1.
EyeWitness – A Web
Application Info-Gathering
Tool
@ChrisTruncer

2.
What’s it do?
! Designed to screenshot web applications that’s been
provided by the user.
! Text File
! Nmap XML Output
! .Nessus
! Gather server header information
! Identify default credentials
! Generates a report

3.
EyeWitness

4.
Why write it?
! Inspiration came from Tim Tomes’s PeepingTom
! Awesome tool
! Fix Blank Images
! Try a different screenshot library
! Ghost.py
! Stop wasting time looking up default creds
! A thought exercise

5.
How to use it

6.
How to use it

7.
Create Web App “Signatures”
! Create signature from web page source
! Multiple Strings are OK
! Find the default creds
! Format all the things!
! Signature|creds
! Signature;A Long Signature;Signature|creds
! All signatures must be present or no match

8.
Future Enhancements
! Group “similar” web apps together
! Printers
! Mirrored websites
! Etc.
! Looking for other suggestions… J
! More default creds…

9.
Current Signatures

10.
Call to Action
! Send me signatures!
! E-Mail! – eyewitness@christophertruncer.com
! Tweet Me!
! Pull Request!
! Find Bugs!

11.
Contact
! Github Repo
! https://github.com/ChrisTruncer/EyeWitness
! Project E-mail
! eyewitness@christophertruncer.com
! @ChrisTruncer