Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How?


  • Please provide a link to the online test you are referring to. Commented Dec 22, 2012 at 20:49
  • 3
    w3af is a awful tool. Use skipfish or wapiti.
    – rook
    Commented Dec 24, 2012 at 19:16
  • Thanks for advice , I used skipfish and wasn't very satisfied , but I like wapiti really useful . Thanks
    – Daniel
    Commented Dec 26, 2012 at 14:03
  • w3af can be a wonderful tool, but it is not easy to configure properly.
    – schroeder
    Commented Dec 27, 2012 at 19:55

1 Answer 1


In w3af in order to test a web application after selecting the OWASP Top 10 scanning profile you need to enable the auth plugin. The auth plugin can be enabled by placing a check mark in the box to the right of either the detailed or generic version of the plugin. Many times simply selecting generic and supplying w3af with a valid user name and password will do the job. If this does not work there is a second option which uses the detailed options which allow you to tweak the way the log-in credentials are processed by w3af.

There is additional information provided in the documentation provided by w3af at the following url: http://w3af.sourceforge.net/

Also you did fail to mention whether you were using the CLI or the GUI version however these directions obviously apply to the GUI but can be converted to CLI by simply navigating the plugin tree in the console.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .