“ASafaWeb is the Automated Security Analyser for ASP.NET Websites. The purpose of ASafaWeb is to make scanning for common configuration vulnerabilities in live ASP.NET websites dead easy. To that effect, you don't need anything more than a URL to get started and ASafaWeb will head off and report on anything it can find which is remotely detectable.”Whilst this is an unequivocally a basic tool, it will still find configuration flaws in many web sites. The sort of flaws it finds are things like custom errors being off, YSODs with stack traces being returned, tracing still on, debug mode enabled and many, many more.
How does it work?
- Browse to Asafaweb.com.
- Enter the url of your application and click Scan. Can it be any easier? (I tried it with my employer's website ).
- Once the scan has completed, you get a nice summary report and details about all the scanned parts, problems and possible ways to fix them. Nice!