New answers tagged python
1
Your searches must have missed the GitHub repo, which is highlighted on w3af.org.
Examples are all there.
2
As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...
3
If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want.
Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...
2
When writing binary output data try instead using
open('bomber.out', 'wb').write(data)
I can't verify if this will help but it might be worth a try.
Top 50 recent answers are included
