GOWAPT - Teste de Penetração em Aplicações Web Go

GOWAPT é o irmão mais novo do wfuzz, um canivete suíço do WAPT, que permite ao pentester realizar atividades enormes sem nenhum estresse, basta configurá-lo e é só uma questão de cliques.

Como instalar

Para instalar o gowapt basta digitar:

make
sudo make install

Uso

A partir do menu -h

Usage of gowapt:
  -H value
    	A list of additional headers
  -a string
    	Basic authentication (user:password)
  -c string
    	A list of cookies
  -d string
    	POST data for request
  -e string
    	A list of comma separated encoders (default "plain")
  -f string
    	Filter the results
  -from-proxy
    	Get the request via a proxy server
  -fuzz
    	Use the built-in fuzzer
  -p string
    	Use upstream proxy
  -plugin-dir string
    	Directory containing all scanning module
  -scanner
    	Run in scanning mode
  -ssl
    	Use SSL
  -t string
    	Template for request
  -threads int
    	Number of threads (default 10)
  -u string
    	URL to fuzz
  -w string
    	Wordlist file
  -x string
    	Extension file example.js

/* * Create a custom encoder called helloworld * * This encore just add the string "_helloworld" to every payload * coming from the wordlist */ addCustomEncoder("helloworld", myenc); /* * Define the callback method for the helloworld encoder */ function myenc(data) { return data + "_helloword"; } /* * Create an HTTP interceptor * * The interceptor will hook every request / response * is possible to modify request before send it, anyway the respose item * it's just shadow copy of the one received from the server so no modification * are possible * * * request_response is an object which may contains both http.Request * or http.Response , to know which on is contained check is_request flag * * REMEMBER! request_response is an http.* object so you must interact with * this one just like you would do in golang! * * dumpResponse is a built-in function which dump full request-response to * disk. * result is an object filled with stats about the response it contains some fields * * result.tags => Number of tags in the response * result.code => HTTP Response status * result.words => Number of words in the response * result.lines => Number of lines in the response * result.chars => Number of chars in the response * result.request => Full dump of the request * result.response => Full dump of the response * result.response => The injected payload * */ setHTTPInterceptor(function(request_response, result, is_request){ if(is_request){ request_response.Header.Set("Hello", "world") }else{ dumpResponse(request_response, "/tmp/dump.txt") /* * Send an HTTP request in a synchronous way * * This API accept 4 parameters: * method => GET | POST | HEAD | PUT | PATCH | UPDATE * url => The url of the HTTP service * post_data => The content of request bodyBytes * headers => A javascript dictionary {headerName => headerValue} * * The response object may be null or undefined or an http.Response from golang */ var response = sendRequestSync("GET", "http://example.com/", null, {"Fake": "Header"}) } })

Method	Number of params	Description	Params
addCustomEncoder	2	Cria um codificador personalizado para ser usado com wordlists	Param1 -> EncoderName (string) Param2 -> EncoderLogic (function)
panic	1	Para fins de depuração, quebra a aplicação	Param1 -> PanicText (string)
dumpResponse	2	Salva uma requisição/resposta completa em disco, útil para salvar casos de teste	Param1 -> ResponseObject (http.Response) Param2 -> Path (string)
setHTTPInterceptor	1	Cria um interceptador para requisições HTTP de saída e respostas de entrada	Param1 -> HTTPCallback (function) *
sendRequestSync *	4	Envia uma requisição HTTP de forma síncrona	Param1 -> Method (string) Param2 -> Url (string) Param3 -> PostData (string) Param4 -> Headers (Object{Name:Value})

goWAPT

Mais Populares

Extensão

API JS

Scanner

Wordlists

Aparência e Estilo

Codificadores

Filtros

Licença