Overview
Version 0.1.2
Pantera is a mix between a pentest proxy, an application scanner and an intelligence analysis framework leaving all the automatic (repetitive) stuff and analysis to the engine but the decisions to the brain (we us consultants). Pantera is the Spanish word for panther. It has been designed by professionals in application security, by many years of experience and dozens of assessments, to professionals with all the features they can ever need.
Pantera is being developed with one purpose: to be the application assessment framework of choice, what we call "Web Assessment Studio (WAS)". Having all your needs under one umbrella. Powerful and easy to use and if you don't like it you can always change it to your taste! It is being released under the GNU General Public License.
Pantera uses as proxy a modified version of Immunity Inc SpikeProxy ( www.immunitysec.com)
The following are some notable Pantera Features:
- User-friendly custom web GUI. (CSS): Pantera itself is a web application that runs inside the browser and can be customized using CSS by the user. Some of the customizations are visual style, colors, fonts, views for easy information access, etc.
- 100% python: Python is cross-platform, easy to install and use. Making it the perfect language of choice.
- Multi-platform (Windows, Linux, etc.) and multi-browser (IE, Firefox, etc.): By using Python, Pantera is cross-platform. And we have made sure Pantera works fine with the most common browsers.
- Supports SSL, NTLM, HTTP Basic.
- Powerful analysis engine: Pantera has a powerful analysis engine, meaning that each web page that Pantera sees is analyzed for several things like comments, scripts, vulnerabilities, hidden tags and more. All this is done in background and transparent for the user while testing the website manual
and of course all this info is stored in the database.
- XML data files for configuration and attacks: Attacks and tests are stored in XML files, so it's easy to add content to these files.
- MySQL support: Most tools do not allow you to save the assessment. While performing an assessment with Pantera you can create a session, so all the info generated while the assessment is stored in the database. Currently only MySQL is supported, more databases will be supported in the future.
- Project Management: Each assessment is a session. Pantera offers project management to create new, open and delete projects.
- Plug-in support: Pantera offers plug-in support so advanced users can add and extent its features.
- Report generation: As Pantera can save assessments it can generate reports with all the gather data and vulnerabilities found. Some reports formats are HTML, XML, PDF, etc. Reports can also be customized!!
- Pantera Inline Feature: This interesting feature allows the user to use the browser visiting the target website and send Pantera commands using a special syntax without switching to Pantera UI. You can do most of the assessment by using just the browser and having Pantera in the background by catching and analyzing all the pages you view.
- Many utilities. (anti-IDS, fuzzing, web spider, brute force, cgi scanning, etc.): Pantera comes with many features, some are common, others aren't.
- Combines automated capabilities with complete manual testing to get the best results: That's the main goal of Pantera.
- Open source and freeware: Free of charge :-D
(Some of them still not available in this first public release to avoid more delays in the initial launch, please excuse us)
Project status
- OWASP Pantera v0.1.2 (Refer to changelog.txt for recent changes.)
- 10/09/2006 : Initial public release of OWASP Pantera version 0.1.1
A revamped version of the User Interface is expected to see the light in the next weeks. ;)
Please notice: This is beta software! ;)
This is an ambitious project, there are too many things we want to add. If you like it please consider getting involved in some way: Testers & Python developers needed, also ideas and suggestions will be very appreciated. Thank you. A mailing list is available at OWASP Project site.