Lots of 'unidentified exploits' detected with w3af

Question

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a POST'ed value similar to what an SQLi looks like. But after doing some testing they aren't SQL injections.

They mostly look like d'%4([random texts])90mhitoe24z'"0. with in a button or somewhere in a form. Are these false positives or are they actual exploits that aren't defined in the plugin code for w3af?

Answer 1

Not sure what you're finding because your question lacks detail, but it looks like you have the audit.generic plugin enabled and you're actually seeing something like: "Possible unidentified vulnerability" or "Unidentified vulnerability".

If this is the case, what w3af is telling you is that you should look into those HTTP requests and responses because they might be potential vulnerabilities.

If you don't want to see these potential vulnerabilities anymore, simply disable audit.generic plugin. On the other side, if you're interested in knowing where they come from, please read the source code at "plugins/audit/generic.py"; but to sum up:

1. w3af sends 'd\'kc"z\'gj\'\"*5(((;-*`)' and an empty string to each input parameter
2. w3af sends something "normal" to the same parameter
3. If the HTTP response for those requests if very different, flag them as a potential vulnerability

PS: I wrote w3af.