W3af

De Linuxmemo.

http://w3af.org/

Framework d'Attaque et d'Audit d'Application Web (w3af),

Sommaire 1 Install 2 Config 3 Script de démarrage 4 Utilisation de la console

Install

git clone https://github.com/andresriancho/w3af.git

• Memo Python modules via proxy

vim /tmp/w3af_dependency_install.sh

ajouter le proxy en httpS

sudo pip install --proxy "https://xxx.xxx.xxx.xxx:8080"  module

si nécessaire

sudo pip install --proxy "https://xxx.xxx.xxx.xxx:8080" --timeout 30 module

Config

• plugin output

w3af>>> plugins
w3af/plugins>>> output console,html_file
w3af/plugins>>> output config html_file
w3af/plugins/output/config:html_file>>>
w3af/plugins/output/config:html_file>>> help
w3af/plugins/output/config:html_file>>> view
w3af/plugins/output/config:html_file>>> save

output_file ~/report.html File name where this plugin will write to

Script de démarrage

vim basic.w3af

plugins
output
output config html_file
set verbose true
back
output config console
set verbose true
back
back
#profiles
#use full_audit
#back
# could change this to audit all but just doing Cross Site Scripting Now
#target
#set target http://localhost
#back
#start

./w3af_console –s basic.w3af

Utilisation de la console

• Plugins

crawl desc phpinfo           # pour la description du plugins
crawl phpinfo  robots_txt    # pour l'activation d'un ou plusieurs plugins