W3af

S. Qi,X. Ma,Y. Zhang,B Zhao,Y Zhu

EC521 Fall 2014

w3af 09/24/14

Outline

Install w3af Target web application Some attempts: SQLI, XSS Source Code demystified Future plan

w3af 09/24/14

Install w3af

Source: http://w3af.org/download

w3af 09/24/14

Install w3af

w3af 09/24/14

Install w3af

Because we are Unix users, we don't need to install Python

Input the code: sudo easy_install pip

w3af 09/24/14

Install w3af Input code: /var/folders/jt/4f04_j4x669fh26qd614v8cc0000gn/T/w3af_dependency_install.sh

w3af 09/24/14

Install w3af - Problems

We can’t use the code: ./w3af_gui PyGTK and GTK

w3af 09/24/14

Install Web AppTHE APP WE NEED TO SETUP:MAMP:Mac Apache-MySQL-PHP

w3af 09/24/14

Install Web App Download and setup

MAMP

Download our testing web server JobTracker save it in a new fold named ‘project’

Create the JobTracker Database

Then we can check the infos in JobTracker Database

w3af 09/24/14

Install Web App

Just change the Document Root and click start server then we can connect to our local web server.

w3af 09/24/14

Install Web App

It is the web application we will use to test w3af

It is written in php

It is barely protected while it was written

w3af 09/24/14

w3af 09/24/14

op

w3af 09/24/14

Attempts: SQLI Examine main components: plugins, profile, http-settings

w3af 09/24/14

Attempts: SQLI Built-in profiles; create new profile

w3af 09/24/14

Attempts: SQLI Built-in plugins; create new or new pattern to existing one

w3af 09/24/14

Attempts: SQLI

w3af 09/24/14

Attempts: SQLI

w3af 09/24/14

Code Study

Structure

w3af 09/24/14

Code Study

Controllers Thread pool, plug-in manager,

Data Parsers, DB connector, Http request handler

UI GUI

w3af 09/24/14

Code Study

Handle different kind of attacks(attack/audit/evasion/grep)

Login (brute force, auth)

Crawl the websites(crawl)

Handle the output, test(output/test)

w3af 09/24/14

Code StudyTest(1) Test the plug-ins

Test the Specific Websites with Specific Method

w3af 09/24/14

Code StudyTest(2) Example

w3af 09/24/14

Code StudyExtensibility

1 Write Plug-ins

2 Put Plug-ins in core

3 Test Plug-ins

4 Test in the websites

w3af 09/24/14

Conclusion

What we have achieved:

Setup and Run

Choose experiment web apps( JobTracker, WAMP)

Collect results

Understanding of architecture and core source

w3af 09/24/14

Future Plan

What we will do:

Cross-Site Scripting(XSS) or Cross-Site Request Forgery(CSRF)

Paper study

Deep understanding of architecture and core source

Comparison(with OpenVAS)

Make the Tutorial!

Photonics Presentation 09/24/14

w3af