2007-10-03

W3AF Tutorial (Part 1)

Overview
w3af stands for web auditing and attack framework.I have heard some say that it is the metasploit for web applications. w3af is basically a free open source web application scanner. w3af has many plugins that are divided into attack, audit, exploit, discovery, evasion, bruteforce, mangle and a few others. The code is well commented and written in python so writing your own exploits and plugins should be trivial but i cannot say for sure since i have not tried as of yet. I will spent more time on this in later articles. This will be the first of many w3af tutorials.

Getting started
I have installed it on both ubuntu fiesty and cygwin for windows. Both installs are relatively painless. Just follow the instructions in the w3afUsersGude and you will be fine.

Once you have all the prerequisites then you can start w3af as follows:

$ ./w3af
w3af>>>

Type help will give you a list of options.

w3af>>> help
The following commands are available:
help You are here. help [command] prints more specific help.
url-settings Configure the URL opener.
misc-settings Configure w3af misc settings.
session Load and save sessions.
plugins Enable, disable and configure plugins.
start Start site analysis.
exploit Exploit a vulnerability.
tools Enter the tools section.
target Set the target URL.
exit Exit w3af.
w3af>>>


First we need to talk about how the interface for w3af is configured. You move forward by typing a given option and back by typing back. Type view to see a list of configurable options and use the set command to change the options. Below we will set the target. This will be the url that we will be auditing.

Configuration:

w3af>>> target
w3af/target>>> help
The following commands are available:
help You are here. help [command|parameter] prints more specific help.
set Set a parameter value.
view List all configuration parameters and current values.
back Return to previous menu.
w3af/target>>> view
Parameter Value Description
========= ===== ===========
target A comma separated list of URLs
w3af/target>>> set target http://localhost:8080
w3af/target>>> view


Now lets configure our plugins.

w3af/target>>> back
w3af>>> plugins
w3af/plugins>>> help
The following commands are available:
help You are here. help [command] prints more specific help.
list List all available plugins.
audit Enable and configure audit plugins.
bruteforce Enable and configure bruteforce plugins.
discovery Enable and configure discovery plugins.
evasion Enable and configure evasion plugins.
grep Enable and configure grep plugins.
mangle Enable and configure mangle plugins.
output Enable and configure output plugins.
back Return to previous menu.


To audit a web application we need at least three plugins configured. Audit, discovery, and output. Typing list plus the plugin will show all available options for the plugin. If you type list audit you will see all the auditing extensions like xss, xsrf, sql injection, ldap injection, etc. Type list discovery will display all discovery options.
Just typing the plugin name (i.e audit) will display which options are loaded. By default there are no options configured for any of the plugins. You will have to add them. Some examples would be:
 w3af/plugins>>> audit xss,xsrf,sqli 
To select a few options to load.
or
 w3af/plugins>>> audit all 
To load all options.


I am going to configure our webserver audit to test for Cross site Scripting, typical web server vulnerabilities, and we want it to spider (crawl) the entire site. We also want to save the results into an html audit report. To do this we need to run the following commands:


w3af/plugins>>> audit xss
w3af/plugins>>> audit
Enabled audit plugins:
xss
w3af/plugins>>> discovery webSpider,pykto,hmap
w3af/plugins>>> discovery
Enabled discovery plugins:
webSpider
pykto
w3af/plugins>>> output console,htmlFile
w3af/plugins>>> output
Enabled output plugins:
htmlFile
console
w3af/plugins>>> output config htmlFile
w3af/plugin/htmlFile>>> view
Parameter Value Description
========= ===== ===========
verbosity 0 Verbosity level for this plugin.
httpFileName output-http.txt File name where this plugin will write HTTP requests and responses
reportDebug False True if debug information will be appended to the report.
fileName report.html File name where this plugin will write to


I have just configured a basic audit with w3af to test for XSS. We initially set the target to be http://localhost/ so it will scan my local apache server. I used pykto which is a perl version of nikto to scan for webserver vulnerabilities. The webSpider plugin will do all the url crawling and create lists of urls to audit. The output plugins will write the results to the command line and the html file called report.html in your application folder. The html output will not be available until the audit is complete. hmap fingerprints the server. The output-http.txt records server requests and responses.

Start the audit as follows:

w3af/plugin/htmlFile>>> back
w3af/plugins>>> back
w3af>>> start


Be prepared to wait a while for the audit to complete.

w3af>>> start
Auto-enabling plugin: discovery.allowedMethods
Auto-enabling plugin: discovery.error404page
Auto-enabling plugin: discovery.serverHeader
The Server header for this HTTP server is: Apache/2.2.3 (Ubuntu) PHP/5.2.1
Hmap plugin is starting. Fingerprinting may take a while.
The most accurate fingerprint for this HTTP server is: Apache/2.0.55 (Ubuntu) PHP/5.1.2
pykto plugin is using "Apache/2.0.55 (Ubuntu) PHP/5.1.2" as the remote server type. This information was obtained by hmap plugin.
pykto plugin found a vulnerability at URL: http://localhost/icons/ . Vulnerability description: Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used, the /icons directory should be removed. The vulnerability was found in the request with id 128.
pykto plugin found a vulnerability at URL: http://localhost/doc/ . Vulnerability description: The /doc directory is browsable. This may be /usr/doc. The vulnerability was found in the request with id 1865.
pykto plugin found a vulnerability at URL: http://localhost/\> . Vulnerability description: The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02. The vulnerability was found in the request with id 3385.
New URL found by discovery: http://localhost/
New URL found by discovery: http://localhost/test2.html
New URL found by discovery: http://localhost/xst2.html
New URL found by discovery: http://localhost/xst.html
New URL found by discovery: http://localhost/test.html


Here is an example of the results.html







Slashdot Slashdot It!

9 comments:

CG said...

not bad, looking forward to part2

-CG

web design quote said...

W3AF is the new tutorial for me and it a nice learning experience to see tutorial in your site. Keep adding more new stuff which help us to improve our skills as well. Keep it up.

mkoswell said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Alessio Dalla Piazza said...

Great :D

Jose Enrique Hernandez said...

Good stuff!!!

satish said...

very nice great

Anonymous said...

FYI, someone is using this article for his own profit; although credits are given to you, seems like unfair job: http://net-solutions.pro/w3af-vulnerability-scanner-tutorial/?goback=.gmr_4317537.gde_4317537_member_205943782