w3af

Nicolas,

    Please read inline,

On Wed, Oct 28, 2009 at 8:46 AM, Nicolas Krassas <krasn@...> wrote:
> Hi,
>
>             Few days now and following always the svn version, I’m having
> problem with w3af, seems that it’s getting stuck. Here is the setup:
>
>
>
> w3af>>> plugins
>
> w3af/plugins>>> discovery
> wordpress_fingerprint,MSNSpider,userDir,webSpider,sharedHosting,serverStatus,serverHeader,hmap,allowedMethods
>
> w3af/plugins>>> audit
> xss,sqli,generic,dav,LDAPi,blindSqli,frontpage,osCommanding,localFileInclude
>
> w3af/plugins>>> output textFile

Setup looks ok, but you should enable debugging in the textFile output
plugin to analyze your problem.

> w3af/config:target>>> set target http://www.host
>
> w3af/config:target>>> back
>
> w3af>>> start
>
> Auto-enabling plugin: grep.error500
>
> Auto-enabling plugin: discovery.frontpage_version
>
> Auto-enabling plugin: grep.httpAuthDetect
>
> Auto-enabling plugin: discovery.fingerMSN
>
> Auto-enabling plugin: discovery.fingerGoogle
>
> Auto-enabling plugin: discovery.fingerPKS
>
> The server header for the remote web server is: "Apache/2.2.8 (Ubuntu)
> mod_jk/1.2.25 mod_python/3.3.1 Python/2 etc etc
>
>
>
> From then on, every now and then I’m pressing enter to check the progress
> and I’m getting the following
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 02m 20s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 06m 22s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 07m 18s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 14m 01s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 15m 51s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 21m 01s
>

Yep, it seems that the spider is stuck, but with this info I'm not
able to see the bug. Could you please enable debugging in the textFile
plugin, run the scan again, and see what *really* happens?

>
> It doesn’t really matter if I’ll leave it more ( I’ve left it running for 40
> minutes with the same results it was just adding time ) .
>
>
>
> The website that I’m checking is the same like every month I didn’t had the
> problem in earlier version of w3af..

Don't worry, we'll fix it =)

>
>
> Regards,
>
> Dinos
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Hi again,
	Attached is the debug info from the output. 

Thanks again.

-----Original Message-----
From: Andres Riancho [mailto:andres.riancho@...] 
Sent: Wednesday, October 28, 2009 2:58 PM
To: Nicolas Krassas
Cc: w3af-users@...
Subject: Re: [W3af-users] Latest w3af

Nicolas,

    Please read inline,

On Wed, Oct 28, 2009 at 8:46 AM, Nicolas Krassas <krasn@...> wrote:
> Hi,
>
>             Few days now and following always the svn version, I’m having
> problem with w3af, seems that it’s getting stuck. Here is the setup:
>
>
>
> w3af>>> plugins
>
> w3af/plugins>>> discovery
>
wordpress_fingerprint,MSNSpider,userDir,webSpider,sharedHosting,serverStatus
,serverHeader,hmap,allowedMethods
>
> w3af/plugins>>> audit
>
xss,sqli,generic,dav,LDAPi,blindSqli,frontpage,osCommanding,localFileInclude
>
> w3af/plugins>>> output textFile

Setup looks ok, but you should enable debugging in the textFile output
plugin to analyze your problem.

> w3af/config:target>>> set target http://www.host
>
> w3af/config:target>>> back
>
> w3af>>> start
>
> Auto-enabling plugin: grep.error500
>
> Auto-enabling plugin: discovery.frontpage_version
>
> Auto-enabling plugin: grep.httpAuthDetect
>
> Auto-enabling plugin: discovery.fingerMSN
>
> Auto-enabling plugin: discovery.fingerGoogle
>
> Auto-enabling plugin: discovery.fingerPKS
>
> The server header for the remote web server is: "Apache/2.2.8 (Ubuntu)
> mod_jk/1.2.25 mod_python/3.3.1 Python/2 etc etc
>
>
>
> From then on, every now and then I’m pressing enter to check the progress
> and I’m getting the following
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 02m 20s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 06m 22s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 07m 18s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 14m 01s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 15m 51s
>
>
>
> Status: Running discovery.webSpider on http://www.host | Method: GET.
>
> Current phase status: 46.15 % - ETA: 00d 00h 21m 01s
>

Yep, it seems that the spider is stuck, but with this info I'm not
able to see the bug. Could you please enable debugging in the textFile
plugin, run the scan again, and see what *really* happens?

