Category:OWASP Webslayer Project - Revision history

Cmartorella at 00:20, 15 December 2010

2010-12-15T00:20:27Z

Paulo Coimbra at 18:02, 9 March 2010

2010-03-09T18:02:12Z

Paulo Coimbra at 18:01, 9 March 2010

2010-03-09T18:01:19Z

Cmartorella at 23:17, 4 November 2008

2008-11-04T23:17:32Z

Cmartorella at 22:42, 2 November 2008

2008-11-02T22:42:20Z

Cmartorella at 22:32, 2 November 2008

2008-11-02T22:32:16Z

Cmartorella at 22:13, 2 November 2008

2008-11-02T22:13:04Z

Cmartorella at 22:06, 2 November 2008

2008-11-02T22:06:19Z

Cmartorella at 21:59, 2 November 2008

2008-11-02T21:59:25Z

Cmartorella at 21:39, 2 November 2008

2008-11-02T21:39:48Z

@@ Line 7: / Line 7: @@
 == Overview ==
-WebSlayer is a tool designed for bruteforcing Web Applications, it can be used for finding not linked resources (directories, servlets, scripts, etc), bruteforce GET and POST parameters, bruteforce Forms parameters (User/Password), Fuzzing, etc. The tools has a payload generator and a easy and powerful results analyzer.
+WebSlayer is a tool designed for brute forcing Web Applications, it can be used to discover not linked resources (directories, servlets, scripts, etc), brute force GET and POST parameters, brute force Forms parameters (User/Password), Fuzzing, etc. The tools has a payload generator and a easy and powerful results analyzer to aid the tester in all the brute force tests.
@@ Line 17: / Line 17: @@
 * Parameters brute force
 * Parameter fuzzing and Injection (XSS, SQL, etc)
-* Basic and Ntml Bruteforcing
+* Basic and Ntml brute forcing
 == Features ==
@@ Line 34: / Line 34: @@
 * Predefined dictionaries for predictable resource location, based on known servers (Thanks to Dark Raver, www.open-labs.org)
 * Payload Generator (custom payload generator)
 ===For Resource Location prediction===
 * Recursion: When discovering directories, you can set how deep to go
-* Non standard code error checking: Webslayer will detect NoN Standard Code, to avoid presenting trash results
+* Non standard code error checking: Webslayer will detect NoN Standard Code, to avoid presenting useless results
-* Extensions: You can add a list of extensions to try with a dictionary
+* Extensions: You can add a list of file extensions to a dictionary
@@ Line 90: / Line 92: @@
 ===Downloading===
-At the moment WebSlayer is available only for Windows platform as an installable, the source code will be available in the next release.
+At the moment WebSlayer is available in google code subversion:
-You can download the latest version from Google Code, and the current version has no dependencies.
 Grab the latest version from here: http://code.google.com/p/webslayer/downloads/list
@@ Line 97: / Line 102: @@
 ===Installing===
-There is a basic installation needed, just double click, select destination folder and it's done.
+It works fine with the OWASP LIVE CD, and Backtrack R2, just make sure you install:
 ===Launching a basic attack===
@@ Line 120: / Line 129: @@
 Also we are working in:
 * Adding more generators in the Payload Generator
 * The possibility to have more than 2 payloads
 * Changing the payload keyword convention (instead of ussing FUZZ, we will allow the use of @mypayload@)
 * Improving the logs
 * Multiple target URLS, ip range support for massive attacks
 * Responses diffing
-*  Check for backups of detected files (.bak,.old,.txt,etc)
+* Check for backups of detected files (.bak,.old,.txt,etc)
 Also we are working in the release of packages for Linux and OS X
@@ Line 142: / Line 141: @@
 ==Contacting us==
-There are two ways of getting information on WebSlayer. The mailing list, and contacting the project lead directly.
+There are two ways of getting information on WebSlayer. The mailing list, and contacting the project leader directly.
 Mailing list: https://lists.owasp.org/mailman/listinfo/owasp-webslayer-project

← Older revision		Revision as of 18:02, 9 March 2010
Line 157:		Line 157:

	The WebSlayer project is run by Christian Martorella and Carlos del Ojo from Edge-Security		The WebSlayer project is run by Christian Martorella and Carlos del Ojo from Edge-Security
−
−	~~[[Category:OWASP Project]]~~
−	~~[[Category:OWASP Tool]]~~
−	~~[[Category:OWASP Download]]~~

@@ Line 2: / Line 2: @@
 [[:Project Information:template Webslayer Project|Click here to see (& edit, if wanted) the template.]]
 {{:Project Information:template Webslayer Project}}
-[[Category:OWASP Project]]
+[[Category:OWASP Project|Webslayer Project]]

← Older revision		Revision as of 23:17, 4 November 2008
Line 127:		Line 127:
	* Improving the session restoring		* Improving the session restoring
	* Improving the Non standard code checking		* Improving the Non standard code checking
		+	* Multiple target URLS, ip range support for massive attacks
		+	* Responses diffing
		+	* Check for backups of detected files (.bak,.old,.txt,etc)
		+	* GUI Redesign
		+	* Crawler for getting the estructure as a starting points

← Older revision		Revision as of 22:42, 2 November 2008
Line 113:		Line 113:
	* 3- Now click the "Start attack" button		* 3- Now click the "Start attack" button

