Wapiti Cheat Blatt

generieren

Überblick

Wapiti ist ein Web Application Sicherheitsscanner, der Black-Box-Tests von Web-Anwendungen durchführt. Es krabbelt Webseiten und sucht nach Skripten und Formularen, wo es Daten injizieren kann. Sobald es die Liste der URLs, Formulare und deren Eingaben erhält, handelt Wapiti wie ein Fuzzer, injiziert Nutzlasten, um zu sehen, ob ein Skript verletzlich ist. Wapiti kann verschiedene Schwachstellen wie SQL-Injektion, XSS, Dateiinklusion, Befehlsausführung und mehr erkennen.

ZEIT Warning: Verwenden Sie Wapiti nur gegen Anwendungen, die Sie besitzen oder eine ausdrückliche Erlaubnis zum Testen haben. Unberechtigte Tests können gegen die Nutzungsbedingungen oder lokale Gesetze verstoßen.

Installation

Python Paket Installation

```bash

Install via pip

pip install wapiti3

Install with all dependencies

pip install wapiti3[complete]

Install development version

pip install git+https://github.com/wapiti-scanner/wapiti.git

Verify installation

wapiti --version ```_

Systempaket Installation

```bash

Ubuntu/Debian

sudo apt update sudo apt install wapiti

CentOS/RHEL/Fedora

sudo yum install wapiti

or

sudo dnf install wapiti

Arch Linux

sudo pacman -S wapiti

macOS with Homebrew

brew install wapiti ```_

Docker Installation

```bash

Pull Docker image

docker pull wapiti/wapiti:latest

Run with Docker

docker run --rm -it wapiti/wapiti:latest --help

Create alias for easier usage

echo 'alias wapiti="docker run --rm -it -v $(pwd):/data wapiti/wapiti:latest"' >> ~/.bashrc source ~/.bashrc ```_

Manuelle Installation

```bash

Clone repository

git clone https://github.com/wapiti-scanner/wapiti.git cd wapiti

Install dependencies

pip install -r requirements.txt

Install

python setup.py install

Or run directly

python wapiti.py --help ```_

Basisnutzung

Einfache Schwachstelle Scannen

```bash

Basic scan

wapiti -u http://target.com

Scan with specific modules

wapiti -u http://target.com -m sql,xss,file

Scan with all modules

wapiti -u http://target.com -m all

Verbose scan

wapiti -u http://target.com -v 2

Quiet scan

wapiti -u http://target.com -q ```_

Crawling Optionen

```bash

Set crawling depth

wapiti -u http://target.com --depth 3

Set maximum pages to crawl

wapiti -u http://target.com --max-pages 100

Set crawling scope

wapiti -u http://target.com --scope domain

Include/exclude specific paths

wapiti -u http://target.com --skip-crawl "/admin,/test"

Follow external links

wapiti -u http://target.com --scope url ```_

Authentication

```bash

Basic authentication

wapiti -u http://target.com --auth-user admin --auth-password secret

wapiti -u http://target.com --cookie "PHPSESSID=abc123; auth=true"

Custom headers

wapiti -u http://target.com --headers "Authorization: Bearer token123"

wapiti -u http://target.com --auth-method form --auth-url http://target.com/login --auth-user admin --auth-password secret ```_

Schwachstellenmodule

Verfügbare Module

```bash

List all available modules

wapiti --list-modules

SQL injection detection

wapiti -u http://target.com -m sql

Cross-site scripting (XSS)

wapiti -u http://target.com -m xss

File inclusion vulnerabilities

wapiti -u http://target.com -m file

Command execution

wapiti -u http://target.com -m exec

Cross-site request forgery (CSRF)

wapiti -u http://target.com -m csrf

Server-side request forgery (SSRF)

wapiti -u http://target.com -m ssrf

XML external entity (XXE)

wapiti -u http://target.com -m xxe

Backup file detection

wapiti -u http://target.com -m backup

Directory traversal

wapiti -u http://target.com -m traversal

HTTP security headers

wapiti -u http://target.com -m headers ```_

Modulspezifische Scans

```bash

Comprehensive SQL injection scan

wapiti -u http://target.com -m sql --level 2

XSS with custom payloads

wapiti -u http://target.com -m xss --payload-file xss_payloads.txt

File inclusion with time delay

wapiti -u http://target.com -m file --timeout 10

Command execution with specific OS

wapiti -u http://target.com -m exec --os linux

Multiple modules

wapiti -u http://target.com -m "sql,xss,file,exec" ```_

Erweiterte Konfiguration

Proxy und Netzwerkeinstellungen