>
> It doesn’t really matter if I’ll leave it more ( I’ve left it running for
40
> minutes with the same results it was just adding time ) .
>
>
>
> The website that I’m checking is the same like every month I didn’t had
the
> problem in earlier version of w3af..

Don't worry, we'll fix it =)

>
>
> Regards,
>
> Dinos
>
>
----------------------------------------------------------------------------
--
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Nicolas,

On Wed, Oct 28, 2009 at 10:23 AM, Nicolas Krassas <krasn@...> wrote:
> Hi again,
>        Attached is the debug info from the output.

hmmm, sorry, but the output is not allowing me to see what's going on.
I have other questions though:

- Is python consuming 100% of the CPU?
- Is the disk flashing constantly?

Cheers,

> Thanks again.
>
> -----Original Message-----
> From: Andres Riancho [mailto:andres.riancho@...]
> Sent: Wednesday, October 28, 2009 2:58 PM
> To: Nicolas Krassas
> Cc: w3af-users@...
> Subject: Re: [W3af-users] Latest w3af
>
> Nicolas,
>
>    Please read inline,
>
> On Wed, Oct 28, 2009 at 8:46 AM, Nicolas Krassas <krasn@...> wrote:
>> Hi,
>>
>>             Few days now and following always the svn version, I’m having
>> problem with w3af, seems that it’s getting stuck. Here is the setup:
>>
>>
>>
>> w3af>>> plugins
>>
>> w3af/plugins>>> discovery
>>
> wordpress_fingerprint,MSNSpider,userDir,webSpider,sharedHosting,serverStatus
> ,serverHeader,hmap,allowedMethods
>>
>> w3af/plugins>>> audit
>>
> xss,sqli,generic,dav,LDAPi,blindSqli,frontpage,osCommanding,localFileInclude
>>
>> w3af/plugins>>> output textFile
>
> Setup looks ok, but you should enable debugging in the textFile output
> plugin to analyze your problem.
>
>> w3af/config:target>>> set target http://www.host
>>
>> w3af/config:target>>> back
>>
>> w3af>>> start
>>
>> Auto-enabling plugin: grep.error500
>>
>> Auto-enabling plugin: discovery.frontpage_version
>>
>> Auto-enabling plugin: grep.httpAuthDetect
>>
>> Auto-enabling plugin: discovery.fingerMSN
>>
>> Auto-enabling plugin: discovery.fingerGoogle
>>
>> Auto-enabling plugin: discovery.fingerPKS
>>
>> The server header for the remote web server is: "Apache/2.2.8 (Ubuntu)
>> mod_jk/1.2.25 mod_python/3.3.1 Python/2 etc etc
>>
>>
>>
>> From then on, every now and then I’m pressing enter to check the progress
>> and I’m getting the following
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 02m 20s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 06m 22s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 07m 18s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 14m 01s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 15m 51s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 21m 01s
>>
>
> Yep, it seems that the spider is stuck, but with this info I'm not
> able to see the bug. Could you please enable debugging in the textFile
> plugin, run the scan again, and see what *really* happens?
>
>>
>> It doesn’t really matter if I’ll leave it more ( I’ve left it running for
> 40
>> minutes with the same results it was just adding time ) .
>>
>>
>>
>> The website that I’m checking is the same like every month I didn’t had
> the
>> problem in earlier version of w3af..
>
> Don't worry, we'll fix it =)
>
>>
>>
>> Regards,
>>
>> Dinos
>>
>>
> ----------------------------------------------------------------------------
> --
>> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
>> http://p.sf.net/sfu/devconference
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>>
>
>
>
> --
> Andrés Riancho
> Founder, Bonsai - Information Security
> http://www.bonsai-sec.com/
> http://w3af.sf.net/
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

No python is normal and iostat is not reporting anything strange on the hard
drive. Python version is 2.5.2 

-----Original Message-----
From: Andres Riancho [mailto:andres.riancho@...] 
Sent: Wednesday, October 28, 2009 5:57 PM
To: Nicolas Krassas
Cc: w3af-users@...
Subject: Re: [W3af-users] Latest w3af

Nicolas,

On Wed, Oct 28, 2009 at 10:23 AM, Nicolas Krassas <krasn@...> wrote:
> Hi again,
>        Attached is the debug info from the output.

hmmm, sorry, but the output is not allowing me to see what's going on.
I have other questions though:

- Is python consuming 100% of the CPU?
- Is the disk flashing constantly?

Cheers,

> Thanks again.
>
> -----Original Message-----
> From: Andres Riancho [mailto:andres.riancho@...]
> Sent: Wednesday, October 28, 2009 2:58 PM
> To: Nicolas Krassas
> Cc: w3af-users@...
> Subject: Re: [W3af-users] Latest w3af
>
> Nicolas,
>
>    Please read inline,
>
> On Wed, Oct 28, 2009 at 8:46 AM, Nicolas Krassas <krasn@...> wrote:
>> Hi,
>>
>>             Few days now and following always the svn version, I’m having
>> problem with w3af, seems that it’s getting stuck. Here is the setup:
>>
>>
>>
>> w3af>>> plugins
>>
>> w3af/plugins>>> discovery
>>
>
wordpress_fingerprint,MSNSpider,userDir,webSpider,sharedHosting,serverStatus
> ,serverHeader,hmap,allowedMethods
>>
>> w3af/plugins>>> audit
>>
>
xss,sqli,generic,dav,LDAPi,blindSqli,frontpage,osCommanding,localFileInclude
>>
>> w3af/plugins>>> output textFile
>
> Setup looks ok, but you should enable debugging in the textFile output
> plugin to analyze your problem.
>
>> w3af/config:target>>> set target http://www.host
>>
>> w3af/config:target>>> back
>>
>> w3af>>> start
>>
>> Auto-enabling plugin: grep.error500
>>
>> Auto-enabling plugin: discovery.frontpage_version
>>
>> Auto-enabling plugin: grep.httpAuthDetect
>>
>> Auto-enabling plugin: discovery.fingerMSN
>>
>> Auto-enabling plugin: discovery.fingerGoogle
>>
>> Auto-enabling plugin: discovery.fingerPKS
>>
>> The server header for the remote web server is: "Apache/2.2.8 (Ubuntu)
>> mod_jk/1.2.25 mod_python/3.3.1 Python/2 etc etc
>>
>>
>>
>> From then on, every now and then I’m pressing enter to check the progress
>> and I’m getting the following
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 02m 20s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 06m 22s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 07m 18s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 14m 01s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 15m 51s
>>
>>
>>
>> Status: Running discovery.webSpider on http://www.host | Method: GET.
>>
>> Current phase status: 46.15 % - ETA: 00d 00h 21m 01s
>>
>
> Yep, it seems that the spider is stuck, but with this info I'm not
> able to see the bug. Could you please enable debugging in the textFile
> plugin, run the scan again, and see what *really* happens?
>
>>
>> It doesn’t really matter if I’ll leave it more ( I’ve left it running for
> 40
>> minutes with the same results it was just adding time ) .
>>
>>
>>
>> The website that I’m checking is the same like every month I didn’t had
> the
>> problem in earlier version of w3af..
>
> Don't worry, we'll fix it =)
>
>>
>>
>> Regards,
>>
>> Dinos
>>
>>
>
----------------------------------------------------------------------------
> --
>> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
>> http://p.sf.net/sfu/devconference
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>>
>
>
>
> --
> Andrés Riancho
> Founder, Bonsai - Information Security
> http://www.bonsai-sec.com/
> http://w3af.sf.net/
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Sébastien,

