View source for VULNERABILITY: w3af (en)

W3AF is a feature-rich web attack application and audit framework that aims to detect and exploit web vulnerabilities. The entire application security assessment process is automated, and the framework is designed to follow three main steps: discovery, audit, and attack. Each of these steps includes multiple plugins, which can help auditors focus on specific testing criteria. All these plugins can communicate and share test data to achieve the desired objectives. It supports the detection and exploitation of several web application vulnerabilities including SQL injection, cross-site scripting, remote and local file inclusion, buffer overflows, XPath injection, OS command injection, application misconfigurations, and so forth. For more information about each available plugin, visit: http://w3af.sourceforge.net/plugin-descriptions.php.

The installation of w3af can be done using the command,

 cd ~
 apt install libcrypto++-dev
 apt-get update
 apt-get install -y python-pip w3af
 pip install --upgrade pip
 git clone https://github.com/andresriancho/w3af.git
 cd w3af
 ./w3af_console
 . /tmp/w3af_dependency_install.sh

Once installed, to run W3AF, navigate to

Kali Linux > Web Applications > Web Vulnerability Scanners > w3af (Console)

or use the console to run the following command:

 w3af_console

This will place you in the personalized W3AF console mode (w3af >>>). Note that the GUI version of this tool is also available at the same menu location, but we prefer to introduce the console version to you due to its flexibility and ease of customization.

 w3af>>> help

This will display all basic options that can be used to configure the tests. You can use the help command whenever you need assistance to know specific options. In this exercise, first configure the output plugin, enable selected audit tests, set the target, and run the scanning process against the target site using the following commands:

 w3af>>> plugins
 w3af/plugins>>> help
 w3af/plugins>>> output
 w3af/plugins>>> output console, htmlFile
 w3af/plugins>>> output config htmlFile
 w3af/plugins/output/config:htmlFile>>> help
 w3af/plugins/output/config:htmlFile>>> view
 w3af/plugins/output/config:htmlFile>>> set verbose True
 w3af/plugins/output/config:htmlFile>>> set fileName testreport.html
 w3af/plugins/output/config:htmlFile>>> back
 w3af/plugins>>> output config console
 w3af/plugins/output/config:console>>> help
 w3af/plugins/output/config:console>>> view
 w3af/plugins/output/config:console>>> set verbose False
 w3af/plugins/output/config:console>>> back
 w3af/plugins>>> audit
 w3af/plugins>>> audit htaccessMethods, osCommanding, sqli, xss
 w3af/plugins>>> back
 w3af>>> target
 w3af/config:target>>> help
 w3af/config:target>>> view
 w3af/config:target>>> set target http://testphp.example.com/
 w3af/config:target>>> back
 w3af>>>

At this point, we have configured all the necessary test parameters. Our target will be evaluated against SQL injection, cross-site scripting, OS commanding, and htaccess configuration errors using the following code:

 w3af>>> start
 Auto-enabling plugin: grep.error500
 Auto-enabling plugin: grep.httpAuthDetect
 Found 2 URLs and 2 different points of injection.
 The list of URLs is:
 - http://testphp.example.com/
 - http://testphp.example.com/search.php?test=query
 The list of fuzzable requests is:
 [ 227 ]Vulnerability Mapping
 - http://testphp.example.com/ | Method: GET
 - http://testphp.example.com/search.php?test=query | Method: POST |
 Parameters: (searchFor="")
 Starting sqli plugin execution.
 Starting osCommanding plugin execution.
 A possible OS Commanding was found at:
 "http://testphp.example.com/search.php?test=query", using
 HTTP method POST. The sent post-data was:
 "searchFor=run+ping+-n+3+localhost&goButton=go".Please review manually.
 This information was found in the request with id 22.
 Starting xss plugin execution.
 Cross Site Scripting was found at:
 "http://testphp.example.com/search.php?test=query",
 using HTTP method POST. The sent post-data was:
 "searchFor=<ScRIPt/SrC=http://x4Xp/x.js></ScRIPt>&goButton=go". 

 This vulnerability affects Internet Explorer 6, Internet Explorer 7, Netscape with IE rendering engine, Mozilla Firefox, Netscape with Gecko rendering engine. This vulnerability was found in the request with id 39. Starting htaccessMethods plugin execution. Finished scanning process.

As you can see, we have found several serious security vulnerabilities in the target web application. As per our configuration, the default location for the testing report (HTML) is /usr/share/web/w3af/testreport.html, detailing all vulnerabilities including debug information about each data request and response transferred between W3AF and the target web application. The test case we provided in the previous code does not reflect the use of other useful plugins, profiles, and exploitation options. Therefore, we highly recommend that you practice through the various exercises available in the user guide, which is available at

* http://w3af.org/howtos/understanding-the-basics
* http://docs.w3af.org/en/latest/