w4af - w4af: web advanced application attack and audit fr

项目说明

![Unit tests]()
![Code Co]()
![License]()
!Release

w4af - Web Ad Application Attack and Audit Framework for Python3

w4af is an open source
web application security scanner which helps de and penetration testers identify and exploit in their web applications. It is originally based on w3af and is currently in an early alpha de phase. We welcome early user experience and bug reports, but we don't make any warranties about the software - it's still a work in progress.

The scanner is able to identify 200+ ,
including Cross-Site Scripting,
SQL injection and
OS commanding.

Documentation

We recommend you to read the user guide before starting to use w4af, there
are many FAQs, tips and tricks and other important pieces of information in
the manual.

Installation

Python

The project expects to use Python 3.11, currently only Ubuntu 22.04 LTS is supported. The project's Python dependencies can be installed by running pipenv in the project's root folder:

Running pipen with then launch a shell from which it is possible to run w4af.

Node

The project uses NodeJS libraries for some features. To install those dependencies, run:

De

Use pytest to run the unit tests:

By default, pytest will run all tests, including tests that depend on internet connection, a clean git checkout, and a running integration en.

Unit tests

The unit tests should run without any integration en (though some do rely on a li connection):

Integration tests

You can launch the integration en with docker-compose:

With that running, the integration tests should also pass. Integration tests are tagged according to which en they rely on - the tag of the test matches the label for the docker service in docker-compose.yml. This will be one of moth, w4af_moth, sqlmap, mcir, wivet, or phpmoth, for example:

Building documentation

First install sphinx within a en and then build documentation

The purpose of this software is to help security researches to scan their sites to find .

Disclaimer

You are only allowed to scan websites that you own and/or ha to scan. The de can not be made responsible for any damage that occurs by using this software. Use at your own risk.

Contributing

Pull requests are always welcome! If you're not sure where to start, please take
a look at the TODO First steps as a contributor
document in our wiki. All contributions, no matter how small, are welcome.

Links and documentation

项目信息

开发语言：Python

Star 数：48

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕w4af: web advanced application attack and audit framework, the open source web vulnerability scanner.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。