Tom,

On Tue, Mar 9, 2010 at 9:12 AM, Tom Ueltschi
<[email protected]> wrote:
> Hi all,
>
> i've been using w3af mostly with spiderMan proxy and manual discovery,
> b/c the application needs a login with username/password.
>
> now i would like to scan the same webapp multiple times with different
> sets of audit plugins enabled.  i already have a list of fuzzable URLs
> from previous scans.
>
>>> the goal is to repeat a scan (with same or other plugins) to check if the 
>>> found vuln's have been fixed, if possible without the need of spiderMan 
>>> proxy. (i would like to be able to configure and start a scan from remote 
>>> with ssh without an open proxy port)

Nice use case. I like what you're trying to achieve.

> i found the 2 plugins "importResults" and "urllist_txt", where the
> documentation of the first one seems outdated (only 1 parameter:
> input_file) and the second one seems undocumented here:
> http://w3af.sourceforge.net/plugin-descriptions.php#discovery

- urllist_txt will read the urllist.txt file from the web server
(http://host.tld/urllist.txt). This is not what you want.
- The latest version from importResults says in its description:

        Three configurable parameter exist:
            - input_csv
            - input_burp
            - input_webscarab

Please make sure that you have the latest version of w3af from the
SVN. The (http://w3af.sourceforge.net/plugin-descriptions.php#discovery)
page is outdated, I'll fix that in a while.

> - what's the difference between the two?  which one should be preferred?

    For your use case, please use importResults with input_csv.

> - what's the format of "input_csv" from importResults? (e.g. 1 URL per
> line, with or without URL parameters? is there any separation by
> comma, or why CSV?)

    method, uri, postdata

> - could i provide a login (username/password or session cookie)
> somehow without using spiderMan proxy?

    Yes, please see the http-settings, there is a way for you to
specify a cookie, or add arbitrary headers with headersFile parameter.

> (maybe if it's possible create a GET request in the URL list file
> which does a login? [unless it's POST only] or else how?)

    Hmm... I'm not sure if that's going to work, but its worth a try!
I think its a smart idea.

> thanks for any feedback and answers.

    Thank you!

> Cheers,
> Tom
>
> ------------------------------------------------------------------------------
> Download Intel&#174; Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> W3af-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/w3af-users
>



-- 
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
W3af-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/w3af-users

Reply via email to