Tom, On Tue, Mar 9, 2010 at 9:12 AM, Tom Ueltschi <[email protected]> wrote: > Hi all, > > i've been using w3af mostly with spiderMan proxy and manual discovery, > b/c the application needs a login with username/password. > > now i would like to scan the same webapp multiple times with different > sets of audit plugins enabled. i already have a list of fuzzable URLs > from previous scans. > >>> the goal is to repeat a scan (with same or other plugins) to check if the >>> found vuln's have been fixed, if possible without the need of spiderMan >>> proxy. (i would like to be able to configure and start a scan from remote >>> with ssh without an open proxy port)
Nice use case. I like what you're trying to achieve. > i found the 2 plugins "importResults" and "urllist_txt", where the > documentation of the first one seems outdated (only 1 parameter: > input_file) and the second one seems undocumented here: > http://w3af.sourceforge.net/plugin-descriptions.php#discovery - urllist_txt will read the urllist.txt file from the web server (http://host.tld/urllist.txt). This is not what you want. - The latest version from importResults says in its description: Three configurable parameter exist: - input_csv - input_burp - input_webscarab Please make sure that you have the latest version of w3af from the SVN. The (http://w3af.sourceforge.net/plugin-descriptions.php#discovery) page is outdated, I'll fix that in a while. > - what's the difference between the two? which one should be preferred? For your use case, please use importResults with input_csv. > - what's the format of "input_csv" from importResults? (e.g. 1 URL per > line, with or without URL parameters? is there any separation by > comma, or why CSV?) method, uri, postdata > - could i provide a login (username/password or session cookie) > somehow without using spiderMan proxy? Yes, please see the http-settings, there is a way for you to specify a cookie, or add arbitrary headers with headersFile parameter. > (maybe if it's possible create a GET request in the URL list file > which does a login? [unless it's POST only] or else how?) Hmm... I'm not sure if that's going to work, but its worth a try! I think its a smart idea. > thanks for any feedback and answers. Thank you! > Cheers, > Tom > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > W3af-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/w3af-users > -- Andrés Riancho Founder, Bonsai - Information Security http://www.bonsai-sec.com/ http://w3af.sf.net/ ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ W3af-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/w3af-users