2009/10/23 Sébastien Duquette <ekse.0x@...>:
> This is dating a bit so you might already know, but w3af was featured
> on the front page of the march issue of the french version of Hackin9
> magazine. You can see the cover here :
>
> http://hakin9.org/fr/magazine/868-introduction-a-w3af

holy shit! This is GREAT! A front page in hackin9? Niiiiiiiiice! =)

> Unfortunately, the article is not available online so I don't know
> what it's worth.

If you get the real magazine from one of your friends, or even buy it
yourself, please let me know if the article was good.

Thanks!

> Sébastien
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Great! =)

It will be interesting to read this article.

-- 
Taras - OSCP, OSWP
----
"Software is like sex: it's better when it's free." - Linus Torvalds

Hello, T H!

Thanks for interesting in W3AF :)

On Tue, 2009-10-06 at 12:55 -0400, T H wrote:
> I've just recently started messing around w/ w3af and I can't seem to
> run the console UI:
> 
> # ./w3af_console
> Error while reading plugin options.
> There was an error while importing plugins.discovery.wordnet: "cannot
> import name wordnet".
Hmm, did you install W3AF_DIR/extlib/nltk package?


> 
> I'm running the supported version of python (2.5.x) and have installed
> all the necessary dependencies. I've tried running the manual python
> setup instrutcions in the user manual as well as skipping them all -
> nothing makes any difference. I've downloaded the latest release
> (wsaf_1.0-rc2.tar.bz2 from April 3, 2009).
> 
> If anyone can provide any assistance, it would be greatly appreciate -
> thank you all! 
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry® Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay 
> ahead of the curve. Join us from November 9-12, 2009. Register now!
> http://p.sf.net/sfu/devconf
> _______________________________________________ W3af-users mailing list W3af-users@... https://lists.sourceforge.net/lists/listinfo/w3af-users
-- 
Taras - OSCP, OSWP
----
"Software is like sex: it's better when it's free." - Linus Torvalds

Hello!

Hmm, it's strange, but I haven't any nltk module installed.
And I haven't any errors.

Could you please remove plugins/discovery/wordnet.py and try to run
w3af_console?

Please, reply to mail list also.

On Tue, 2009-10-06 at 16:26 -0400, T H wrote:
> I installed the Fedora nltk package via yum.
> 
> In the setup instructions, there is a step to run:
> 
> python setup.py install in the directory you mention (extlib/nltk),
> however there is no setup.py file in that directory. I reinstalled and
> re-extracted the package a number of times - never found the setup.py
> file.
> 
> On Tue, Oct 6, 2009 at 4:07 PM, Taras <taras@...> wrote:
>         Hello, T H!
>         
>         Thanks for interesting in W3AF :)
>         
>         On Tue, 2009-10-06 at 12:55 -0400, T H wrote:
>         > I've just recently started messing around w/ w3af and I
>         can't seem to
>         > run the console UI:
>         >
>         > # ./w3af_console
>         > Error while reading plugin options.
>         > There was an error while importing
>         plugins.discovery.wordnet: "cannot
>         > import name wordnet".
>         
>         Hmm, did you install W3AF_DIR/extlib/nltk package?
>         
>         
>         >
>         > I'm running the supported version of python (2.5.x) and have
>         installed
>         > all the necessary dependencies. I've tried running the
>         manual python
>         > setup instrutcions in the user manual as well as skipping
>         them all -
>         > nothing makes any difference. I've downloaded the latest
>         release
>         > (wsaf_1.0-rc2.tar.bz2 from April 3, 2009).
>         >
>         > If anyone can provide any assistance, it would be greatly
>         appreciate -
>         > thank you all!
>         
>         >
>         ------------------------------------------------------------------------------
>         > Come build with us! The BlackBerry&reg; Developer Conference
>         in SF, CA
>         > is the only developer event you need to attend this year.
>         Jumpstart your
>         > developing skills, take BlackBerry mobile applications to
>         market and stay
>         > ahead of the curve. Join us from November 9&#45;12, 2009.
>         Register now&#33;
>         > http://p.sf.net/sfu/devconf
>         > _______________________________________________ W3af-users
>         mailing list W3af-users@...
>         https://lists.sourceforge.net/lists/listinfo/w3af-users
>         --
>         Taras - OSCP, OSWP
>         ----
>         "Software is like sex: it's better when it's free." - Linus
>         Torvalds
> 
-- 
Taras - OSCP, OSWP
----
"Software is like sex: it's better when it's free." - Linus Torvalds

