----------------------------------------------------------------------- # THEKLA - Web spider for web application pentesting # (c) 2009- Volker Tanger # # http://www.wyae.de/software/thekla/ # All rights reserved. Distributable under "Modified BSD" license ----------------------------------------------------------------------- Changes: 1x.y.x MAJOR TODO: rewrite pattern matching to generic (type, matchstring) IMPORTANT todo: feature: identify repeat content via SHA1(content) todo: feature: Auto-Cookie (auch: je Domain) todo: bugfix: print times > 24h - 1d todo: feature: match InnerHtml todo: feature: find known JS toolkits (top 37 ajax toolkits) todo: feature: find webstate/viewstate? PUT-Method (REST) todo: feature: what other identifiers for reloading todo: scanner (similar to Burp): - Passwort mit Autocomplete - match PHPINFO: allow_url_fopen allow_url_include - find SWFs 12.8.29 bugfix: added processing for JS and forms, too bugfix: corrected PHPSESSID regex 12.8.28 feature: added processing bugfix: made phpsess global variable 12.3.28 feature: manual Cookie support 11.11.25 feature "cut after hash" for URLs feature: decoding "&" in GET parameter to "&" feature: inhibit multiple-URL-encoding (i.e. the dreaded %252525...) feature: added sorted "logurls" file listing all visited URLS 11.2.9 feature: added excluded file types feature: saving HTTP errors into errors file, too feature: writes unsorted files during read, re-writes sorted list after successful completion feature: print visited URLs sorted into file feature: find/visit frame/iframe targets feature: added PHPSESSID keeping for URL-based session-ID bugfix: adjusted a number of RegEx-matches 11.1.7 bugfix: print times > 24h feature: reads HTML 30x redirects feature: finds AJAX requests (requests only, not targets) feature: reads JS files