w3af – Web Application Attack and Audit Framework


A pretty cool tool was released a while back called w3af ( Web Application Attack and Audit Framework ), a fully automated auditing and exploiting framework for the web. This framework has been in development for almost a year and has the following features:

Audit

  • SQL injection detection
  • XSS detection
  • SSI detection
  • Local file include detection
  • Remote file include detection
  • Buffer Overflow detection
  • Format String bugs detection
  • OS Commanding detection
  • Response Splitting detection
  • LDAP Injection detection
  • Basic Authentication bruteforce
  • File upload inside webroot
  • htaccess LIMIT misconfiguration
  • SSL certificate validation
  • XPATH injection detection
  • unSSL (HTTPS documents can be fetched using HTTP)

Discovery

  • Pykto, a nikto port to python
  • Hmap, http fingerprinting.
  • fingerGoogle, finds valid user accounts in google.
  • googleSpider, a spider that uses google.
  • webSpider, a classic web spider.
  • robotsReader
  • urlFuzzer
  • serverHeader, fetches server header
  • allowedMethods, gets a list of allowed HTTP methods.
  • crossDomain, get and parse the flash file crossdomain.xml
  • error404page, generate a regular expression to match 404 pages.
  • sitemapReader, read googles sitemap.xml and parse it.
  • spiderMan, using a localproxy and a human, find new URLs for auditing.
  • webDiff, find differences between a local and a remote directory.
  • wsdlFinder, find and parse WSDL and DISCO files.

The framework is extended using plug-ins and is completely written in Python.

You can download w3af here:

w3af BETA 4

Or read more here.

Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , , , ,


Latest Posts:


LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.


2 Responses to w3af – Web Application Attack and Audit Framework

  1. TheRealDonQuixote August 22, 2007 at 11:42 am #

    So far its been easy to install all the libs in Kubuntu. I like all the toys, and I haven’t hit a bug yet!! This might be a bit too easy…

    I wonder when they are going to get out of beta?

  2. Sandeep Nain August 31, 2007 at 2:03 am #

    Wowwww…

    This is a big step in web application security field.. Its gonna make the life of pen testers very easy.

    I’m gonna try this for sure..