W3af Setup - Revision history

NKirnbauer: NKirnbauer moved page W3af to W3af Setup

2024-10-18T11:23:09Z

NKirnbauer moved page W3af to W3af Setup

← Older revision		Revision as of 11:23, 18 October 2024
(No difference)

NKirnbauer: misspelling

2024-10-18T11:22:52Z

misspelling

← Older revision		Revision as of 11:22, 18 October 2024
Line 5:		Line 5:
	== Requirements ==		== Requirements ==

	* Linux-based System - preferably Ubuntu 12.04 LTS		* Linux-based System - preferably Ubuntu 22.04 LTS
	* Python2		* Python2

FVarli at 15:30, 13 January 2023

2023-01-13T15:30:22Z

← Older revision		Revision as of 15:30, 13 January 2023
Line 5:		Line 5:
	== Requirements ==		== Requirements ==

	* Linux-based System - preferably Ubuntu 12.04		* Linux-based System - preferably Ubuntu 12.04 LTS
	* Python2		* Python2

FVarli at 15:30, 13 January 2023

2023-01-13T15:30:14Z

← Older revision		Revision as of 15:30, 13 January 2023
Line 5:		Line 5:
	== Requirements ==		== Requirements ==

	* ~~Preferable Operating system:~~ Ubuntu 12.04		* Linux-based System - preferably Ubuntu 12.04
	* Python2		* Python2

Line 27:		Line 27:
	* Next we install the dependencies with ./w3af_dependency_install.sh		* Next we install the dependencies with ./w3af_dependency_install.sh

	Edit (Jan. 2023): Currently there might be new errors starting w3af_gui, therefore you might have to downgrade specific dependencies/packets or ~~the whole~~ OS.		Edit (Jan. 2023): Currently there might be new errors starting w3af_gui, therefore you might have to downgrade specific dependencies/packets or use an older OS (i.e. Ubuntu 12.04).

	=== Scanning ===		=== Scanning ===

FVarli at 15:28, 13 January 2023

2023-01-13T15:28:23Z

← Older revision		Revision as of 15:28, 13 January 2023
Line 80:		Line 80:

	* https://docs.w3af.org/en/stable/index.html		* https://docs.w3af.org/en/stable/index.html
			* https://github.com/andresriancho/w3af/

	[[Category:Documentation]]		[[Category:Documentation]]

FVarli at 15:28, 13 January 2023

2023-01-13T15:28:05Z

← Older revision		Revision as of 15:28, 13 January 2023
Line 1:		Line 1:
	== Summary ==		== Summary ==

	This document is a Step-by-Step Guide on how to use w3af. w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing.		This document is a Step-by-Step Guide on how to use w3af. w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing. w3af is able to identify 200+ vulnerabilities, including Cross-Site Scripting (XSS), SQL injection and OS commanding.

	== Requirements ==		== Requirements ==

FVarli at 15:27, 13 January 2023

2023-01-13T15:27:31Z

← Older revision		Revision as of 15:27, 13 January 2023
Line 1:		Line 1:
	== Summary ==		== Summary ==

	Step by Step Guide on how to use w3af.		This document is a Step-by-Step Guide on how to use w3af. w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing.

	== Requirements ==		== Requirements ==

FVarli at 15:25, 13 January 2023

2023-01-13T15:25:44Z

← Older revision		Revision as of 15:25, 13 January 2023
Line 73:		Line 73:
	[[File:Bild3.png\|900px]]		[[File:Bild3.png\|900px]]

			In order to exploit a vulnerability, you need to drag the exploit to the vulnerability you want to exploit and drop it there. This drag-and-drop process is all you need to activate a particular vulnerability.

			Apart from the w3af core functionality, that is to scan for vulnerabilities and exploit them, there are other tools that can be used, to find them follow the guide (Tools section) under the References section.

	== References ==		== References ==

FVarli at 15:18, 13 January 2023

2023-01-13T15:18:41Z

← Older revision		Revision as of 15:18, 13 January 2023
Line 5:		Line 5:
	== Requirements ==		== Requirements ==

	* Preferable Operating system: Ubuntu 22.04		* Preferable Operating system: Ubuntu 12.04
	* Python2		* Python2

FVarli at 15:18, 13 January 2023

2023-01-13T15:18:20Z

← Older revision		Revision as of 15:18, 13 January 2023
Line 33:		Line 33:
	This is how the GUI looks like:		This is how the GUI looks like:

	[[File:Bild1.png]]		[[File:Bild1.png\|900px]]

			On the left hand side, you can find different profiles, that have different plugins to select and configure.
			Under the plugin section, there are different plugin groups:

			* audit
			* bruteforce
			* crawl
			* infrastructure
			* evasion
			* grep
			* mangle
			* output

			After selecting a plugin, in the window on the right is a description regarding the plugin and its configurations. To configure the plugin, just select it, and modify the options that appears in the right window. You need to save the configuration to use it.

			To finish the configuration for the scan, you need to insert a target URL in the upper text entry.

			After selecting the profile, the plugins and typed in the URL, you can start the scan with clicking on start.

			After starting the scan, the Log Pane will be opened, where in the upper part you have the logging text & below that messages you can see what the system is currently doing. Also on the right bottom side, there are three indicators showing the quantity of information items found, vulnerabilities found, & the shell, which were successfully exploited.

			=== Results ===

			During the scan or after finishing the scan, you can look in the results tab:

			[[File:Bild2.png\|900px]]

			On the left side, it shows you the vulnerabilities and informations. When selecting one of the items, and that item corresponds to a HTTP request originated by the scanning, you can see it on the right side with its information. The colours indicate the severity of the vulnerability and have the following meaning:

			* black for information,
			* orange for low severity
			* red for medium/high severity.

			=== Exploitation ===

			We can also use exploits in w3af:

			[[File:Bild3.png\|900px]]