Python 官方文档:入门教程 => 点击学习
This type of article aims to provide to development team a easy/quick way to perfORM automated audit test
This type of article aims to provide to development team a easy/quick way to
perfORM automated audit tests against their WEB application projects over implementation phase.
Contents
|
This page have to objective to show a W3AF sample script to automate audit of a web application.
W3AF is a free and open source Web Application Attack and Audit Framework (W3AF homepage).
This script do not replace a manual audit but can be useful to perform a first validation.
# -----------------------------------------------------------------------------------------------------------
# W3AF AUDIT SCRIPT FOR WEB APPLICATION
# -----------------------------------------------------------------------------------------------------------
Http-settings
set timeout 60
back
plugins
# Step 1 : Configure DISCOVERY plugins
discovery serverHeader, dotnetErrors, webSpider
discovery config serverHeader
set execOneTime True
back
discovery config webSpider
set onlyForward False
set followRegex .*
back
# Step 2 : Configure AUDIT plugins
audit LDapi,eval,frontpage,generic,globalRedirect,phishingVector,responseSplitting,sqli,xpath,xsrf,xss,xst
audit config xss
set numberOfChecks 15
back
# Step 3 : Configure GREP plugins
grep error500, domXss, metaTags, dotNetEventValidation, findComments, pathDisclosure, collectCookies, errorPages, httpAuthDetect
grep config domXss
set simpleGrep False
set smartGrep True
back
grep config metaTags
set search404 False
back
grep config findComments
set search404 False
back
# Step 4 : Configure OUTPUT plugins
output htmlFile
output config htmlFile
set fileName /tmp/W3afReport.html
set verbose False
back
back
# Step 5 : Define target URL
target
set target PUT_YOUR_SITE_URL_HERE
back
# Step 6 : Start audit
start
exit
./w3af_console -s MyScript.w3af
After the script runs, the audit report is available in the location defined in clause "set fileName" ("/tmp/W3afReport.html" in the script example).
You can find below a highlighter for Notepad++ in order to help to edit W3AF script (copy/paste content into a file and import it into Notepad++).
<NotepadPlus>
<UserLang name="W3AF" ext="w3af">
<Settings>
<Global caseIgnored="yes" />
<TreatAsSymbol comment="no" commentLine="no" />
<Prefix Words1="no" words2="no" words3="no" words4="no" />
</Settings>
<KeywordLists>
<Keywords name="Delimiters">000000</Keywords>
<Keywords name="Folder+"></Keywords>
<Keywords name="Folder-"></Keywords>
<Keywords name="Operators"></Keywords>
<Keywords name="Comment"> 1 2 0#</Keywords>
<Keywords name="Words1">start plugins exploit profiles httpsettings miscsettings
target back assert help version keys view set</Keywords>
<Keywords name="Words2">mangle evasion discovery grep bruteforce audit output</Keywords>
<Keywords name="Words3"></Keywords>
<Keywords name="Words4"></Keywords>
</KeywordLists>
<Styles>
<WordsStyle name="DEFAULT" styleID="11" fGColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="FOLDEROPEN" styleID="12" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="FOLDERCLOSE" styleID="13" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="KEYWORD1" styleID="5" fgColor="000080" bgColor="FFFFFF" fontStyle="3" />
<WordsStyle name="KEYWORD2" styleID="6" fgColor="800040" bgColor="FFFFFF" fontStyle="3" />
<WordsStyle name="KEYWORD3" styleID="7" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="KEYWORD4" styleID="8" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="COMMENT" styleID="1" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="COMMENT LINE" styleID="2" fgColor="008040" bgColor="FFFFFF" fontStyle="1" />
<WordsStyle name="NUMBER" styleID="4" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="OPERATOR" styleID="10" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="DELIMINER1" styleID="14" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="DELIMINER2" styleID="15" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
<WordsStyle name="DELIMINER3" styleID="16" fgColor="000000" bgColor="FFFFFF" fontStyle="0" />
</Styles>
</UserLang>
</NotepadPlus>
Step 1 : Import file into User-Defined Dialogue
Step 2 : Select W3AF language for a script
--结束END--
本文标题: Automated Audit usin
本文链接: https://www.lsjlt.com/news/182966.html(转载时请注明来源链接)
有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341
下载Word文档到电脑,方便收藏和打印~
2024-03-01
2024-03-01
2024-03-01
2024-02-29
2024-02-29
2024-02-29
2024-02-29
2024-02-29
2024-02-29
2024-02-29
回答
回答
回答
回答
回答
回答
回答
回答
回答
回答
0