Home / Unlabelled / Wapiti - Web Application Vulnerability Scanner

Wapiti - Web Application Vulnerability Scanner

Wapiti Security Tool

Wapiti is an open source command-line application that you can use to audit the security of your web applications.

It performs "black-box" scans, i.e. it does not study the source code of the application but will scan the webpages of the deployed web app, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti can detect the following vulnerabilities :
  • File disclosure (Local and remote include/require, fopen, readfile...)
  • Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
  • XSS (Cross Site Scripting) injection (reflected and permanent)
  • Command Execution detection (eval(), system(), passtru()...)
  • CRLF Injection (HTTP Response Splitting, session fixation...)
  • XXE (XmleXternal Entity) injection
  • Use of know potentially dangerous files (thanks to the Nikto database)
  • Weak .htaccess configurations that can be bypassed
  • Presence of backup files giving sensitive information (source code disclosure)

Wapiti supports both GET and POST HTTP methods for attacks. It also supports multipart and can inject payloads in filenames (upload).

It will display a warning when an anomaly is found (for example 500 errors and timeouts).

Features:

  • Generates vulnerability reports in various formats (HTML, XML, JSON, TXT...)
  • Can suspend and resume a scan or an attack
  • Can give you colors in the terminal to highlight vulnerabilities
  • Different levels of verbosity
  • Fast and easy way to activate/deactivate attack modules
  • Adding a payload can be as easy as adding a line to a text file
  • Support HTTP and HTTPS proxies
  • Authentication via several methods : Basic, Digest, Kerberos or NTLM
  • Ability to restrain the scope of the scan (domain, folder, web page)
  • Automatic removal of a parameter in URLs
  • Safeguards against scan endless-loops (max number of values for a parameter)
  • Possibility to set the first URLs to explore (even if not in scope)
  • Can exclude some URLs of the scan and attacks (eg: logout URL)
  • Import of cookies (get them with the wapiti-cookie and wapiti-getcookie tools)
  • Can activate / deactivate SSL certificates verification
  • Extract URLs from Flash SWF files
  • Try to extract URLs from javascript (very basic JS interpreter)
  • HTML5 aware (understand recent HTML tags)

Usage:

python wapiti.py http://server.com/base/url/ [options] 

Options:
-s <url> 
  --start <url> 
  	To specify an url to start with. This option can be called several times.
  	Wapiti will browse these links to find more URLs even if the specified link is
         not in the scope.
 
 -x <url> 
  --exclude <url> 
  	To exclude an URL from the scan (eg: logout URLs). This option can be called 
         several times to specify several URLs.
  	Wildcards (*) can be used in URLs for basic regex.
  	Example : -x http://server/base/?page=*&module=test
  	or -x http://server/base/admin/* to exclude a directory.
 
  
 -p <url_proxy> 
  --proxy <url_proxy> 
  	To specify a proxy. Currently supported proxies are HTTP and HTTPS.
  	This option can be called twice to specify the HTTP and the HTTPS proxy.
  	Example: -p http://proxy:port/
 
  -c <cookie_file> 
  --cookie <cookie_file> 
  	To import cookies to use for the scan. The cookie file must be in JSON format.
  	Cookies can be grabbed using the cookie.py and getcookie.py utilities 
         (net directory).
  
 -t <timeout> 
  --timeout <timeout> 
  	To set the timeout (maximum time in seconds to wait for the server to send a 
         response).
  
 -a <login%password> 
  --auth <login%password> 
  	Set credentials for HTTP authentication.
 
  --auth-method <method>
  	If the server requires an authentication, set the authentication method to use.
  	Currently supported methods are (some requires additional modules to install):
  		+ basic
  		+ digest
  		+ kerberos
  		+ ntlm
 
  -r <parameter_name> 
  --remove <parameter_name> 
  	Remove a parameter (name and value) from URLs.
 
 -n <limit> 
  --nice <limit> 
  	Define a limit of URLs to browse with the same pattern (ie, the maximum number 
         of unique values for the same parameter).
  	Use this option to prevent endless loops during scan. Limit must be greater 
         than 0.
 
 -m <module_options>
  --module <module_options>
  	Set the modules (and HTTP methods for each module) to use for attacks.
  	Prefix a module name with a dash to deactivate the related module.
  	To only browse the target (without sending any payloads), deactivate every 
         module with -m "-all".
  	If you don't specify the HTTP methods, GET and POST will be used.
  	Example: -m "-all,xss:get,exec:post"
 
  -u 
  --color 
  	Use colors to highlight vulnerabilities and anomalies in output. 
 
  -v <level> 
  --verbose <level> 
  	Set the verbosity level. 
  	0: quiet (default), 1: print each URL, 2: print every attack. 
 
  -b <scope>
  --scope <scope>
  	Set the scope of the scan:
  		+ page: to analyse only the page given as the root URL.
  		+ folder: to analyse all the URLs under the root URL passed to Wapiti 
                   (default).
  		+ domain: to analyse all the links to the pages which are in the same 
                   domain as the URL passed to Wapiti.
 
  -f <type_file> 
  --format <type_file> 
  	Set the format type for the report. 
  	json: Report in JSON format 
  	html: Report in HTML format (default)
  	openvas: Report in OpenVAS XML format 
  	txt: Report in plain text (UTF-8) 
  	vulneranet: Report in VulneraNET (XML based) format 
  	xml: Report in XML format 
 
  -o <output> 
  --output <output_file> 
  	Set the name of the report file. 
  	If the selected report format is 'html', this parameter will be used 
         as a directory name.
 
  -i <file>
  --continue <file>
  	This parameter indicates to Wapiti to resume the previous scan saved in the
         specified XML status file.
  	The file name is optional, if not specified, Wapiti takes the default file 
         from the "scans" folder.
 
  -k <file>
  --attack <file>
  	This parameter indicates to Wapiti to resume the attacks without scanning the 
         website again, loading the scan status from the specified file.
  	The file name is optional, if it is not specified, Wapiti takes the default 
         file from the "scans" folder.
 
  --verify-ssl <0|1>
  	This parameter indicates whether Wapiti must check SSL certificates.
  	Default is to verify certificates
 
  -h 
  --help 
  	To print this usage message


Download Wapiti


Source: www.effecthacking.com
Wapiti - Web Application Vulnerability Scanner Wapiti - Web Application Vulnerability Scanner Reviewed by Anonymous on 8:10 AM Rating: 5

Tags