Codename RKN: The WebApp attack surface mapper.

Hello all,

I would like to introduce to you the new addition to Ecsypno's product line: Codename RKN

Codename RKN is the first comprehensive WebApp attack surface mapper.

It can help save countless hours from your daily duties by providing amazing insight into a web application's behavior and inner workings.

It utilizes DAST and client-side IAST techniques to monitor everything about a black-box and presents its I/O characteristics in an approachable form.

Codename RKN digs deep and will let you know how to prepare your penetration test approach for each web application based on how it processes its inputs and presents its outputs.

This is especially true when it comes to the client-side JS environment, as you get a full trace of how an input's data traversed through it and where it ended up.

In other words, Codename RKN is an automated WebApp I/O behavioral analysis (for reconnaissance and threat modelling) tool -- i.e. a penetration tester's best friend.
It is your manual webapp pentest assistant, allowing you to keep track of a Web application's attack surface as well as your progress traversing through it.

Core functionality

Server-stack identification.
Identify amount and types (link, form, cookie etc.) of inputs.
Identify input characteristics, ex.:

Data sinks -- Data lands in:

HTML – reflected
HTTP response headers – reflected
JS runtime

Whether or not an input triggers functionality on the server-side in a discernible manner.
Whether or not an input triggers functionality on the client-side in a discernible manner.
If an input appears to be non-functional server-side.
If an input appears to be non-functional client-side.
Parallel webapp scans.
Multi-role scans.
More to come.