Steve.org.uk

Fortress is the name of a simple script-based security scanner which aims to be:

• Simple to control, build & use.
• Extensible.
• Reasonably portable.

The code is written in C++ and developed primarily upon the GNU/Linux platform. All the security tests should be written in the LUA extension language. (The scanner includes a copy of the LUA scripting engine, and can thus execute scripts directly.)

To build the software you will need :

• A C++ compiler.
• LUA 5.0 development libraries + headers.
• libcurl 3.0 development libraries + headers.

These can be installed en masse upon Debian GNU/Linux hosts with the following command:

apt-get install build-essential liblualib50-dev \
  liblua50-dev libcurl3-dev

Once compiled you can run all tests against a single host with the following command:

./fortress --target=hostname --port NN

If you wish to run only a single test you may run:

./fortress --script=./script/name.lua

If you're just interested in writing simple scripts you can create one and execute it directly:

./fortress path/to/script.lua

For more information invoke 'fortress --help'.

You can download the tarball from the following link:

• fortress-0.3.tar.gz [78k]

There is also a public repository which you may use to keep track of the current developments, or submit patches/scripts against:

• http://fortress.repository.steve.org.uk/

Writing your own tests is what makes a scriptable security tester useful. You will have access to the full power of the LUA scripting environment available to you in your scripts.

Additionally there are some new functions which are implemented by the scanning engine - these are described within the primitives documentation.

If you'd like to use more general purpose networking primitives please see the following project:

• Lua-httpd

This implements Lua-callable network primitives such as bind(), accept(), connect(), read(), and write().