timing_attack
Profile web applications, sorting inputs into two categories based on discrepancies in the application's response time. This tool can be used to test and develop known-vulnerable applications. Installation: gem install timing_attack. Usage: timing_attack [options] -u <target> <inputs> -u, --url URL URL of endpoint to profile. 'INPUT' will be replaced with the attack string. -n, --number NUM Requests per input (default: 50). -c, --concurrency NUM Number of concurrent requests (default: 15). -t, --threshold NUM Minimum threshold, in seconds, for meaningfulness (default: 0.025). -p, --post Use POST, not GET. -q, --quiet Quiet mode (don't display progress bars). -b, --brute-force Brute force mode. -i, --inputs-file FILE Read inputs from specified file, one per line. --parameters STR JSON hash of URL parameters. 'INPUT' will be replaced with the attack string. --parameters-file FILE Name of file containing parameters as with --parameters. --headers STR JSON hash of headers. 'INPUT' will be replaced with the attack string. --headers-file FILE Name of file containing headers as with --headers. --body STR JSON hash of parameters to be included in the request body. 'INPUT'
FEATURES
ALTERNATIVES
Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
A SaaS-based web application firewall that combines signature and behavioral-based threat detection to protect applications deployed across cloud, on-premises and edge environments.
A plugin for viewing, detecting weak configurations, and generating Content Security Policy headers.
An Application Security Posture Management platform that helps organizations integrate security throughout the software development lifecycle with a focus on vulnerability management and secure coding practices.
A web application firewall and API security platform that combines API discovery, runtime protection, vulnerability testing, and security posture management.
Apiiro ASPM Platform is an application security solution that provides code-to-runtime visibility, risk assessment, and remediation capabilities to help organizations manage and reduce security risks across their application portfolio.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Check Point CloudGuard WAF
A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.