Enteletaor

Enteletaor is a pentesting tool for message queues and brokers.

RabbitMQ, Redis or Apache Kafka are critical pieces of modern architectures, and hardly anyone tests them properly. Most pentesters focus on web applications, but brokers are just as critical and just as misconfigured.

What it does

• Detects insecure configurations in brokers.
• Injects malicious messages.
• Identifies authentication problems.
• Tests incorrect permissions.

Real cases

With it I’ve found critical vulnerabilities in systems processing financial transactions. In one of them anyone could inject messages into the queue, and it is easy to imagine what that allows.

It has over 150 stars and the pentester community uses it.