wapiti-3.0.0 - Wapiti 3.0.0 - The Web-Application Vulnerability

项目说明

WAPITI - 3.0.0
Wapiti is a web application security auditor.

Requirements
============
In order to work correctly, Wapiti needs :
* Python 3.x where x is >= 4 (3.4, 3.5...)
* python-requests ( )
* BeautifulSoup ( )
* yaswfp ()
* libxml + python-lxml or html5lib

See INSTALL.md for more details on installation.

How it works
============

Wapiti works as a "black-box" scanner, that means it won't
study the source code of web applications but will work like a fuzzer,
scanning the pages of the deployed web application, extracting links and
forms and attacking the scripts, sending payloads and looking for error
messages, special strings or abnormal behaviors.

General features
================

+ Generates reports in formats (HTML, XML, JSON, TXT...).
+ Can suspend and resume a scan or an attack (session mechanism using sqlite3 databases).
+ Can give you colors in the terminal to highlight .
+ Different levels of .
+ Fast and easy way to activate/deactivate attack modules.
+ Adding a payload can be as easy as adding a line to a text file.

Browsing features
=================

+ Support HTTP, HTTPS and SOCKS5 proxies.
+ Authentication on the target methods : Basic, Digest, Kerberos or NTLM.
+ Ability to restrain the scope of the scan (domain, folder, page, url).
+ Automatic removal of one or more parameters in URLs.
+ Multiple safeguards against scan endless-loops (for example, limit of for a parameter).
+ Possibility to set the first URLs to explore (even if not in scope).
+ Can exclude some URLs of the scan and attacks (eg: logout URL).
+ Import of cookies (get them with the wapiti-getcookie tool).
+ Can activate / deactivate SSL certificates .
+ Extract URLs from Flash SWF files.
+ Try to extract URLs from ja (very basic JS interpreter).
+ HTML5 aware (understand recent HTML tags).
+ Several options to control the crawler behavior and limits.
+ Skipping some parameter names during attack.
+ Setting a maximum time for the scan process.
+ Adding some custom HTTP headers or setting a custom User-Agent.

Supported attacks
=================

+ Database Injection (PHP/ASP/JSP SQL Injections and XPath Injections)
+ Cross Site Scripting (XSS) reflected and permanent
+ File disclosure detection (local and remote include, require, fopen,
readfile...)
+ Command Execution detection (eval(), system(), passtru()...)
+ XXE (Xml eXternal Entity) injection
+ CRLF Injection
+ Search for potentially dangerous files on the server (thank to the Nikto db)
+ Bypass of weak htaccess configurations
+ Search for copies (backup) of scripts on the server
+ Shellshock
+ DirBuster like

Wapiti supports both GET and POST HTTP methods for attacks.
It also supports multipart and can inject payloads in filenames (upload).
Display a warning when an anomaly is found (for example 500 errors and timeouts)
Makes the difference beetween permanent and reflected XSS .

Module names
============

The aforementioned attacks are tied to the following module names :

+ backup (Search for copies and scripts)
+ blindsql (SQL injection detected with time-based methodology)
+ buster (DirBuster like module)
+ crlf (CR-LF injection in HTTP headers)
+ delay (Not an attack module, prints the 10 slowest to load webpages of the target)
+ exec (Code execution or command injection)
+ file (Path tra, file inclusion and XXE)
+ htaccess (Misconfigured htaccess restrictions)
+ nikto (Look for known by testing URL existence and checking responses)
+ permanentxss (Rescan the whole target after the xss module execution looking for pre tainted payloads)
+ shellshock (Test Shellshock attack, see )
+ sql (Error-based SQL injection detection)
+ xss (XSS injection module)

Module names can be given as comma separated list using the "-m" or "--module" option.

How to get the best results
===========================

To find more (as some attacks are error-based), you can modify
your webser.

For example, you can set the following in your PHP configuration :

Where to get help
=================

In the prompt, just type the following command to get the basic usage :

You can also take a look at the manpage (wapiti.1 or wapiti.1.html) for more details on each option.

If you find a bug, fill a ticket on the bugtracker :

The official wiki can be helpful too :

How to help the Wapiti project
==============================

You can :
+ Support the project by making a donation ( )
+ Create or impro modules
+ Create or impro generators
+ Work on the JS interpreter (lamejs)
+ Send bugfixes, patches...
+ Write some GUIs
+ Create some tools to convert cookies from browsers to Wapiti JSON format
+ Create a tool to convert PCAP files to Wapiti sqlite3 session files
+ Translate Wapiti in your language ( )
+ Talk about Wapiti around you

What is included with Wapiti
============================

Wapiti comes with :
+ a modified of PyNarcissus (MPL 1.1 License),
see
+ Kube CSS framework ( see ) and jQuery
for HTML report generation.

Licensing
=========

Wapiti is released under the GNU General Public License 2 (the GPL).
Source code is a on SourceForge :

项目信息

开发语言：Python

Star 数：26

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕 Wapiti 3.0.0 - The Web-Application Vulnerability Scanner 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。