```bash

Use HTTP proxy

wapiti -u http://target.com --proxy http://127.0.0.1:8080

Use SOCKS proxy

wapiti -u http://target.com --proxy socks5://127.0.0.1:9050

Set timeout

wapiti -u http://target.com --timeout 30

Set delay between requests

wapiti -u http://target.com --delay 2

Set user agent

wapiti -u http://target.com --user-agent "Custom Scanner 1.0"

Ignore SSL certificate errors

wapiti -u https://target.com --verify-ssl 0 ```_

Crawling Konfiguration

```bash

Set maximum crawling time

wapiti -u http://target.com --max-scan-time 3600

Set maximum parameters per page

wapiti -u http://target.com --max-parameters 20

Set maximum attack time per URL

wapiti -u http://target.com --max-attack-time 300

Exclude specific file types

wapiti -u http://target.com --exclude ".pdf,.jpg,*.png"

Include only specific file types

wapiti -u http://target.com --include ".php,.asp,*.jsp"

Set crawling rules

wapiti -u http://target.com --crawl-rules "follow_redirects,parse_robots" ```_

Ausgabe und Reporting

```bash

Generate HTML report

wapiti -u http://target.com -f html -o /tmp/wapiti_report.html

Generate XML report

wapiti -u http://target.com -f xml -o /tmp/wapiti_report.xml

Generate JSON report

wapiti -u http://target.com -f json -o /tmp/wapiti_report.json

Generate TXT report

wapiti -u http://target.com -f txt -o /tmp/wapiti_report.txt

Multiple output formats

wapiti -u http://target.com -f html,xml,json -o /tmp/wapiti_report ```_

Spezielles Scannen

API Testing

```bash

Scan REST API

wapiti -u http://api.target.com/v1 --scope domain -m "sql,xss,xxe"

Scan with API authentication

wapiti -u http://api.target.com/v1 --headers "Authorization: Bearer token123" -m all

Scan GraphQL endpoints

wapiti -u http://target.com/graphql -m "sql,xss" --level 2

Scan with custom content type

wapiti -u http://api.target.com/v1 --headers "Content-Type: application/json" -m all ```_

Formbasierte Prüfung

```bash

Focus on forms only

wapiti -u http://target.com --attack-forms-only

Skip GET parameters

wapiti -u http://target.com --skip-get-params

Test specific form fields

wapiti -u http://target.com --form-data "username=admin&password;=test"

Upload file testing

wapiti -u http://target.com --upload-dir /tmp/uploads -m file ```_

Sitzungsmanagement

```bash

Use session file

wapiti -u http://target.com --session-file session.json

Save session for later use

wapiti -u http://target.com --save-session session.json

Resume previous scan

wapiti -u http://target.com --resume-session session.json

Clear session data

wapiti -u http://target.com --clear-session ```_

Benutzerdefinierte Payloads und Regeln

Individuelle Payload-Dateien

```bash

Create custom SQL injection payloads

cat > sql_payloads.txt << 'EOF' ' OR '1'='1 ' UNION SELECT NULL-- '; DROP TABLE users-- ' AND SLEEP(5)-- ' OR 1=1# EOF

Use custom payloads

wapiti -u http://target.com -m sql --payload-file sql_payloads.txt

Create custom XSS payloads

cat > xss_payloads.txt << 'EOF'

javascript:alert('XSS')

wapiti -u http://target.com -m xss --payload-file xss_payloads.txt ```_

Konfigurationsdateien

```bash

Create configuration file

cat > wapiti.conf << 'EOF' [general] timeout = 30 delay = 1 max_pages = 200 max_scan_time = 7200

[crawling] depth = 3 scope = domain follow_redirects = true

[modules] sql = true xss = true file = true exec = false csrf = true

[output] format = html,json output_dir = /tmp/wapiti_reports EOF

Use configuration file

wapiti -u http://target.com --config wapiti.conf ```_

Kundenspezifische Angriffsmodule

