w4af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. It is originally based on w3af.
The scanner is able to identify 200+ vulnerabilities, including Cross-Site Scripting, SQL injection and OS commanding.
We recommend you to read the user's guide before starting to use w4af, there are many FAQs, tips and tricks and other important pieces of information in the manual. w4af
The command-line version of the tool is substantially working with Python 3.10.
At time of writing, the core unit tests are running and passing, and some integration tests are working too.
These unit tests should run without any integration environment (though some do rely on a live internet connection):
pytest -m "not moth and not fails and not git and not gui and not integration and not ci_ignore"
You can launch the integration environment with docker-compose:
./w4af/tests/add-test-routes.sh
docker-compose -f ./w4af/tests/docker-compose.yml up
With that running, some integration tests are also passing:
pytest -m "w4af_moth and not fails"
The project expects to use Python 3.10. The project's Python dependencies can be install with pipenv:
python -m pip install --upgrade pipenv wheel
pipenv install
Running pipenv shell with then launch a shell from which it is possible to run w4af.
The project uses NodeJS libraries for some features. To install those dependencies, run:
npm install
Use pytest to run the unit tests:
$ pytest --help
By default, pytest will run all tests, including tests that depend on internet connection, a clean git checkout, and a running integration environment. We will add more detailed information about how to run the tests as the porting work progresses.
First install sphinx within a virtual environment and then build documentation
python -m pip install sphinx
sphinx-build -b html doc/sphinx/ doc/sphinx/_build/
The purpose of this software is to help security researches to scan their sites to find vulnerabilities.
You are only allowed to scan websites that you own and/or have permissions to scan. The developers can not be made responsible for any damage that occurs by using this software. Use at your own risk.
Pull requests are always welcome! If you're not sure where to start, please take a look at the TODO First steps as a contributor document in our wiki. All contributions, no matter how small, are welcome.