I uninstalled the nltk Fedora package and it's working fine now.

On Wed, Oct 7, 2009 at 3:42 PM, Taras <taras@...> wrote:

>
> Hello!
>
> Hmm, it's strange, but I haven't any nltk module installed.
> And I haven't any errors.
>
> Could you please remove plugins/discovery/wordnet.py and try to run
> w3af_console?
>
> Please, reply to mail list also.
>
> On Tue, 2009-10-06 at 16:26 -0400, T H wrote:
> > I installed the Fedora nltk package via yum.
> >
> > In the setup instructions, there is a step to run:
> >
> > python setup.py install in the directory you mention (extlib/nltk),
> > however there is no setup.py file in that directory. I reinstalled and
> > re-extracted the package a number of times - never found the setup.py
> > file.
> >
> > On Tue, Oct 6, 2009 at 4:07 PM, Taras <taras@...> wrote:
> >         Hello, T H!
> >
> >         Thanks for interesting in W3AF :)
> >
> >         On Tue, 2009-10-06 at 12:55 -0400, T H wrote:
> >         > I've just recently started messing around w/ w3af and I
> >         can't seem to
> >         > run the console UI:
> >         >
> >         > # ./w3af_console
> >         > Error while reading plugin options.
> >         > There was an error while importing
> >         plugins.discovery.wordnet: "cannot
> >         > import name wordnet".
> >
> >         Hmm, did you install W3AF_DIR/extlib/nltk package?
> >
> >
> >         >
> >         > I'm running the supported version of python (2.5.x) and have
> >         installed
> >         > all the necessary dependencies. I've tried running the
> >         manual python
> >         > setup instrutcions in the user manual as well as skipping
> >         them all -
> >         > nothing makes any difference. I've downloaded the latest
> >         release
> >         > (wsaf_1.0-rc2.tar.bz2 from April 3, 2009).
> >         >
> >         > If anyone can provide any assistance, it would be greatly
> >         appreciate -
> >         > thank you all!
> >
> >         >
> >
> ------------------------------------------------------------------------------
> >         > Come build with us! The BlackBerry&reg; Developer Conference
> >         in SF, CA
> >         > is the only developer event you need to attend this year.
> >         Jumpstart your
> >         > developing skills, take BlackBerry mobile applications to
> >         market and stay
> >         > ahead of the curve. Join us from November 9&#45;12, 2009.
> >         Register now&#33;
> >         > http://p.sf.net/sfu/devconf
> >         > _______________________________________________ W3af-users
> >         mailing list W3af-users@...
> >         https://lists.sourceforge.net/lists/listinfo/w3af-users
> >         --
> >         Taras - OSCP, OSWP
> >         ----
> >         "Software is like sex: it's better when it's free." - Linus
> >         Torvalds
> >
> --
> Taras - OSCP, OSWP
> ----
> "Software is like sex: it's better when it's free." - Linus Torvalds
>

How I envy you!... :)

>     I'm in Toronto, Canada. If you would like to have dinner and a
> beer, send me a private email!
> 

-- 
Taras - OSCP, OSWP
----
"Software is like sex: it's better when it's free." - Linus Torvalds

Default configurations with debugging and information disclosure. You
are almost garanteed to trip on one of those. Sometime it gives you
access to way too much information, like environment configuration,
accounts name (and even passwords, I saw that two weeks ago),
installation paths, generated reports etc.

