Monday, July 15, 2024

Scanning for OWASP Top 10 With w3af – An Open-source Web Application Security Scanner

w3af is an open-source web application security scanner (OWASP Top 10) that enables developers and penetration testers to distinguish and exploit vulnerabilities in their web applications, especially OWASP Top 10 Vulnerabilities.

This tool also provides GUI framework but sadly most of the time GUI mode hangs up, most recommended is to work with w3afconsole.

It is also called “Metasploit for the web” but actually, it is more than that. w3af uses black-box scanning techniques and it has more than 130 plugins and can detect 200+ vulnerabilities including XSS, Injection, LFI, RFI, CSRF, and more.

Also, you can learn Advanced Pentesting and Web Hacking – Scratch to Advance level course

Scanning OWASP Top 10 Vulnerabilities with w3af

To start with w3af root@kali:~# w3af and then load the help menu w3af>>> help.

Scanning for OWASP Top 10 Vulnerabilities with w3af

To navigate the profiles w3af>>> profiles and to list all the possible options  w3af/profiles>>> list

Scanning for OWASP Top 10 Vulnerabilities with w3af

You need to select the Profile as OWASP_10 w3af/profiles>>> use OWASP_10

Scanning for OWASP Top 10 Vulnerabilities with w3af

Also read: How to Do Penetration Testing with Your WordPress website detailed Explanation

Then you need to define the target to start the Scan w3af/profiles>>>back. to get back to the main menu and then

w3af>>> target

w3af/config:target>>> set target

w3af/config:target>>> save

w3af/config:target>>> back

It will save all the configurations.

Also Read: XSSer automated framework to detect, exploit and report XSS vulnerabilities

OWASP Top 10 Vulnerabilities

Then you need to start the scan with w3af.

w3af >> start

OWASP Top 10 Vulnerabilities

Normally scan will take around 20 minutes to complete all OWASP Top 10 Vulnerabilities, depending upon the target it may vary. Happy pentesting!!

You can follow us on LinkedinTwitter, and Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.


Latest articles

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...

Malicious NuGet Campaign Tricking Developers To Inject Malicious Code

Hackers often target NuGet as it's a popular package manager for .NET, which developers...

Akira Ransomware Attacking Airline Industry With Legitimate Tools

Airlines often become the target of hackers as they contain sensitive personal and financial...

DarkGate Malware Exploiting Excel Files And SMB File Shares

DarkGate, a Malware-as-a-Service (MaaS) platform, experienced a surge in activity since September 2023, employing...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles