Automated Audit using W3AF - Revision history

Dominique RIGHETTO: Add VIM syntax file

2013-04-30T20:19:00Z

Add VIM syntax file

2013-04-27T13:09:39Z

2013-04-27T13:08:48Z

2013-04-27T11:24:03Z

Update format

2013-04-27T11:10:34Z

Update to take in account W3AF current release

2013-01-30T17:02:31Z

Update W3AF url

2012-03-08T20:27:56Z

Remove Audit Script Category

2012-03-02T20:19:23Z

2012-03-02T20:18:46Z

2012-02-25T10:16:51Z

Add article finality

← Older revision		Revision as of 20:19, 30 April 2013
Line 89:		Line 89:

	==Script edition==		==Script edition==
−	A VIM syntax file is ~~under progress, it will be released very soon~~...	+	A VIM syntax file is available [http://www.vim.org/scripts/script.php?script_id=4567 here]...

← Older revision		Revision as of 13:09, 27 April 2013
Line 89:		Line 89:

	==Script edition==		==Script edition==
−	In progress...	+	A VIM syntax file is under progress, it will be released very soon...

@@ Line 42: / Line 42: @@
 back
 ##Specify list of GREP plugins type to use (grep plugin is a type of plugin that can find also vulnerabilities or informations disclosure)
-grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages, html_comments, objects, path_disclosure, private_ip, strange_headers, strange_http_codes, strange_parameters, strange_reason, url_session, xss_protection_header
+grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages,
 ##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin is a type of plugin that can find informations disclosure)
 infrastructure server_header, server_status, domain_dot, dot_net_errors

@@ Line 2: / Line 2: @@
 <pre style="color:#088A08">This type of article aims to provide to development team a easy/quick way to perform automated audit tests against their web application projects over implementation phase.</pre>
 ==Description==
 This page have to objective to show a W3AF sample script to automate audit of a web application.
 W3AF is a free and open source Web Application Attack and Audit Framework ([http://w3af.org/ W3AF homepage]).
 ''This script do not replace a manual audit but can be useful to perform a first validation''.
 ==Script content==
 <pre>
 # -----------------------------------------------------------------------------------------------------------
 #                                              W3AF AUDIT SCRIPT FOR WEB APPLICATION
 # -----------------------------------------------------------------------------------------------------------
 #Configure HTTP settings
 http-settings
@@ Line 94: / Line 76: @@
 cleanup
 start
 </pre>
 Here the application [http://www.dvwa.co.uk/ Damn Vulnerable Web Application] as been used as target application.
 ==Script run==
 <pre>
 ./w3af_console -s MyScript.w3af
 </pre>
 After the script runs, the audit report is available in the location defined in clause "'''set fileName'''" ("'''/tmp/W3afReport.html'''" in the script example).
 ==Script edition==
 In progress...

@@ Line 7: / Line 7: @@
 This page have to objective to show a W3AF sample script to automate audit of a web application.
-W3AF is a free and open source Web Application Attack and Audit Framework ([http://w3af.sourceforge.net/ W3AF homepage]).
+W3AF is a free and open source Web Application Attack and Audit Framework ([http://w3af.org/ W3AF homepage]).
 ''This script do not replace a manual audit but can be useful to perform a first validation''.

@@ Line 124: / Line 124: @@
 [[Category:Code Snippet]]
 [[Category:Automated Audit]]
 [[Category:Externally Linked Page]]
 [[Category:Python]]

@@ Line 86: / Line 86: @@
              <Keywords name="Operators"></Keywords>
              <Keywords name="Comment"> 1 2 0#</Keywords>
-             <Keywords name="Words1">start plugins exploit profiles http&#x00AD;settings misc&#x00AD;settings target back assert help version keys view set</Keywords>
+             <Keywords name="Words1">start plugins exploit profiles http&#x00AD;settings misc&#x00AD;settings
              <Keywords name="Words2">mangle evasion discovery grep bruteforce audit output</Keywords>
              <Keywords name="Words3"></Keywords>

← Older revision		Revision as of 10:16, 25 February 2012
Line 1:		Line 1:
	Last revision (mm/dd/yy): '''02/13/2012'''		Last revision (mm/dd/yy): '''02/13/2012'''
		+	<pre style="color:#088A08">This type of article aims to provide to development team a easy/quick way to perform automated audit tests against their web application projects over implementation phase.</pre>

	==Description==		==Description==