		+
		+	==Future Developments==
		+
		+	We are working on the new release of WebSlayer, which will have a complete engine redesign, and some changes in the GUI.
		+
		+	Also we are working in:
		+
		+	* Adding more encoders/decoders
		+	* Adding more generators in the Payload Generator
		+	* The possibility to have more than 2 payloads
		+	* Changing the payload keyword convention (instead of ussing FUZZ, we will allow the use of @mypayload@)
		+	* Improving the logs
		+	* Improving the session restoring
		+	* Improving the Non standard code checking
		+
		+
		+	One important area to work is the tailored dictionaries from know application/servers, it is important that the community participate providing new
		+	dictionaries of known applications.
		+
		+
		+	Also we are working in the release of packages for Linux and OS X

	==Contacting us==		==Contacting us==

← Older revision		Revision as of 22:32, 2 November 2008
Line 66:		Line 66:
	[[Image:Webslayer-analysis.jpg]]		[[Image:Webslayer-analysis.jpg]]

		+
		+
		+	==Payload Generator==
		+
		+	Another interesting feature of WebSlayer is the Payload Generator, with this tool you can create your custom payloads, for all your needs. It has some basic functions like:
		+
		+	* Files: You can load dictionaries and encode the content.
		+	* Numeric Ranges: Allow the creation of a numeric payload given a chosen range. Also allow to use a fixed width. Eg: "01","02",..,"09"
		+	* Block: You can create characters block, given a string or set of characters. Eg: "A" "AA" AAA" "AAAA"
		+	* Permutation: Given a charset and a width it will create all possibles permutations. Eg: "ABC", "ACB", "BAC" ..., "CBA"
		+	* Credit Cards: You can create well formed credit card numbers for testing shopping carts, and payment modules
		+	* Usernames: Given some names, it will create all the possibles combinations used in account naming patterns. Eg: John Doe: "j.doe","john.doe","johndoe", etc.
		+
		+	After you have some Generators, you can concatenate and create your final Payload, in the screenshot we created a Permutation of "abcaeiou" with a width of 5 characters, and for the final payload we concatenated the word "-owasp08" to the generator. The pattern to create the Payload is: [@PPerm00@]-owasp08
		+	Yo can drag'n'drop the temporal generator, to the Payload creator pattern:
		+
		+
		+	[[Image:Webslayer-payload.jpg]]

@@ Line 62: / Line 62: @@
 Webslayer will maintain all the attacks in the session so you can work with them, compare, check later, etc.
 ==Getting Started==
@@ Line 70: / Line 75: @@
 You can download the latest version from Google Code, and the current version has no dependencies.
-Grab the latest version from here: <a href="http://code.google.com/p/webslayer/downloads/list">Google code</a>
+Grab the latest version from here: http://code.google.com/p/webslayer/downloads/list
 ===Installing===
@@ Line 95: / Line 100: @@
 There are two ways of getting information on WebSlayer. The mailing list, and contacting the project lead directly.
-Mailing list: <a href="https://lists.owasp.org/mailman/listinfo/owasp-webslayer-project">https://lists.owasp.org/mailman/listinfo/owasp-webslayer-project</a>
+Mailing list: https://lists.owasp.org/mailman/listinfo/owasp-webslayer-project
 For content which is not appropriate for the public mailing list, you can alternatively contact Christian Martorella, at [cmartorella] at the [edge-security.com]

@@ Line 69: / Line 69: @@
 At the moment WebSlayer is available only for Windows platform as an installable, the source code will be available in the next release.
 You can download the latest version from Google Code, and the current version has no dependencies.
 ===Installing===
@@ Line 102: / Line 104: @@
 * a) Once a panel is detached how can i attach it again?
         You can attach the panel again by double clicking on the title bar

@@ Line 35: / Line 35: @@
 * Payload Generator (custom payload generator)
-===For Resource Location prediction, it supports:===
+===For Resource Location prediction===
 * Recursion: When discovering directories, you can set how deep to go
@@ Line 84: / Line 84: @@
 http://www.mysite.com/FUZZ
 </pre>
-* 2- Next we are going to choose the payload type, we will leave "Dictionary", and we are going to choose a dictionary file, in this case i recommend to use the file "common.txt"
+* 2- Next we are going to choose the payload type, we will leave "Dictionary", and we are going to choose a dictionary file, in this case i recommend to use the file "common.txt", which is located in the wordlists folder.
 * 3- Now click the "Start attack" button
@@ Line 98: / Line 98: @@
-==FAQ's==
+* a) Once a panel is detached how can i attach it again?

@@ Line 8: / Line 8: @@
 WebSlayer is a tool designed for bruteforcing Web Applications, it can be used for finding not linked resources (directories, servlets, scripts, etc), bruteforce GET and POST parameters, bruteforce Forms parameters (User/Password), Fuzzing, etc. The tools has a payload generator and a easy and powerful results analyzer.
 It's possible to perform attacks like:
@@ Line 60: / Line 61: @@
 * Regular expression
-Webslayer will maintain all the attacks in the session so you can work with them, compare, check later, etc.
+For content which is not appropriate for the public mailing list, you can alternatively contact Christian Martorella, at [cmartorella] at the [edge-security.com]