Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How?
Thanks
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
In w3af in order to test a web application after selecting the OWASP Top 10 scanning profile you need to enable the auth plugin. The auth plugin can be enabled by placing a check mark in the box to the right of either the detailed or generic version of the plugin. Many times simply selecting generic and supplying w3af with a valid user name and password will do the job. If this does not work there is a second option which uses the detailed options which allow you to tweak the way the log-in credentials are processed by w3af. There is additional information provided in the documentation provided by w3af at the following url: http://w3af.sourceforge.net/ Also you did fail to mention whether you were using the CLI or the GUI version however these directions obviously apply to the GUI but can be converted to CLI by simply navigating the plugin tree in the console. |
|||
|
|