XSS is still really frequent too.

Sébastien

On Mon, Oct 5, 2009 at 2:16 PM, steve jacobs <stevejacobs123@...> wrote:
> Out of interest, I'd be interested to know what vulnerabilities show up in
> most apps you review? I guess gaping SQLi flaws are rare in companies with
> decent programmers, but are there some vulnerabilties that show up time and
> time against when you do these security audits? I'm seriously intreged in
> the w3af framework. What would you say are the top offenders (vulnerability
> wise) that always show up in almost any app?
>
> Thanks,
> Steve J.
>
> ________________________________
> Have more than one Hotmail account? Link them together to easily access
> both.
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
>

Steve,

On Mon, Oct 5, 2009 at 3:16 PM, steve jacobs <stevejacobs123@...> wrote:
> Out of interest, I'd be interested to know what vulnerabilities show up in
> most apps you review? I guess gaping SQLi flaws are rare in companies with
> decent programmers, but are there some vulnerabilties that show up time and
> time against when you do these security audits? I'm seriously intreged in
> the w3af framework. What would you say are the top offenders (vulnerability
> wise) that always show up in almost any app?

Well... in my experience, SQL injection is there in at least 65% of
the web applications I've tested. I usually test web applications from
banks, financial institutions, online carts, etc. for companies in
South America and USA. Also, XSS and local file read are two common
vulnerabilities that you'll find in most assessments.

Cheers,

>
> Thanks,
> Steve J.
>
> ________________________________
> Have more than one Hotmail account? Link them together to easily access
> both.
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

rXSS for me is the most frequent by volume. We do see info disclosure
and error message type findings on every one as well. There are a few
that don't show up often, but that is because the technology isn't in
use as much. (WSDL, SSI, and ORM are a few examples)
I typically see highs (sql injection, xss, OS commanding, etc) on 99%
of the apps reviewed.
SQLi is actually more common than you might think. Problem is, its
been buried behind WAFs and pretty error messages, so you don't get
DBMS errors like you used to as much. Typically I end up fighting the
WAF over SQLi, and sometimes I lose. =)
This is not related to using the W3AF Tool, but a generalization of
reviews in general.

-Brad Causey
CISSP, MCSE, C|EH, CIFI, CGSP

http://www.owasp.org
--
Never underestimate the time, expense, and effort an opponent will
expend to break a code. (Robert Morris)
--



On Mon, Oct 5, 2009 at 2:32 PM, Andres Riancho <andres.riancho@...> wrote:
> Steve,
>
> On Mon, Oct 5, 2009 at 3:16 PM, steve jacobs <stevejacobs123@...> wrote:
>> Out of interest, I'd be interested to know what vulnerabilities show up in
>> most apps you review? I guess gaping SQLi flaws are rare in companies with
>> decent programmers, but are there some vulnerabilties that show up time and
>> time against when you do these security audits? I'm seriously intreged in
>> the w3af framework. What would you say are the top offenders (vulnerability
>> wise) that always show up in almost any app?
>
> Well... in my experience, SQL injection is there in at least 65% of
> the web applications I've tested. I usually test web applications from
> banks, financial institutions, online carts, etc. for companies in
> South America and USA. Also, XSS and local file read are two common
> vulnerabilities that you'll find in most assessments.
>
> Cheers,
>
>>
>> Thanks,
>> Steve J.
>>
>> ________________________________
>> Have more than one Hotmail account? Link them together to easily access
>> both.
>> ------------------------------------------------------------------------------
>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>> http://p.sf.net/sfu/devconf
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>>
>
>
>
> --
> Andrés Riancho
> Founder, Bonsai - Information Security
> http://www.bonsai-sec.com/
> http://w3af.sf.net/
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>

Something I was forgetting... "Business logic flaws" ! Those are my
favorite, and they are always there, no matter if there is a WAF or
not, you'll always find them.

