WXf: Web Exploitation Framework

Registration | Hotel | Walter E. Washington Convention Center

The presentation

The web application security field has seen a large expansion in the last decade. In that time the amount of community participation has significantly increased, however, efforts have become increasingly discontigous.

Several web application security centric frameworks have come and gone that were intended to address this challenge. The goal of Web Exploitation Framework (wXf) is to take the experience of using these tools, the perceived shortcomings and build something that is easy to use, install and extend.

Web Exploitation Framework (“wXf”) is written in Ruby and was originally an idea as a module for Rapid 7’s Metasploit but the idea quickly outgrew a network exploitation framework. Instead, we designed a core that focuses on the web standards along with exploits & payloads designed specifically for defeating web application protections. wXf maintains somewhat of the look and feel of Metasploit but the code is entirely different. Our goal is to have a security professional familiar with the Metasploit framework using wXf in under 10 minutes.

The speakers

Ken Johnson is a Senior Application Security Consultant with FishNet Security performing dynamic analysis, source code analysis and web application penetration testing. Ken has worked for both government and corporate organizations both at home and abroad.

Chris Gates (CG/carnal0wnage) is a member of the Metasploit Project and Attack Research. He enjoys business logic flaws, misconfigured databases and the occasional client-side attack. He has spoken at various other security conferences including BlackHat USA, Defcon, CSI 2009, Brucon, SOURCE Boston, Toorcon, Notacon, and Chicagocon.