Web Application Attack and Audit Framework (W3AF)- Tutorial

Security is key point for every effective business, either you are running your own website or you are at job to manage the web application for your company you have to do little penetration testing to check the security of web application.
Now a days exploit are available and update on daily basis for different web application services.

While doing a penetration testing a pen tester must consider these exploit for different vulnerabilities.
To find a vulnerabilities is not enough a pen-tester must check the parallel exploits that are available publicly for different services.

w3af is a Web Application Attack and Audit Framework. The project goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend. w3af is working for Become the best Open Source Web Application Exploitation Framework. It provides information about security vulnerabilities and aids in penetration testing efforts.

The important fact of w3af is that it is available for all major operating system like Microsoft Windows, Linux, MAC OS, FreeBSD and OpenBSD etc. It is written in python programming language and provide both command line interface and graphical user interface.

W3af uses more than 130 plug-in to find vulnerabilities in web applications, after finding vulnerabilities like SQL injections, OS commanding, remote file inclusions (PHP), cross-site scripting (XSS), and unsafe file uploads, can be exploited in order to gain different types of access to the remote system.


Once you have all the prerequisites then you can start w3af as follows:
$ ./w3af

Type help will give you a list of options.

w3af>>> help
The following commands are available:

help                  You are here. help [command] prints more specific help.
url-settings       Configure the URL opener.
misc-settings    Configure w3af misc settings.
session             Load and save sessions.
plugins             Enable, disable and configure plugins.
start                 Start site analysis.
exploit              Exploit a vulnerability.
tools                 Enter the tools section.
target               Set the target URL.
exit                   Exit w3af.

Now see this example:
w3af/plugins>>> audit xss
w3af/plugins>>> audit
Enabled audit plugins:
w3af/plugins>>> discovery webSpider,pykto,hmap
w3af/plugins>>> discovery
Enabled discovery plugins:
w3af/plugins>>> output console,htmlFile
w3af/plugins>>> output
Enabled output plugins:
w3af/plugins>>> output config htmlFile
w3af/plugin/htmlFile>>> view

For video tutorial click here 

Note: If you enjoyed this post, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Security Against Hacks: A Simple Game of Economics

One of the cold hard truths behind cybersecurity is that it's impossible to prevent a hack 100% of the time. It only takes one...

Certain Things That You Must Know About Microsoft MS-500 Exam and Its Practice Tests

If you want to be a Microsoft 365 security administrator, then there would be a number of responsibilities that will fall on your shoulders,...

Quick Ways to Avoid Being Watched by the NSA’s PRISM Program

Big brother is on the watch online. Today, a week hardly passes without news of government spying, whistleblowers, cell phone hacking, or even private photos...

Android Post Exploitation: Exploit ADB using Ghost Framework in Kali Linux

This article is the part of Android Hacking tutorial; it covers step by step guide to exploit Android ADB to get the persistent connection...


Then sign up for FREE to the ehacking’s exclusive group. You will get the exclusive tips/tricks, tutorials, webinars & courses that I ONLY share with my fellow on this exclusive newsletter.