This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Automated Audit using WAPITI"
From OWASP
m (Remove warning about source code update) |
|||
| Line 1: | Line 1: | ||
| − | Last revision (mm/dd/yy): ''' | + | Last revision (mm/dd/yy): '''01/13/2015''' |
| − | <pre style="color:#088A08">This type of article aims to provide to development | + | <pre style="color:#088A08">This type of article aims to provide to development teams an easy/quick way |
to perform automated audit tests against their web application projects over implementation phase.</pre> | to perform automated audit tests against their web application projects over implementation phase.</pre> | ||
== Description == | == Description == | ||
| − | + | WAPITI is a simple command line to tool to automate the audit of a web application. It's free and open source and has had some recent edits and updates ([http://wapiti.sourceforge.net/ WAPITI homepage]). The application is available for contribution at ([http://sourceforge.net/projects/wapiti/ WAPITI Repository]). | |
| − | + | Please be aware this command line does not replace a manual audit but can be useful to perform a first validation or exploration of legacy projects. | |
| − | |||
| − | |||
== Command line == | == Command line == | ||
| − | <pre>python wapiti | + | <pre>python wapiti http://mysite.com -n 10 -b folder -u -v 1 -f html -o /tmp/scan_report</pre> |
'''Options used:''' | '''Options used:''' | ||
* -n: Define a limit of urls to read with the same pattern (prevent endless loops), here limit to 10. | * -n: Define a limit of urls to read with the same pattern (prevent endless loops), here limit to 10. | ||
| − | * -b: Set the scope of the scan, here we | + | * -b: Set the scope of the scan, here we analyze all the links to the pages which are in the same domain as the URL passed. |
* -u: Use color to highlight vulnerables parameters in output. | * -u: Use color to highlight vulnerables parameters in output. | ||
* -v: Define verbosity level, here we print each url. | * -v: Define verbosity level, here we print each url. | ||
| Line 34: | Line 32: | ||
* ''sql'': Standard error-based SQL injection scanner. | * ''sql'': Standard error-based SQL injection scanner. | ||
* ''xss'': Module for XSS detection. | * ''xss'': Module for XSS detection. | ||
| + | * ''buster'': Module for a file and directory buster attack - checking for "bad" files. | ||
| + | * ''shellshock'': Module for Shellshock bug detection. | ||
== Report == | == Report == | ||
Revision as of 04:21, 14 January 2015
Last revision (mm/dd/yy): 01/13/2015
This type of article aims to provide to development teams an easy/quick way to perform automated audit tests against their web application projects over implementation phase.
Description
WAPITI is a simple command line to tool to automate the audit of a web application. It's free and open source and has had some recent edits and updates (WAPITI homepage). The application is available for contribution at (WAPITI Repository).
Please be aware this command line does not replace a manual audit but can be useful to perform a first validation or exploration of legacy projects.
Command line
python wapiti http://mysite.com -n 10 -b folder -u -v 1 -f html -o /tmp/scan_report
Options used:
- -n: Define a limit of urls to read with the same pattern (prevent endless loops), here limit to 10.
- -b: Set the scope of the scan, here we analyze all the links to the pages which are in the same domain as the URL passed.
- -u: Use color to highlight vulnerables parameters in output.
- -v: Define verbosity level, here we print each url.
- -f: Define report type, here we choose HTML format.
- -o: Define report destination, in our case it must be a directory because we choose HTML format.
Attack modules used by WAPITI:
- backup: This module search backup of scripts on the server.
- blindsql: Time-based blind sql scanner.
- crlf: Search for CR/LF injection in HTTP headers.
- exec: Module used to detect command execution vulnerabilities.
- file: Search for include()/fread() and other file handling vulns.
- htaccess: Try to bypass weak htaccess configurations.
- nikto: Use a Nikto database to search for potentially dangerous files.
- permanentxss: Look for permanent XSS.
- sql: Standard error-based SQL injection scanner.
- xss: Module for XSS detection.
- buster: Module for a file and directory buster attack - checking for "bad" files.
- shellshock: Module for Shellshock bug detection.
Report
A sample HTML report is available here.
