Re: [W3af-users] Basic Authentication

2009-05-31 Thread Yilmaz Cankaya
> > Yilmaz, > Hi Andres, > On Fri, May 29, 2009 at 2:25 AM, Yilmaz Cankaya > wrote: > >> Hi Andres >> here is the output from the console >> >> w3af/config:http-settings>>> set basicAuthUser guest basicAuthPass guest >> basicAuthDomain webgoat >> > > All in the same line? > No, actu

Re: [W3af-users] Basic Authentication

2009-05-29 Thread Andres Riancho
Yilmaz, On Fri, May 29, 2009 at 2:25 AM, Yilmaz Cankaya wrote: > Hi Andres > here is the output from the console > > w3af/config:http-settings>>> set basicAuthUser guest basicAuthPass guest > basicAuthDomain webgoat All in the same line? > To properly configure the basic authentication settings

Re: [W3af-users] Basic Authentication

2009-05-28 Thread Yilmaz Cankaya
Hi Andres here is the output from the console w3af/config:http-settings>>> set basicAuthUser guest basicAuthPass guest basicAuthDomain webgoat To properly configure the basic authentication settings, you should also set the auth domain. If you are unsure, you can set it to the target domain nam

Re: [W3af-users] Basic Authentication

2009-05-28 Thread Andres Riancho
Yilmaz, On Thu, May 28, 2009 at 7:09 AM, Yilmaz Cankaya wrote: > Meanwhile, I had sniffed the http traffic on the server and could verify > that no authorization header is sent. > > Is there someone who tested this opt?   I am not very good at python, > thus any help is appreciated. hmmm, I trie

Re: [W3af-users] Basic Authentication

2009-05-28 Thread Yilmaz Cankaya
Meanwhile, I had sniffed the http traffic on the server and could verify that no authorization header is sent. Is there someone who tested this opt? I am not very good at python, thus any help is appreciated. regards Yilmaz Cankaya wrote: > Hi, > giving a try to the Basic Authentication opti

[W3af-users] Basic Authentication

2009-05-28 Thread Yilmaz Cankaya
Hi, giving a try to the Basic Authentication option in HTTP Config screen, I've noticed that w3af spider tests do not sent authorization header properly or even not at all. someone tested any site with Basic Authentication credentials configured? Is there any way to debug if the headers are p