Cheers,

On Mon, Oct 5, 2009 at 4:47 PM, Brad Causey <bradcausey@...> wrote:
> rXSS for me is the most frequent by volume. We do see info disclosure
> and error message type findings on every one as well. There are a few
> that don't show up often, but that is because the technology isn't in
> use as much. (WSDL, SSI, and ORM are a few examples)
> I typically see highs (sql injection, xss, OS commanding, etc) on 99%
> of the apps reviewed.
> SQLi is actually more common than you might think. Problem is, its
> been buried behind WAFs and pretty error messages, so you don't get
> DBMS errors like you used to as much. Typically I end up fighting the
> WAF over SQLi, and sometimes I lose. =)
> This is not related to using the W3AF Tool, but a generalization of
> reviews in general.
>
> -Brad Causey
> CISSP, MCSE, C|EH, CIFI, CGSP
>
> http://www.owasp.org
> --
> Never underestimate the time, expense, and effort an opponent will
> expend to break a code. (Robert Morris)
> --
>
>
>
> On Mon, Oct 5, 2009 at 2:32 PM, Andres Riancho <andres.riancho@...> wrote:
>> Steve,
>>
>> On Mon, Oct 5, 2009 at 3:16 PM, steve jacobs <stevejacobs123@...> wrote:
>>> Out of interest, I'd be interested to know what vulnerabilities show up in
>>> most apps you review? I guess gaping SQLi flaws are rare in companies with
>>> decent programmers, but are there some vulnerabilties that show up time and
>>> time against when you do these security audits? I'm seriously intreged in
>>> the w3af framework. What would you say are the top offenders (vulnerability
>>> wise) that always show up in almost any app?
>>
>> Well... in my experience, SQL injection is there in at least 65% of
>> the web applications I've tested. I usually test web applications from
>> banks, financial institutions, online carts, etc. for companies in
>> South America and USA. Also, XSS and local file read are two common
>> vulnerabilities that you'll find in most assessments.
>>
>> Cheers,
>>
>>>
>>> Thanks,
>>> Steve J.
>>>
>>> ________________________________
>>> Have more than one Hotmail account? Link them together to easily access
>>> both.
>>> ------------------------------------------------------------------------------
>>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>>> is the only developer event you need to attend this year. Jumpstart your
>>> developing skills, take BlackBerry mobile applications to market and stay
>>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>>> http://p.sf.net/sfu/devconf
>>> _______________________________________________
>>> W3af-users mailing list
>>> W3af-users@...
>>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>>
>>>
>>
>>
>>
>> --
>> Andrés Riancho
>> Founder, Bonsai - Information Security
>> http://www.bonsai-sec.com/
>> http://w3af.sf.net/
>>
>> ------------------------------------------------------------------------------
>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>> http://p.sf.net/sfu/devconf
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Steve,

    Please read inline,

On Fri, Oct 2, 2009 at 4:11 PM, steve jacobs <stevejacobs123@...> wrote:
> Dear Seasoned w3af users -
>
> Do you know which w3af plugins could help my company identify:
>
> a) Weak SQL Server passwords for our apps that have a backend SQL DB
> b) Weak MS Access passwords for our apps that have a backend MS Access DB

    Do you mean passwords in the database connection string?

> c) Passwords exposed in source code

    I don't think that's even possible to do.

> d) Weak passwords on Windows Servers running IIS
> e) Missing patches on Web Servers (IIS, Apache).

    This last two are out of w3af's scope.

> Any pointers if w3af can identify these would be great.
>
> Regards,
> Steve.
>
> ________________________________
> View your Twitter and Flickr updates from one place – Learn more!
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

Isn't it possible to use the "grep" module to look for instances of
password? Perhaps that might indicate potential disclosures. It might
yield a few false positives though.

