You can clone/download EyeWitness to test active scans here: https://github.com/ChrisTruncer/EyeWitness

Since its release, EyeWitness has purely been a passive scanner. Its focus has been to take screenshots of web applications, and attempt to identify any default credentials that might be associated with that web application. In my experience, it works well to save me the time from having to look up account information. While there are other features, this has been EyeWitness’s primary MO.

For a while, it’s been requested that EyeWitness integrate active scanning features to actually test and see what user accounts are genuinely valid, but it’s just never been in EyeWitness’s functionality.. until now.

Evan Pena (@Evan_Pena2003) just submitted a pull request to EyeWitness which has just been merged into the master branch. While it is currently limited in scope, active user account scanning functionality has just been merged into EyeWitness!

When you use the –active-scan command line flag, EyeWitness will attempt to find common locations of login forms, and if one is found, it will attempt to validate commonly used credentials and see if they work for the specific web application being tested. Additionally, we are now able to create more targeted “signatures” that can be used to specify paths for each unique web application and the credentials that should be tested against it.

For example, the –active-scan feature now can test tomcat manager web applications with various username and password combinations to see if any are valid. If a valid user/pass combo is found, EyeWitness will not only alert within the console, but the report itself has a new category called “Successful Logins” to highlight the applications where EyeWitness could successfully log into it.

As of now, the “database” of web applications isn’t large. However, this is the same situation we were in when EyeWitness began passively scanning for default credentials. As the database is built out, I’ll have the ability to add more web applications in and identify more credentials for each web app.

I’m really happy to have had this feature added in from the community, and I look forward to adding to the web application database and identify more credentials with each scan.