Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How?


share|improve this question
Please provide a link to the online test you are referring to. – HeatfanJohn Dec 22 '12 at 20:49
w3af is a awful tool. Use skipfish or wapiti. – rook Dec 24 '12 at 19:16
Thanks for advice , I used skipfish and wasn't very satisfied , but I like wapiti really useful . Thanks – khaomax Dec 26 '12 at 14:03
w3af can be a wonderful tool, but it is not easy to configure properly. – schroeder Dec 27 '12 at 19:55
up vote 0 down vote accepted

In w3af in order to test a web application after selecting the OWASP Top 10 scanning profile you need to enable the auth plugin. The auth plugin can be enabled by placing a check mark in the box to the right of either the detailed or generic version of the plugin. Many times simply selecting generic and supplying w3af with a valid user name and password will do the job. If this does not work there is a second option which uses the detailed options which allow you to tweak the way the log-in credentials are processed by w3af.

There is additional information provided in the documentation provided by w3af at the following url:

Also you did fail to mention whether you were using the CLI or the GUI version however these directions obviously apply to the GUI but can be converted to CLI by simply navigating the plugin tree in the console.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.