Sitadel is a python based web application scanner. It’s flexible and has many different scanning options. It can get a full fingerprint of a server and bruteforce directories, admin pages, files etc. Also, it can search for injection type attacks (slq, html, xss, rfi, ldap and more), other information disclosures and popular vulnerabilities.
Installing Sitadel
Let’s first clone the repo from Github.
git clone https://github.com/shenril/Sitadel.git
After that go inside the folder and run the setup script in python3.
cd Sitadel/ python3 setup.py install
After that you are good to go.
Running Sitadel
To run sitadel simply type the command below.
python3 sitadel.py
Let’s run the scanner against a vulnerable server to see what data we get back. The basic scan command is pretty straightforward. Just type this command and the scan will start. Give it some time for the script to complete.
python3 sitadel.py [target]
At first we get some basic fingerprinting about the target (x-frame options, headers, server version). Then it starts crawling the website. After that the scanner launches some basic attacks against the target. We got many different results. We can now search them manually for false positives. In our example we can see that our server is vulnerable to HTML injection and SQL injection, which is correct, we didn’t get any false positives for this particular test.
Sitadel is very flexible and easy to use. On the other hand, you get a lot of data in your terminal that is not of much use. In my opinion, I prefer GUI interfaces for Web Application scanning as the data feels more organised. However, it’s good to have a variety of tools to scan for vulnerabilities. I’m giving it 3.5 out of 5 bunnies.