Regards,

Christian

On Sat, Oct 3, 2009 at 3:43 AM, Andres Riancho <andres.riancho@...> wrote:
> Steve,
>
>    Please read inline,
>
> On Fri, Oct 2, 2009 at 4:11 PM, steve jacobs <stevejacobs123@...> wrote:
>> Dear Seasoned w3af users -
>>
>> Do you know which w3af plugins could help my company identify:
>>
>> a) Weak SQL Server passwords for our apps that have a backend SQL DB
>> b) Weak MS Access passwords for our apps that have a backend MS Access DB
>
>    Do you mean passwords in the database connection string?
>
>> c) Passwords exposed in source code
>
>    I don't think that's even possible to do.
>
>> d) Weak passwords on Windows Servers running IIS
>> e) Missing patches on Web Servers (IIS, Apache).
>
>    This last two are out of w3af's scope.
>
>> Any pointers if w3af can identify these would be great.
>>
>> Regards,
>> Steve.
>>
>> ________________________________
>> View your Twitter and Flickr updates from one place – Learn more!
>> ------------------------------------------------------------------------------
>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>> http://p.sf.net/sfu/devconf
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>>
>
>
>
> --
> Andrés Riancho
> Founder, Bonsai - Information Security
> http://www.bonsai-sec.com/
> http://w3af.sf.net/
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> W3af-users mailing list
> W3af-users@...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Christian Frichot
e: xntrik@...
p: 0433 490 117
w: http://un-excogitate.org

One of the plugins finds HTML comments with the words "passwd",
"password", "pass", and reports them. But as you say, this could
trigger some false positives. In my experience, it triggers when you
have something like this:

<script>
<!--
    var password = input1.text;
    validate( password );
    ...
-->
</script>

On Sun, Oct 4, 2009 at 9:29 PM, Christian Frichot <xntrik@...> wrote:
> Isn't it possible to use the "grep" module to look for instances of
> password? Perhaps that might indicate potential disclosures. It might
> yield a few false positives though.
>
> Regards,
>
> Christian
>
> On Sat, Oct 3, 2009 at 3:43 AM, Andres Riancho <andres.riancho@...> wrote:
>> Steve,
>>
>>    Please read inline,
>>
>> On Fri, Oct 2, 2009 at 4:11 PM, steve jacobs <stevejacobs123@...> wrote:
>>> Dear Seasoned w3af users -
>>>
>>> Do you know which w3af plugins could help my company identify:
>>>
>>> a) Weak SQL Server passwords for our apps that have a backend SQL DB
>>> b) Weak MS Access passwords for our apps that have a backend MS Access DB
>>
>>    Do you mean passwords in the database connection string?
>>
>>> c) Passwords exposed in source code
>>
>>    I don't think that's even possible to do.
>>
>>> d) Weak passwords on Windows Servers running IIS
>>> e) Missing patches on Web Servers (IIS, Apache).
>>
>>    This last two are out of w3af's scope.
>>
>>> Any pointers if w3af can identify these would be great.
>>>
>>> Regards,
>>> Steve.
>>>
>>> ________________________________
>>> View your Twitter and Flickr updates from one place – Learn more!
>>> ------------------------------------------------------------------------------
>>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>>> is the only developer event you need to attend this year. Jumpstart your
>>> developing skills, take BlackBerry mobile applications to market and stay
>>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>>> http://p.sf.net/sfu/devconf
>>> _______________________________________________
>>> W3af-users mailing list
>>> W3af-users@...
>>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>>
>>>
>>
>>
>>
>> --
>> Andrés Riancho
>> Founder, Bonsai - Information Security
>> http://www.bonsai-sec.com/
>> http://w3af.sf.net/
>>
>> ------------------------------------------------------------------------------
>> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
>> is the only developer event you need to attend this year. Jumpstart your
>> developing skills, take BlackBerry mobile applications to market and stay
>> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
>> http://p.sf.net/sfu/devconf
>> _______________________________________________
>> W3af-users mailing list
>> W3af-users@...
>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>
>
>
> --
> Christian Frichot
> e: xntrik@...
> p: 0433 490 117
> w: http://un-excogitate.org
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/