Difference between revisions of "OWASP Bywaf Project"

ByWaf

ByWaf is a web application penetration testing framework (WAPTF). It consists of a command-line interpreter and a set of plugins.

Introduction

Develop an application that streamlines the auditor's job when making a Pen Test. It's main fuction is to detect, evade and display vulnerabilities. The tool works using scripts developed by our teammembers throughout their experience.

Description

The Bywaf application is built on Python's built-in cmd.Cmd class. Cmd is a lightweight command interpreter loop that provides several useful facilities for the developer, including overridable hook methods and easy addition of commands and help. For the user, it offers commandline editing with readline, including automatic tab completion of commands, command options and filenames.

Bywaf contains a sub-classed version of Cmd called Wafterpreter, which adds some important additions, including:

  - Loading and selecting plugins
  - Getting and setting global and per-plugin options
  - Additional methods exposing functionality to the plugins
  - Backgrounding jobs, ending running jobs and querying job status
  - Loading scripts from the the command-line or within the interpreter   
  - Loading, saving, showing and clearing the command history

Wafterpreter employs a simple plugin system consisting of python modules containing commands exposed to the user (functions starting with "do_") and a dictionary of user-modifiable options ("options").

A number of Wafterpreter methods have been exposed to plugins, allowing them to change the interpreter's behavior and access other modules' options.

For notifications of changes in plugin options, Bywaf supports callback functions. The Wafterpreter will call a function for a given plugin option if it begins with "set_"; for example, for an option like "FILENAME", the Wafterpreter will search for and call a set_FILENAME(), if it exists. The Wafterpreter will also search for and call "set_default()", if it exists, for any option that does not have a specific setter function. Failing these attempts, Wafterpreter will perform a direct assignment on the plugin's option.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or Rafael Gil any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

Contact:

Home: https://www.owasp.org/index.php/OWASP_Bywaf_Project

Mail: rafael.gillarios@owasp.org

skype: depasonic0

What is ByWaf?

ByWaf provides:

• Pentesting tool
• Auditing tool
• so on

Quick Guide

• http://youtu.be/frpT7vQdzCc
• http://youtu.be/KWlsYZCzAIA
• http://youtu.be/KpRVVlWN2tQ

Project Leader

Project leader's name:

• Rafael Gil

Quick Download

• https://github.com/depasonico/OWASP-ByWaf

Sponsors

Wingware

News and Events

• Tool presented at OWASP appsec EU in Cambridge June 2014
• [Nov 15 2013] Beta release
• [May 4 2014] Release v1.0

Classifications