Automated Audit using WAPITI
Thank you for visiting OWASP.org. We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done.
This is an example of a Project or Chapter Page.
WAPITI is a simple command line to tool to automate the audit of a web application. It’s free and open source and has had some recent edits and updates (WAPITI homepage). The application is available for contribution at (WAPITI Repository).
Please be aware this command line does not replace a manual audit but can be useful to perform a first validation or exploration of legacy projects.
It is also recommended that you perform a build of the app:
python setup.py install
python wapiti http://mysite.com -n 10 -b folder -u -v 1 -f html -o /tmp/scan_report
- -n: Define a limit of urls to read with the same pattern (prevent endless loops), here limit to 10.
- -b: Set the scope of the scan, here we analyze all the links to the pages which are in the same domain as the URL passed.
- -u: Use color to highlight vulnerables parameters in output.
- -v: Define verbosity level, here we print each url.
- -f: Define report type, here we choose HTML format.
- -o: Define report destination, in our case it must be a directory because we choose HTML format.
Attack modules used by WAPITI:
- backup: This module search backup of scripts on the server.
- blindsql: Time-based blind sql scanner.
- crlf: Search for CR/LF injection in HTTP headers.
- exec: Module used to detect command execution vulnerabilities.
- file: Search for include()/fread() and other file handling vulns.
- htaccess: Try to bypass weak htaccess configurations.
- nikto: Use a Nikto database to search for potentially dangerous files.
- permanentxss: Look for permanent XSS.
- sql: Standard error-based SQL injection scanner.
- xss: Module for XSS detection.
- buster: Module for a file and directory buster attack - checking for “bad” files.
- shellshock: Module for Shellshock bug detection.
A sample TXT report is available here.