w3af-users — User mailing list

[W3af-users] w3af API

[Guillermo D.A.G <ge...@gm...>]

Dear Andres,

First of all, congratulations for w3af, you are doing a great job. Now, im
working on the testing of several tools for private use, with an a
commercial approach, with acunetix, appscan, etc. and an open source
approach, with w3af, wapiti... The first gap that i found is the API
documentation (Restful or not). I saw some parallel project like
w3afRemote, but i dont know the maturity level of this project. Do you have
in mind publish (soon) an API Rest Documentation? I saw that
https://github.com/andresriancho/w3af/wiki/REST-API-v1.0 and this
http://comments.gmane.org/gmane.comp.security.w3af.user/1783 but if you
have a roadmap in mind would be nice!

Thanks in advance.

Best regards,

--

Guillermo de Ángel García / Senior Security Consultant
+34 630 340 920 / ge...@gm...

[image: Google Plus] <http://plus.google.com/+Guillermode%C3%81ngel/> [image:
Linkedin] <http://es.linkedin.com/in/gdeangelg/>

  *Cuidemos del medio ambiente. Por favor no imprimas este e-mail si no es
necesario.*

Re: [W3af-users] pass in target

[Andres R. <and...@gm...>]

Geoff,

    I remember answering this question before, and a small thread
about this (not sure if it was in the mailing list). The best solution
for me is to use some kind of templating system to generate the
scripts. Example:

// template.w3af file
# plugin configuration
target
set target http://__TARGET__/
back

// generator.py
for target in TARGET_LIST:
    template = file('template.w3af').read()
    template = template.replace('__TARGET__', target)
    file('%s.w3af', 'w').write(template)

    And then you run the generated scripts.

Regards,

On Wed, Jul 9, 2014 at 6:20 AM, Geoff Galitz <ge...@ga...> wrote:
>
>
> Hi.
>
> I'm looking for the best way to pass in a target from the shell to
> w3af_console.  Recommendations?  I have a script file that I want to
> iterate over numerous hosts which are generated dynamically.
>
>
> -G
>
>
>
> ------------------------------
> Geoff Galitz
> http://www.galitz.org
>
>
> ------------------------------------------------------------------------------
> Open source business process management suite built on Java and Eclipse
> Turn processes into business applications with Bonita BPM Community Edition
> Quickly connect people, data, and systems into organized workflows
> Winner of BOSSIE, CODIE, OW2 and Gartner awards
> http://p.sf.net/sfu/Bonitasoft
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] pass in target

[Geoff G. <ge...@ga...>]

Hi.

I'm looking for the best way to pass in a target from the shell to
w3af_console.  Recommendations?  I have a script file that I want to
iterate over numerous hosts which are generated dynamically.


-G



------------------------------
Geoff Galitz
http://www.galitz.org

Re: [W3af-users] Why report pragma/cache header errors for 404 or 302 responses?

[Andres R. <and...@gm...>]

Ben,

On Tue, Jul 8, 2014 at 11:10 AM, Ben Kirk <dav...@gm...> wrote:
> Hi,
> OK I understand the 404 issue now, that makes sense.

Cool,

>As for a pull request,
> sorry for a newbie question, are you talking about me making the change and
> submitting a PR to you? Is this via a fork or a branch? I use git at work
> but haven't done a PR with a shared github project before. I pulled latest
> and created a branch with the change but I can't push the change, I get
> error: The requested URL returned error: 403 Forbidden while accessing
> https://github.com/andresriancho/w3af.git/info/refs?service=git-receive-pack
> fatal: HTTP request failed
> I couldn't find any documentation on the site about exactly which process
> you'd like. Do I need to be added as a contributing dev? The suggested
> change is:
>
>         elif response.get_code() > 300\
>         and response.get_code() < 310:
>             return

Short answer: fork and then send a pull request.
Long answer: https://github.com/andresriancho/w3af/wiki/Contributing-101

>
>
> On Tue, Jul 8, 2014 at 6:10 AM, Andres Riancho <and...@gm...>
> wrote:
>>
>> Ben,
>>
>> Please read inline,
>>
>> On Mon, Jul 7, 2014 at 7:15 PM, Ben Kirk <dav...@gm...> wrote:
>> > hi all,
>> > I may be misreading my scan output results, but I get the following and
>> > when
>> > I check all of these specific IDs they are for redirects like 302 or a
>> > 404.
>> > Should this even be reported for HTTP responses that are not really
>> > content
>> > for the user (like a normal 200 with HTML content)
>> >
>> > Is this something that can be filtered out? asking because I need to
>> > report
>> > these in our monthly deployments to production to our security team and
>> > I
>> > don't want to raise any unnecessary flags. I'm using the latest build in
>> > git
>> > as of today.
>> >
>> > However if these are truly issues I should fix I'm open to that.
>> >
>> > thanks for any discussion on this.
>> >
>> > [Mon Jul  7 22:06:42 2014 - vulnerability] The whole target web
>> > application
>> > has no protection (Pragma and Cache-Control headers) against sensitive
>> > content caching. This vulnerability was found in the requests with ids
>> > 16,
>> > 36, 42 to 43 and 50.
>>
>> Well, you raise an interesting point. I agree that it doesn't make
>> sense for these to be checked against 30x. I would be more than happy
>> to receive a pull-request which adds a check around here [0] for the
>> 30x codes. Actually, believe it or not, that if in [0] was intended to
>> match that situation, but it wasn't a complete solution since some 30x
>> do have response bodies.
>>
>> RE: 404 codes, I believe that cache_control.py can't simply say: "we
>> don't care about them". Some 404 pages do have some private
>> information (at least the email address of the user?)
>>
>> Does this make sense? Do you have the time to send me that small PR?
>>
>> [0]
>> https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/cache_control.py#L58
>>
>> >
>> > ------------------------------------------------------------------------------
>> > Open source business process management suite built on Java and Eclipse
>> > Turn processes into business applications with Bonita BPM Community
>> > Edition
>> > Quickly connect people, data, and systems into organized workflows
>> > Winner of BOSSIE, CODIE, OW2 and Gartner awards
>> > http://p.sf.net/sfu/Bonitasoft
>> > _______________________________________________
>> > W3af-users mailing list
>> > W3a...@li...
>> > https://lists.sourceforge.net/lists/listinfo/w3af-users
>> >
>>
>>
>>
>> --
>> Andrés Riancho
>> Project Leader at w3af - http://w3af.org/
>> Web Application Attack and Audit Framework
>> Twitter: @w3af
>> GPG: 0x93C344F3
>
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] Why report pragma/cache header errors for 404 or 302 responses?

[Andres R. <and...@gm...>]

Ben,

Please read inline,

On Mon, Jul 7, 2014 at 7:15 PM, Ben Kirk <dav...@gm...> wrote:
> hi all,
> I may be misreading my scan output results, but I get the following and when
> I check all of these specific IDs they are for redirects like 302 or a 404.
> Should this even be reported for HTTP responses that are not really content
> for the user (like a normal 200 with HTML content)
>
> Is this something that can be filtered out? asking because I need to report
> these in our monthly deployments to production to our security team and I
> don't want to raise any unnecessary flags. I'm using the latest build in git
> as of today.
>
> However if these are truly issues I should fix I'm open to that.
>
> thanks for any discussion on this.
>
> [Mon Jul  7 22:06:42 2014 - vulnerability] The whole target web application
> has no protection (Pragma and Cache-Control headers) against sensitive
> content caching. This vulnerability was found in the requests with ids 16,
> 36, 42 to 43 and 50.

Well, you raise an interesting point. I agree that it doesn't make
sense for these to be checked against 30x. I would be more than happy
to receive a pull-request which adds a check around here [0] for the
30x codes. Actually, believe it or not, that if in [0] was intended to
match that situation, but it wasn't a complete solution since some 30x
do have response bodies.

RE: 404 codes, I believe that cache_control.py can't simply say: "we
don't care about them". Some 404 pages do have some private
information (at least the email address of the user?)

Does this make sense? Do you have the time to send me that small PR?

[0] https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/cache_control.py#L58

> ------------------------------------------------------------------------------
> Open source business process management suite built on Java and Eclipse
> Turn processes into business applications with Bonita BPM Community Edition
> Quickly connect people, data, and systems into organized workflows
> Winner of BOSSIE, CODIE, OW2 and Gartner awards
> http://p.sf.net/sfu/Bonitasoft
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] Why report pragma/cache header errors for 404 or 302 responses?

[Ben K. <dav...@gm...>]

hi all,
I may be misreading my scan output results, but I get the following and
when I check all of these specific IDs they are for redirects like 302 or a
404. Should this even be reported for HTTP responses that are not really
content for the user (like a normal 200 with HTML content)

Is this something that can be filtered out? asking because I need to report
these in our monthly deployments to production to our security team and I
don't want to raise any unnecessary flags. I'm using the latest build in
git as of today.

However if these are truly issues I should fix I'm open to that.

thanks for any discussion on this.

[Mon Jul  7 22:06:42 2014 - vulnerability] The whole target web application
has no protection (Pragma and Cache-Control headers) against sensitive
content caching. This vulnerability was found in the requests with ids 16,
36, 42 to 43 and 50.

Re: [W3af-users] W3af in metasploit

[Andres R. <and...@gm...>]

Its impossible to answer your questions, first read:
http://www.catb.org/esr/faqs/smart-questions.html

And then ask your question using it.

On Sun, Jul 6, 2014 at 3:50 PM, risataim cusan <ris...@gm...> wrote:
> create plugin to w3af ??
>
> El jul 5, 2014 2:01 PM, "Andres Riancho" <and...@gm...>
> escribió:
>
>> Please ask specific questions, and decide which one you want to ask :)
>>
>> 2014-07-05 14:16 GMT-03:00 risataim cusan <ris...@gm...>:
>> > As use w3af + metasploit ??
>> >
>> > Como uso w3af  y metasploit
>> >
>> > Como puedo crear un plugin para w3af ??
>>
>>
>>
>> --
>> Andrés Riancho
>> Project Leader at w3af - http://w3af.org/
>> Web Application Attack and Audit Framework
>> Twitter: @w3af
>> GPG: 0x93C344F3



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] W3af in metasploit

[risataim c. <ris...@gm...>]

create plugin to w3af ??
El jul 5, 2014 2:01 PM, "Andres Riancho" <and...@gm...>
escribió:

> Please ask specific questions, and decide which one you want to ask :)
>
> 2014-07-05 14:16 GMT-03:00 risataim cusan <ris...@gm...>:
> > As use w3af + metasploit ??
> >
> > Como uso w3af  y metasploit
> >
> > Como puedo crear un plugin para w3af ??
>
>
>
> --
> Andrés Riancho
> Project Leader at w3af - http://w3af.org/
> Web Application Attack and Audit Framework
> Twitter: @w3af
> GPG: 0x93C344F3
>

Re: [W3af-users] W3af in metasploit

[Andres R. <and...@gm...>]

Please ask specific questions, and decide which one you want to ask :)

2014-07-05 14:16 GMT-03:00 risataim cusan <ris...@gm...>:
> As use w3af + metasploit ??
>
> Como uso w3af  y metasploit
>
> Como puedo crear un plugin para w3af ??



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] W3af in metasploit

[risataim c. <ris...@gm...>]

As use w3af + metasploit ??

Como uso w3af  y metasploit

Como puedo crear un plugin para w3af ??

Re: [W3af-users] Scan mobile devices with w3af

[Aman T. <ama...@gm...>]

ok great.....thanks for the kind info....Mr. Riancho.....I appreciate your
frequent replies....thanks


On Tue, Jun 24, 2014 at 9:44 PM, Andres Riancho <and...@gm...>
wrote:

> Correct
>
> On Tue, Jun 24, 2014 at 12:40 PM, Aman Thakur
> <ama...@gm...> wrote:
> > Yes, even I was thinking that these mobile devices don't run any remote
> > services which could be very unusual case. And will it be same for the
> > normal user's desktops and laptops as well?
> >
> >
> > On Tue, Jun 24, 2014 at 8:56 PM, Andres Riancho <
> and...@gm...>
> > wrote:
> >>
> >> Well, w3af scans web applications, so if your phone exposes a web
> >> server you'll be able to scan it. That's REALLY uncommon.
> >>
> >> On the other hand, some web apps are designed for being accessed from
> >> mobile devices. Those are good targets for w3af
> >>
> >> On Tue, Jun 24, 2014 at 12:10 PM, Aman Thakur
> >> <ama...@gm...> wrote:
> >> > Hi guys,
> >> > Good Day!!
> >> >
> >> > I was thinking about the scanning process of w3af for devices. So i
> >> > thought
> >> > it would be better to discuss it over here.
> >> >
> >> > I wanted to ask, is it possible to scan mobile devices for
> >> > vulnerabilities
> >> > with w3af??
> >> >
> >> > Thanks
> >> >
> >> > With Regards
> >> > Aman Thakur
> >> >
> >> >
> >> >
> ------------------------------------------------------------------------------
> >> > Open source business process management suite built on Java and
> Eclipse
> >> > Turn processes into business applications with Bonita BPM Community
> >> > Edition
> >> > Quickly connect people, data, and systems into organized workflows
> >> > Winner of BOSSIE, CODIE, OW2 and Gartner awards
> >> > http://p.sf.net/sfu/Bonitasoft
> >> > _______________________________________________
> >> > W3af-users mailing list
> >> > W3a...@li...
> >> > https://lists.sourceforge.net/lists/listinfo/w3af-users
> >> >
> >>
> >>
> >>
> >> --
> >> Andrés Riancho
> >> Project Leader at w3af - http://w3af.org/
> >> Web Application Attack and Audit Framework
> >> Twitter: @w3af
> >> GPG: 0x93C344F3
> >
> >
>
>
>
> --
> Andrés Riancho
> Project Leader at w3af - http://w3af.org/
> Web Application Attack and Audit Framework
> Twitter: @w3af
> GPG: 0x93C344F3
>

Re: [W3af-users] Scan mobile devices with w3af

[Andres R. <and...@gm...>]

Correct

On Tue, Jun 24, 2014 at 12:40 PM, Aman Thakur
<ama...@gm...> wrote:
> Yes, even I was thinking that these mobile devices don't run any remote
> services which could be very unusual case. And will it be same for the
> normal user's desktops and laptops as well?
>
>
> On Tue, Jun 24, 2014 at 8:56 PM, Andres Riancho <and...@gm...>
> wrote:
>>
>> Well, w3af scans web applications, so if your phone exposes a web
>> server you'll be able to scan it. That's REALLY uncommon.
>>
>> On the other hand, some web apps are designed for being accessed from
>> mobile devices. Those are good targets for w3af
>>
>> On Tue, Jun 24, 2014 at 12:10 PM, Aman Thakur
>> <ama...@gm...> wrote:
>> > Hi guys,
>> > Good Day!!
>> >
>> > I was thinking about the scanning process of w3af for devices. So i
>> > thought
>> > it would be better to discuss it over here.
>> >
>> > I wanted to ask, is it possible to scan mobile devices for
>> > vulnerabilities
>> > with w3af??
>> >
>> > Thanks
>> >
>> > With Regards
>> > Aman Thakur
>> >
>> >
>> > ------------------------------------------------------------------------------
>> > Open source business process management suite built on Java and Eclipse
>> > Turn processes into business applications with Bonita BPM Community
>> > Edition
>> > Quickly connect people, data, and systems into organized workflows
>> > Winner of BOSSIE, CODIE, OW2 and Gartner awards
>> > http://p.sf.net/sfu/Bonitasoft
>> > _______________________________________________
>> > W3af-users mailing list
>> > W3a...@li...
>> > https://lists.sourceforge.net/lists/listinfo/w3af-users
>> >
>>
>>
>>
>> --
>> Andrés Riancho
>> Project Leader at w3af - http://w3af.org/
>> Web Application Attack and Audit Framework
>> Twitter: @w3af
>> GPG: 0x93C344F3
>
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] Scan mobile devices with w3af

[Aman T. <ama...@gm...>]

Yes, even I was thinking that these mobile devices don't run any remote
services which could be very unusual case. And will it be same for the
normal user's desktops and laptops as well?


On Tue, Jun 24, 2014 at 8:56 PM, Andres Riancho <and...@gm...>
wrote:

> Well, w3af scans web applications, so if your phone exposes a web
> server you'll be able to scan it. That's REALLY uncommon.
>
> On the other hand, some web apps are designed for being accessed from
> mobile devices. Those are good targets for w3af
>
> On Tue, Jun 24, 2014 at 12:10 PM, Aman Thakur
> <ama...@gm...> wrote:
> > Hi guys,
> > Good Day!!
> >
> > I was thinking about the scanning process of w3af for devices. So i
> thought
> > it would be better to discuss it over here.
> >
> > I wanted to ask, is it possible to scan mobile devices for
> vulnerabilities
> > with w3af??
> >
> > Thanks
> >
> > With Regards
> > Aman Thakur
> >
> >
> ------------------------------------------------------------------------------
> > Open source business process management suite built on Java and Eclipse
> > Turn processes into business applications with Bonita BPM Community
> Edition
> > Quickly connect people, data, and systems into organized workflows
> > Winner of BOSSIE, CODIE, OW2 and Gartner awards
> > http://p.sf.net/sfu/Bonitasoft
> > _______________________________________________
> > W3af-users mailing list
> > W3a...@li...
> > https://lists.sourceforge.net/lists/listinfo/w3af-users
> >
>
>
>
> --
> Andrés Riancho
> Project Leader at w3af - http://w3af.org/
> Web Application Attack and Audit Framework
> Twitter: @w3af
> GPG: 0x93C344F3
>

Re: [W3af-users] Scan mobile devices with w3af

[Andres R. <and...@gm...>]

Well, w3af scans web applications, so if your phone exposes a web
server you'll be able to scan it. That's REALLY uncommon.

On the other hand, some web apps are designed for being accessed from
mobile devices. Those are good targets for w3af

On Tue, Jun 24, 2014 at 12:10 PM, Aman Thakur
<ama...@gm...> wrote:
> Hi guys,
> Good Day!!
>
> I was thinking about the scanning process of w3af for devices. So i thought
> it would be better to discuss it over here.
>
> I wanted to ask, is it possible to scan mobile devices for vulnerabilities
> with w3af??
>
> Thanks
>
> With Regards
> Aman Thakur
>
> ------------------------------------------------------------------------------
> Open source business process management suite built on Java and Eclipse
> Turn processes into business applications with Bonita BPM Community Edition
> Quickly connect people, data, and systems into organized workflows
> Winner of BOSSIE, CODIE, OW2 and Gartner awards
> http://p.sf.net/sfu/Bonitasoft
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] Scan mobile devices with w3af

[Aman T. <ama...@gm...>]

Hi guys,
Good Day!!

I was thinking about the scanning process of w3af for devices. So i thought
it would be better to discuss it over here.

I wanted to ask, is it possible to scan mobile devices for vulnerabilities
with w3af??

Thanks

With Regards
Aman Thakur

Re: [W3af-users] Script for automated testing

[Andres R. <and...@gm...>]

Could you send us the complete output from the console? Maybe a screenshot?

On Tue, Jun 24, 2014 at 11:12 AM, Shafeeque O.K [gmail]
<sha...@gm...> wrote:
> yes
>
> Regards,
> Shafeeque Olassery Kunnikkal C|EH,C|EI
> Graytips Cyber Technologies | www.graytips.com
>
>
>
>
> On Tue, Jun 24, 2014 at 7:37 PM, Andres Riancho <and...@gm...>
> wrote:
>>
>> Are you running ./w3af_console -s script.w3af ?
>>
>> On Tue, Jun 24, 2014 at 11:03 AM, Shafeeque O.K [gmail]
>> <sha...@gm...> wrote:
>> > Hi
>> >
>> > I am using the script which is taken from :
>> > https://www.owasp.org/index.php/Automated_Audit_using_W3AF
>> >
>> > done some editing removed the authentiucation details and the current
>> > version which I am using is given below. When I run the script, the
>> > scanning
>> > is not started instead it gives the console w3af>>
>> >
>> >
>> > Please guide, using the latest version of w3af in kali.
>> >
>> > Script is given below.
>> >
>> > #
>> >
>> > -----------------------------------------------------------------------------------------------------------
>> > #                                              W3AF AUDIT SCRIPT FOR WEB
>> > APPLICATION
>> > #
>> >
>> > -----------------------------------------------------------------------------------------------------------
>> > #Configure HTTP settings
>> > http-settings
>> > set timeout 30
>> > back
>> >
>> > #Configure scanner global behaviors
>> > misc-settings
>> > set max_discovery_time 20
>> > set fuzz_cookies True
>> > set fuzz_form_files True
>> > set fuzz_url_parts True
>> > set fuzz_url_filenames True
>> > back
>> >
>> >
>> > plugins
>> > #Configure entry point (CRAWLING) scanner
>> > crawl web_spider
>> > crawl config web_spider
>> > set only_forward False
>> > set ignore_regex (?i)(logout|disconnect|signout|exit)+
>> > back
>> >
>> >
>> > #Configure vulnerability scanners
>> > ##Specify list of AUDIT plugins type to use
>> > audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload,
>> > ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting,
>> > sqli,
>> > xpath, xss, xst
>> > ##Customize behavior of each audit plugin when needed
>> > audit config file_upload
>> > set extensions
>> > jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
>> > back
>> >
>> >
>> > ##Specify list of GREP plugins type to use (grep plugin is a type of
>> > plugin
>> > that can find also vulnerabilities or informations disclosure)
>> > grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js,
>> > csp,
>> > directory_indexing, dom_xss, error_500, error_pages,
>> > html_comments, objects, path_disclosure, private_ip, strange_headers,
>> > strange_http_codes, strange_parameters, strange_reason, url_session,
>> > xss_protection_header
>> >
>> >
>> > ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure
>> > plugin
>> > is a type of plugin that can find informations disclosure)
>> > infrastructure server_header, server_status, domain_dot, dot_net_errors
>> > back
>> >
>> >
>> > #Configure reporting in order to generate an HTML report
>> > output console, html_file
>> > output config html_file
>> > set output_file /tmp/samir-W3afReport.html
>> > set verbose False
>> > back
>> > output config console
>> > set verbose True
>> > back
>> >
>> >
>> > back
>> > #Set target informations, do a cleanup and run the scan
>> > target
>> > set target http://www.xxxxxxx.com
>> > back
>> >
>> > cleanup
>> > start
>> >
>> >
>> >
>> > shafeeque
>> >
>> >
>>
>>
>>
>> --
>> Andrés Riancho
>> Project Leader at w3af - http://w3af.org/
>> Web Application Attack and Audit Framework
>> Twitter: @w3af
>> GPG: 0x93C344F3
>
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] Script for automated testing

[Shafeeque O.K [gmail] <sha...@gm...>]

yes

Regards,
Shafeeque Olassery Kunnikkal C|EH,C|EI
Graytips Cyber Technologies | www.graytips.com




On Tue, Jun 24, 2014 at 7:37 PM, Andres Riancho <and...@gm...>
wrote:

> Are you running ./w3af_console -s script.w3af ?
>
> On Tue, Jun 24, 2014 at 11:03 AM, Shafeeque O.K [gmail]
> <sha...@gm...> wrote:
> > Hi
> >
> > I am using the script which is taken from :
> > https://www.owasp.org/index.php/Automated_Audit_using_W3AF
> >
> > done some editing removed the authentiucation details and the current
> > version which I am using is given below. When I run the script, the
> scanning
> > is not started instead it gives the console w3af>>
> >
> >
> > Please guide, using the latest version of w3af in kali.
> >
> > Script is given below.
> >
> > #
> >
> -----------------------------------------------------------------------------------------------------------
> > #                                              W3AF AUDIT SCRIPT FOR WEB
> > APPLICATION
> > #
> >
> -----------------------------------------------------------------------------------------------------------
> > #Configure HTTP settings
> > http-settings
> > set timeout 30
> > back
> >
> > #Configure scanner global behaviors
> > misc-settings
> > set max_discovery_time 20
> > set fuzz_cookies True
> > set fuzz_form_files True
> > set fuzz_url_parts True
> > set fuzz_url_filenames True
> > back
> >
> >
> > plugins
> > #Configure entry point (CRAWLING) scanner
> > crawl web_spider
> > crawl config web_spider
> > set only_forward False
> > set ignore_regex (?i)(logout|disconnect|signout|exit)+
> > back
> >
> >
> > #Configure vulnerability scanners
> > ##Specify list of AUDIT plugins type to use
> > audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload,
> > ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting,
> sqli,
> > xpath, xss, xst
> > ##Customize behavior of each audit plugin when needed
> > audit config file_upload
> > set extensions
> > jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
> > back
> >
> >
> > ##Specify list of GREP plugins type to use (grep plugin is a type of
> plugin
> > that can find also vulnerabilities or informations disclosure)
> > grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js,
> csp,
> > directory_indexing, dom_xss, error_500, error_pages,
> > html_comments, objects, path_disclosure, private_ip, strange_headers,
> > strange_http_codes, strange_parameters, strange_reason, url_session,
> > xss_protection_header
> >
> >
> > ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure
> plugin
> > is a type of plugin that can find informations disclosure)
> > infrastructure server_header, server_status, domain_dot, dot_net_errors
> > back
> >
> >
> > #Configure reporting in order to generate an HTML report
> > output console, html_file
> > output config html_file
> > set output_file /tmp/samir-W3afReport.html
> > set verbose False
> > back
> > output config console
> > set verbose True
> > back
> >
> >
> > back
> > #Set target informations, do a cleanup and run the scan
> > target
> > set target http://www.xxxxxxx.com
> > back
> >
> > cleanup
> > start
> >
> >
> >
> > shafeeque
> >
> >
>
>
>
> --
> Andrés Riancho
> Project Leader at w3af - http://w3af.org/
> Web Application Attack and Audit Framework
> Twitter: @w3af
> GPG: 0x93C344F3
>

Re: [W3af-users] Script for automated testing

[Andres R. <and...@gm...>]

Are you running ./w3af_console -s script.w3af ?

On Tue, Jun 24, 2014 at 11:03 AM, Shafeeque O.K [gmail]
<sha...@gm...> wrote:
> Hi
>
> I am using the script which is taken from :
> https://www.owasp.org/index.php/Automated_Audit_using_W3AF
>
> done some editing removed the authentiucation details and the current
> version which I am using is given below. When I run the script, the scanning
> is not started instead it gives the console w3af>>
>
>
> Please guide, using the latest version of w3af in kali.
>
> Script is given below.
>
> #
> -----------------------------------------------------------------------------------------------------------
> #                                              W3AF AUDIT SCRIPT FOR WEB
> APPLICATION
> #
> -----------------------------------------------------------------------------------------------------------
> #Configure HTTP settings
> http-settings
> set timeout 30
> back
>
> #Configure scanner global behaviors
> misc-settings
> set max_discovery_time 20
> set fuzz_cookies True
> set fuzz_form_files True
> set fuzz_url_parts True
> set fuzz_url_filenames True
> back
>
>
> plugins
> #Configure entry point (CRAWLING) scanner
> crawl web_spider
> crawl config web_spider
> set only_forward False
> set ignore_regex (?i)(logout|disconnect|signout|exit)+
> back
>
>
> #Configure vulnerability scanners
> ##Specify list of AUDIT plugins type to use
> audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload,
> ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli,
> xpath, xss, xst
> ##Customize behavior of each audit plugin when needed
> audit config file_upload
> set extensions
> jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
> back
>
>
> ##Specify list of GREP plugins type to use (grep plugin is a type of plugin
> that can find also vulnerabilities or informations disclosure)
> grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp,
> directory_indexing, dom_xss, error_500, error_pages,
> html_comments, objects, path_disclosure, private_ip, strange_headers,
> strange_http_codes, strange_parameters, strange_reason, url_session,
> xss_protection_header
>
>
> ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin
> is a type of plugin that can find informations disclosure)
> infrastructure server_header, server_status, domain_dot, dot_net_errors
> back
>
>
> #Configure reporting in order to generate an HTML report
> output console, html_file
> output config html_file
> set output_file /tmp/samir-W3afReport.html
> set verbose False
> back
> output config console
> set verbose True
> back
>
>
> back
> #Set target informations, do a cleanup and run the scan
> target
> set target http://www.xxxxxxx.com
> back
>
> cleanup
> start
>
>
>
> shafeeque
>
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] Script for automated testing

[Shafeeque O.K [gmail] <sha...@gm...>]

Hi

I am using the script which is taken from :
https://www.owasp.org/index.php/Automated_Audit_using_W3AF

done some editing removed the authentiucation details and the current
version which I am using is given below. When I run the script, the
scanning is not started instead it gives the console w3af>>


Please guide, using the latest version of w3af in kali.

Script is given below.

#
-----------------------------------------------------------------------------------------------------------
#                                              W3AF AUDIT SCRIPT FOR WEB
APPLICATION
#
-----------------------------------------------------------------------------------------------------------
#Configure HTTP settings
http-settings
set timeout 30
back

#Configure scanner global behaviors
misc-settings
set max_discovery_time 20
set fuzz_cookies True
set fuzz_form_files True
set fuzz_url_parts True
set fuzz_url_filenames True
back


plugins
#Configure entry point (CRAWLING) scanner
crawl web_spider
crawl config web_spider
set only_forward False
set ignore_regex (?i)(logout|disconnect|signout|exit)+
back


#Configure vulnerability scanners
##Specify list of AUDIT plugins type to use
audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload,
ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting,
sqli, xpath, xss, xst
##Customize behavior of each audit plugin when needed
audit config file_upload
set extensions
jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
back


##Specify list of GREP plugins type to use (grep plugin is a type of plugin
that can find also vulnerabilities or informations disclosure)
grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp,
directory_indexing, dom_xss, error_500, error_pages,
html_comments, objects, path_disclosure, private_ip, strange_headers,
strange_http_codes, strange_parameters, strange_reason, url_session,
xss_protection_header


##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin
is a type of plugin that can find informations disclosure)
infrastructure server_header, server_status, domain_dot, dot_net_errors
back


#Configure reporting in order to generate an HTML report
output console, html_file
output config html_file
set output_file /tmp/samir-W3afReport.html
set verbose False
back
output config console
set verbose True
back


back
#Set target informations, do a cleanup and run the scan
target
set target http://www.xxxxxxx.com
back

cleanup
start



shafeeque

Re: [W3af-users] A new beta is here!

[Drexx L. [personal] <dr...@gm...>]

20Jun2014 (UTC +8)

Very cool. Many thanks! Will start to download in a few minutes.

On Fri, Jun 20, 2014 at 11:24 PM, Andres Riancho
<and...@gm...> wrote:
> List,
>
>     During the last 10 days I've been working really hard on fixing
> all the high priority bugs in w3af [0], most notably # 580 [1] which
> lead to a huge code refactoring which touched almost every file in the
> framework and modified the internals (for good!).
>
>     I just merged my feature/fix_580 branch into develop. All
> unittests PASS, but that doesn't mean that I didn't introduce any new
> bugs, I most likely did, so I want to ask you to run a couple of scans
> and report any exceptions. Here are the steps:
>
> # Update to the latest development release
> cd w3af
> git pull
> git checkout develop
> ./w3af_console --version
>
> # Run a scan against any of your favorite targets
> ./w3af_console
> # Configure and run the scan
> # ...
> # When scan finishes, report any bugs to our ticketing system
> bug-report
> list
> report
> back
> exit
>
>     The latest development branch version is 1.6.0.4, I'll be paying
> special attention to any issues reported with that version in the
> ticketing system.
>
>     Hopefully we'll be able to test this during the weekend and I'll
> be able to merge it to master (so that everyone gets the latest fixes)
> on Monday.
>
> Thanks!
>
> [0] https://github.com/andresriancho/w3af/issues?labels=priority%3Ahigh&milestone=10&page=1&state=open
> [1] https://github.com/andresriancho/w3af/issues/580
> --
> Andrés Riancho
> Project Leader at w3af - http://w3af.org/
> Web Application Attack and Audit Framework
> Twitter: @w3af
> GPG: 0x93C344F3



Drexx Laggui  -- CISA, CISSP, CFE Associate, ISO27001 LA, CCSI, CSA
http://www.laggui.com  ( Manila & California )
Computer forensics; Penetration testing; QMS & ISMS developers; K-Transfer
PGP fingerprint = 0117 15C5 F3B1 6564 59EA  6013 1308 9A66 41A2 3F9B

[W3af-users] A new beta is here!

[Andres R. <and...@gm...>]

List,

    During the last 10 days I've been working really hard on fixing
all the high priority bugs in w3af [0], most notably # 580 [1] which
lead to a huge code refactoring which touched almost every file in the
framework and modified the internals (for good!).

    I just merged my feature/fix_580 branch into develop. All
unittests PASS, but that doesn't mean that I didn't introduce any new
bugs, I most likely did, so I want to ask you to run a couple of scans
and report any exceptions. Here are the steps:

# Update to the latest development release
cd w3af
git pull
git checkout develop
./w3af_console --version

# Run a scan against any of your favorite targets
./w3af_console
# Configure and run the scan
# ...
# When scan finishes, report any bugs to our ticketing system
bug-report
list
report
back
exit

    The latest development branch version is 1.6.0.4, I'll be paying
special attention to any issues reported with that version in the
ticketing system.

    Hopefully we'll be able to test this during the weekend and I'll
be able to merge it to master (so that everyone gets the latest fixes)
on Monday.

Thanks!

[0] https://github.com/andresriancho/w3af/issues?labels=priority%3Ahigh&milestone=10&page=1&state=open
[1] https://github.com/andresriancho/w3af/issues/580
-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] Throttling requests

[Andres R. <and...@gm...>]

Simon,

    Yep, the answer is still the same. Usually people just want it to
go faster, not slower :)

    Pull-requests for adding this feature are welcome.

On Mon, Jun 9, 2014 at 9:04 AM,
<BM-...@bi...> wrote:
> Hi,
>
> I was searching the web on how to throttle w3af requests and only found:
> http://comments.gmane.org/gmane.comp.security.w3af.user/1015
>
> (from 2011)
>
> Is it still not available as a config option in w3af nowadays?
>
> thanks!
> Simon
>
>
>
> ------------------------------------------------------------------------------
> HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> Find What Matters Most in Your Big Data with HPCC Systems
> Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> http://www.hpccsystems.com
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

[W3af-users] Throttling requests

[<BM-...@bi...>]

Hi,

I was searching the web on how to throttle w3af requests and only found:
http://comments.gmane.org/gmane.comp.security.w3af.user/1015

(from 2011)

Is it still not available as a config option in w3af nowadays?

thanks!
Simon

Re: [W3af-users] [Gentoo] Help with packages w3af depend on

[Andres R. <and...@gm...>]

I believe you might be hitting this [0] bug. The solution might be to
disable the dependency_check (until #2703 is fixed).

[0] https://github.com/andresriancho/w3af/issues/2703

On Thu, May 8, 2014 at 12:11 PM, Raphael de Albuquerque Lima
<ra...@gm...> wrote:
> Hi all,
>
>
> I've got w3af to work under Gentoo once, quite a while ago, and now I'm
> unable to reproduce it and I can't find any trace of what I've done then
> (duh)
>
> I'm running a fully updated Gentoo, running Python 2.7, Python Targets with
> 2.7 support enabled for all packages.
>
> I've read all the documentation and searched forums/google'd for it, but i
> was unable to find which packages need to be installed prior to running it
> on Gentoo specifically, since the script points out Debian packages, I
> installed some packages that i believed to be Gentoo's similars, but I'm
> still missing something.
>
> I'm running both svn and stable (pentoo layman) versions, but can't use
> both.
>
> The error messages doesn't complaint about python dependencies nor pip's, as
> you can see below:
>
> w3af # ./w3af_gui
> w3af's requirements are not met, one or more third-party libraries need to
> be installed.
>
> On Debian systems please install the following operating system packages
> before running the pip installer:
>     sudo apt-get install build-essential python-setuptools git python-pip
> libssl-dev graphviz python2.7-dev libsqlite3-dev libxslt1-dev libyaml-dev
> python-gtksourceview2 python-gtk2 libxml2-dev
>
> A script with these commands has been created for you at
> /tmp/w3af_dependency_install.sh
>
>
>
> Doing some research, these are the equivalents of Debian's packages for
> Gentoo that I've installed:
>
> build-essential  ->  from what i've found, it's shipped with Gentoo (emerge
> system)
> python-setuptools  ->  installed dev-python/setuptools
> git  ->  installed dev-vcs/git
> python-pip  ->  installed dev-python/pip
> libssl-dev  ->  installed both  dev-libs/openssl and dev-python/pyopenssl
> graphviz  ->  installed both media-gfx/graphviz and dev-python/pygraphviz
> python2.7-dev  ->  installed dev-lang/python 2.7.6-r1 and it's the active
> python
> libsqlite3-dev  ->  installed: dev-db/sqlite dev-python/sqlite3dbm
> dev-python/sqlitecachec
> libxslt1-dev  -> installed  dev-libs/libxslt and dev-python/django-xslt
> (don't think this one is related but wouldn't hurt to try)
> libyaml-dev  ->  installed dev-libs/libyaml and dev-python/pyyaml
> python-gtksourceview2  ->  installed dev-python/pygtksourceview (2.10.1-r1)
> and x11-libs/gtksourceview both 2.0 and 3.0
> python-gtk2  ->  installed dev-python/pygtk 2.24.0-r4 and
> dev-python/pywebkitgtk
> libxml2-dev  ->  installed  dev-python/lxml and dev-python/pyxml
>
> Any help would be greatly appreciated.
>
> Sorry for any english mistakes.
>
> Thanks!
>
> - Raphael
>
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing platform
> available
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> _______________________________________________
> W3af-users mailing list
> W3a...@li...
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3

Re: [W3af-users] blacklist URL from being scanned by anything

[Andres R. <and...@gm...>]

Sorry for the very late response, I was offline.

The framework's blacklist should take care of blocking all requests,
to any URL you specify in the blacklist. I haven't tested your
specific case, but I don't see why it wouldn't work [0].

If you want to see this fixed, please send me an easy way to reproduce it:
    * A w3af script with an online target
    * A failing unittest written in python like [1]

[0] https://github.com/andresriancho/w3af/blob/master/w3af/core/data/url/handlers/blacklist.py#L58
[1] https://github.com/andresriancho/w3af/blob/master/w3af/core/data/url/handlers/tests/test_blacklist.py

On Wed, May 21, 2014 at 2:54 AM, Vojtěch Polášek <kr...@gm...> wrote:
> Hi,
> Okay. The target application is heavily dynamic (JSP). So I selected
> following way of scanning:
> I want to scan an authenticated part of the application.
> 1. I log in and export my cookie.
> 2. I created a profile which performs various testing, but main source
> of URLs is spider_man, because of technology in use.
> This profile uses exported cookie for maintaining session.
> But whenever anyone who has valid session cookie visits
> xxx.xxx.xxx.xxx/, the cookie is invalidated and so my scan returns no
> interesting results after doing this.
> For example, session breaks after probably phpinfo plugin visits:
> xxx.xxx.xxx.xxx/?mode=phpinfo
> I simply want to blacklist this individual URL:
> xxx.xxx.xxx.xxx/
>
> Or is there any other way of doing authenticated scan in this conditions?
> Thanks,
> Vojta
> Dne 20.5.2014 21:42, Andres Riancho napsal(a):
>> Vojtech,
>>
>>     Please read inline,
>>
>> On Tue, May 20, 2014 at 4:41 AM, Vojtěch Polášek <kr...@gm...> wrote:
>>> Hi,
>>> I am scanning a web application which is quite dynamic.
>>> I have to use spider_man to walk through it. There is one problem -
>>> whenever anyone tries to access its root URL (http://xxx.xxx.xxx.xxx/)
>>> it is redirected to a login form and therefore current cookie loses its
>>> validity.
>>> Is there any possibility to prevent every plugin from scanning this URL?
>>     Well... I believe you've found a rather strange bug. Let me better
>> understand:
>>         * What's the target you're setting for the scan?
>>         * Which URL is going into the blacklist?
>>
>>
>>> I added it into ignored urls in misc settings, but it doesn't help.
>>> Thanks,
>>> Vojta
>>>
>>> ------------------------------------------------------------------------------
>>> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
>>> Instantly run your Selenium tests across 300+ browser/OS combos.
>>> Get unparalleled scalability from the best Selenium testing platform available
>>> Simple to use. Nothing to install. Get started now for free."
>>> http://p.sf.net/sfu/SauceLabs
>>> _______________________________________________
>>> W3af-users mailing list
>>> W3a...@li...
>>> https://lists.sourceforge.net/lists/listinfo/w3af-users
>>
>>
>



-- 
Andrés Riancho
Project Leader at w3af - http://w3af.org/
Web Application Attack and Audit Framework
Twitter: @w3af
GPG: 0x93C344F3