Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a POST'ed value similar to what an SQLi looks like. But after doing some testing they aren't SQL injections.

They mostly look like d'%4([random texts])90mhitoe24z'"0. with in a button or somewhere in a form. Are these false positives or are they actual exploits that aren't defined in the plugin code for w3af?

share|improve this question
1  
IMHO w3af isn't a very good tool, the plugins are poorly written and w3af's API prohibits useful features. I would try any other tool. –  Rook Aug 8 '12 at 18:21
1  
I agree, I've been considering running nessus or acunetix for my webapp tests. –  Digital Fire Aug 8 '12 at 18:53
    
SkipFish is free, sitewat.ch is a managed service that is free and cheap. (I work for sitewatch) –  Rook Aug 8 '12 at 22:44
    
@Rook, there are more than 10 spelling and grammar mistakes on the front page of that website. –  Hendrik Brummermann Aug 12 '12 at 14:22

1 Answer 1

up vote 2 down vote accepted

Not sure what you're finding because your question lacks detail, but it looks like you have the audit.generic plugin enabled and you're actually seeing something like: "Possible unidentified vulnerability" or "Unidentified vulnerability".

If this is the case, what w3af is telling you is that you should look into those HTTP requests and responses because they might be potential vulnerabilities.

If you don't want to see these potential vulnerabilities anymore, simply disable audit.generic plugin. On the other side, if you're interested in knowing where they come from, please read the source code at "plugins/audit/generic.py"; but to sum up:

  1. w3af sends 'd\'kc"z\'gj\'\"*5(((;-*`)' and an empty string to each input parameter
  2. w3af sends something "normal" to the same parameter
  3. If the HTTP response for those requests if very different, flag them as a potential vulnerability

PS: I wrote w3af.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.