Scribd
Upload
18 views

Web Application Attack and Audit Framework: by Prachu Sharma

W3af is a web application attack and auditing framework similar to Metasploit. It combines mapping, discovery, and exploitation into three plugin types to audit websites for SQL injections, XSS vulnerabilities, file inclusions, and more. The discovery plugin finds URLs and injection points, the audit plugin tests those points with crafted data, and the exploit plugin then exploits any found vulnerabilities to return items like SQL dumps or a remote shell.

Uploaded by

iipradyumna
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
18 views

Web Application Attack and Audit Framework: by Prachu Sharma

W3af is a web application attack and auditing framework similar to Metasploit. It combines mapping, discovery, and exploitation into three plugin types to audit websites for SQL injections, XSS vulnerabilities, file inclusions, and more. The discovery plugin finds URLs and injection points, the audit plugin tests those points with crafted data, and the exploit plugin then exploits any found vulnerabilities to return items like SQL dumps or a remote shell.

Uploaded by

iipradyumna
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 11

Web Application Attack and Audit Framework

By Prachu Sharma

W3af is a well known web attack and auditing framework. Very similar to Metasploit framework W3af combines all necessary actions for a complete web attack. Mapping Discovery Exploitation
This puts the framework into three major plug-ins.

Web Service Support Exploits


SQL injections(blind) OS commanding remote file inclusions local file inclusions XSS and more

A good harmony among plug-ins.

Discovery Plugin
URLS Injection Points

Audit Plugin
Uses the above injection points Sends crafted data to find vulnerabilities

Exploit Plugin
Exploits vulnerabilities found Provides SQL dumps / remote shell is returned

Find all the URLs Create Fuzzable request Plugins: WebSpider URL fuzzer Pykto GoogleFuzzer

They use the discovery plug-in outputs and find their respective vulnerabilities SQL Injection (blind)
XSS

Buffer Overflow
Response Splitting

Grep every HTTP request and response findComments passwordProfiling privateIP DirectoryIndexing Getmails lang

BruteForce
Bruteforce logins

Evasion
Modify the request to evade IDS detection

Mangle
Modify requests/responses based on regular expressions.

Output
Write logs .

Any
Question

THANKS TO

ALL

You might also like