portable so that you can run it directly from your USB Thumb drive.

Features:

• Save and optimize JPEG, GIF and PNG with a simple, clean user interface
• Compress files to desired filesize
• Processing is super fast
• Option to remove metadata (Comments, IPTC, Adobe XMP, EXIF profiles, ICC profiles)
• Resize image by using well known resample filters (ex: Lanczos3, Catmull Rom, Bicubic, and others)
• Adaptive logarithmic tone mapping algorithm (Drago) used for HDR images
• Free and Portable!!!

Download RIOT :

More details at RIOT Homepage

Balsamiq Mockups is a rich mockscreen creator app which has tons and tons of UI components available (If you still want more, there are options import components! ). This app is available in Online(free!) as well as in Desktop version(79$), and other versions for Confluence, JIRA, XWiki.

I had previously reviewed a portable screen mockup software, Pencil, but Balsamiq Mockups definitely stands out as it is powerful and fully loaded compared to its alternatives. This app is loaded heavily with 75 built-in UI controls and more than 100 icons. Additional controls can be downloaded from MockUpsToGo Site which has many user contributed controls which can be imported to our editor and reused.

MockScreen Controls

You can try out the online free version of this app but it has few limitations

• You need active Internet connection (Obvious)
• Cannot work on multiple mockup screens simultaneously
• Insert Images in Mockup components.
• Change the default Comic Sans font.

For full fledged features buy the downloadable version or try the demo desktop version. Adobe Air is required for running the Desktop version

Samples

Mock Site

Real Site

This is the screenshot of my previously decommisioned site http://31nst31n-In-Me.com (Click to view it larger)

(Update: Author was benevolent enough to provide me with full version of this app for testing, so I was able to insert images in the my sample mockup below and so was I able to explore all the features…)

Checkout the sample mockups created from this page.

Demo

Go to Balsamiq Mockups

Download Desktop Version :

SmartDefrag is one of the best free and award winning defrag tools available in the market.

SmartDefrag Screenshot

We have an options to optimize files after the defrag phase. This will further enhance the whole process and once the defragmentation is complete, a summary report is displayed.

Final Report

Features

• Efficient Defragmentation
• Optimize Disk Performance
• Work Automatically in the background when idle
• Options to schedule the task
• Free

Comparison Chart

I found this chart in their site, where they have compared their features with similar other tools

Comparison Chart

Download SmartDefrag :

[Note : To make this portable, download the exe and extract the files as mentioned in here uniextract]