{"id":17928693,"url":"https://github.com/evilsocket/altair","last_synced_at":"2025-09-12T10:43:55.931Z","repository":{"id":1338260,"uuid":"1284167","full_name":"evilsocket/altair","owner":"evilsocket","description":"A Modular Web Vulnerability Scanner","archived":false,"fork":false,"pushed_at":"2011-01-24T23:18:04.000Z","size":184,"stargazers_count":49,"open_issues_count":2,"forks_count":22,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-12-30T21:41:37.003Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://www.evilsocket.net","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/evilsocket.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2011-01-23T09:23:50.000Z","updated_at":"2024-10-11T17:18:51.000Z","dependencies_parsed_at":"2022-08-16T13:10:30.124Z","dependency_job_id":null,"html_url":"https://github.com/evilsocket/altair","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilsocket%2Faltair","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilsocket%2Faltair/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilsocket%2Faltair/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilsocket%2Faltair/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/evilsocket","download_url":"https://codeload.github.com/evilsocket/altair/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":233430514,"owners_count":18675102,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T21:04:45.580Z","updated_at":"2025-01-11T02:19:34.642Z","avatar_url":"https://github.com/evilsocket.png","language":"Python","readme":"ALTAIR - A Modular Web Vulnerability Scanner\nCopyleft by Simone Margaritelli \u003cevilsocket@gmail.com\u003e\nhttp://www.evilsocket.net - http://www.backbox.org\n\nUsage: altair [options] -u \u003ctarget\u003e\n\nEXAMPLES:\n  altair --filter=lfi,rfi --url=http://www.somesite.com\n  altair --filter=sqli --load-modules=sqlmap --url=http://www.somesite.com\n\nOptions:\n  -h, --help            show this help message and exit\n  -t THREADS, --threads=THREADS\n                        Max simultaneous threads.\n  -e ALLOWEDEXTENSIONS, --ext=ALLOWEDEXTENSIONS\n                        Comma separated allowed extensions.\n  -a USERAGENT, --ua=USERAGENT\n                        Custom user agent.\n  -d, --enable-delay    Enable crawling delay.\n  -s CRAWLDELAY, --crawl-delay=CRAWLDELAY\n                        Crawling delay in ms.\n  -m MAXDIRECTORYDEPTH, --max-depth=MAXDIRECTORYDEPTH\n                        Max directory depth.\n  -p, --enable-proxy    Enable proxy support.\n  -S PROXYSERVER, --proxy-server=PROXYSERVER\n                        Proxy server address.\n  -P PROXYPORT, --proxy-port=PROXYPORT\n                        Proxy server port.\n  -f KBFILTER, --filter=KBFILTER\n                        Comma separated ids of vulnerabilities to test,\n                        default to all, use the --list-ids flag to enumerate\n                        available ids.\n  -I, --list-ids        Print a list of available ids in the knowledge base to\n                        be used with the --filter flag.\n  -k KBFILE, --kb=KBFILE\n                        Knowledge base file to use, default kb.xml.\n  -L MODULES, --load-modules=MODULES\n                        Comma separated modules names to load or 'all' to load\n                        them all, use the --list-modules flag to a list of\n                        available modules.\n  -M, --list-modules    Print a list of available modules.\n  -u URL, --url=URL     Url to test, mandatory.\n  -O OUTFILE, --output=OUTFILE\n                        Output status and result to file.\n  --import-files=IMPORTFILES\n                        Import sensitive files list from this file.\n  --import-dirs=IMPORTDIRS\n                        Import sensitive directories list from this file.\n  --single-mode         Single url mode, scan only this url for\n                        vulnerabilities (the URL has to have at least one\n                        parameter).\n\n\n----------------------------------------------------------------------------------------\n\n[evilsocket@shinigami altair] ./altair.py -I\n\n[xss] Cross Site Scriptings :\nA cross site scripting vulnerability, also known as XSS, is one of the most common vulnerabilities in web apps. The server does not check the users' input, and parses GET variables (can be done also through POST sometimes), without sanitizing them ahead of time. This allows users to inject html, javascript, or other code, through the page affected by this kind of bug. These injections occur client side (the server side code will be not modified), but the html stream that the user receives will contain the injected code . Usually this type of flaw is used to obtain private data such as cookies, data that often contains the credentials to access protected pages.\n\n[sqli] SQL Injections :\nAn SQL injection, or SQL code injection, is another example of how a lack of checking user inputed data can undermine our site's security. Nowadays 90% of existing websites rely on a database to store contents such as news, articles, or simply to manage the users; this means that if not placed through an accurate checking process, the data send from an attacker can affect the information present in our database. An SQL injection, as the name itself suggests, is made by injecting arbitrary sql code in a variable sent to the website, both GET or POST, to obtain data from the db, data that would not be normally accessible .\n\n[rfi] Remote File Inclusions :\nA remote file inclusion happens when a page includes a file whose name is taken from a GET or POST variable that is not sanitized or checked ahead of time .\n\n[lfi] Local File Inclusions :\nA local file inclusion happens when a page includes a file whose name is taken from a GET or POST variable that is not sanitized or checked ahead of time .\n\n[files] Sensitive Files :\nPotential sensitive file .\n\n[dirs] Sensitive Directories :\nPotential sensitive directory .\n\n----------------------------------------------------------------------------------------\n\n[evilsocket@shinigami altair] altair -M\n\n[+] 'lfier' by Simone Margaritelli \u003cevilsocket@gmail.com\u003e : This module will try to read some standard system files upon LFI vulnerabilities.\n[+] 'sqlmap' by Simone Margaritelli \u003cevilsocket@gmail.com\u003e : This module will ask the user to launch sqlmap when a sql injection is found.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevilsocket%2Faltair","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fevilsocket%2Faltair","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevilsocket%2Faltair/lists"}