```python

!/usr/bin/env python3

Custom Wapiti module example

from wapitiCore.attack.attack import Attack from wapitiCore.language.vulnerability import Vulnerability

class CustomAttack(Attack): """Custom attack module for Wapiti"""

name = "custom"
description = "Custom vulnerability detection"

def __init__(self, crawler, persister, logger, attack_options):
    super().__init__(crawler, persister, logger, attack_options)
    self.payloads = [
        "custom_payload_1",
        "custom_payload_2",
        "custom_payload_3"
    ]

def attack(self, http_res):
    """Main attack method"""
    url = http_res.url

    for payload in self.payloads:
        # Inject payload and test response
        test_url = f"\\\\{url\\\\}?test=\\\\{payload\\\\}"

        try:
            response = self.crawler.get(test_url)

            if self.is_vulnerable(response):
                vuln = Vulnerability(
                    category="Custom Vulnerability",
                    level=Vulnerability.HIGH_LEVEL,
                    request=response.http_request,
                    info="Custom vulnerability detected"
                )
                self.add_vuln(vuln)

        except Exception as e:
            self.logger.error(f"Error testing \\\\{test_url\\\\}: \\\\{e\\\\}")

def is_vulnerable(self, response):
    """Check if response indicates vulnerability"""
    indicators = ["error", "exception", "debug"]
    return any(indicator in response.content.lower() for indicator in indicators)

```_

Automatisierungsskripte

Umfassendes Scannen von Skript

```bash

!/bin/bash

Comprehensive web application security scan

TARGET="$1" OUTPUT_DIR="wapiti_scan_$(date +%Y%m%d_%H%M%S)"

if [ -z "$TARGET" ]; then echo "Usage: $0 " exit 1 fi

mkdir -p "$OUTPUT_DIR"

echo "[+] Starting comprehensive scan for: $TARGET"

Basic vulnerability scan

echo "[+] Running basic vulnerability scan..." wapiti -u "$TARGET" \ -m "sql,xss,file,exec,csrf,ssrf" \ -f html,json \ -o "$OUTPUT_DIR/basic_scan" \ --level 2 \ --timeout 30 \ --max-pages 500

Deep SQL injection scan

echo "[+] Running deep SQL injection scan..." wapiti -u "$TARGET" \ -m sql \ -f json \ -o "$OUTPUT_DIR/sql_scan.json" \ --level 3 \ --timeout 60

XSS focused scan

echo "[+] Running XSS focused scan..." wapiti -u "$TARGET" \ -m xss \ -f json \ -o "$OUTPUT_DIR/xss_scan.json" \ --level 2 \ --timeout 30

File inclusion scan

echo "[+] Running file inclusion scan..." wapiti -u "$TARGET" \ -m file \ -f json \ -o "$OUTPUT_DIR/file_scan.json" \ --level 2

Backup file detection

echo "[+] Running backup file detection..." wapiti -u "$TARGET" \ -m backup \ -f json \ -o "$OUTPUT_DIR/backup_scan.json"

Security headers check

echo "[+] Checking security headers..." wapiti -u "$TARGET" \ -m headers \ -f json \ -o "$OUTPUT_DIR/headers_scan.json"

echo "[+] Scan completed. Results saved to: $OUTPUT_DIR"

Generate summary

python3 ``<< EOF import json import os from collections import defaultdict

results_dir = "$OUTPUT_DIR" vulnerabilities = defaultdict(list)

for filename in os.listdir(results_dir): if filename.endswith('.json'): filepath = os.path.join(results_dir, filename) try: with open(filepath, 'r') as f: data = json.load(f) if 'vulnerabilities' in data: for vuln in data['vulnerabilities']: vuln_type = vuln.get('type', 'Unknown') vulnerabilities[vuln_type].append(vuln) except Exception as e: print(f"Error processing \{filename\}: \{e\}")

print("\n=== VULNERABILITY SUMMARY ===") total_vulns = 0 for vuln_type, vulns in vulnerabilities.items(): count = len(vulns) total_vulns += count print(f"\{vuln_type\}: \{count\}")

print(f"\nTotal vulnerabilities found: \{total_vulns\}")

Save summary

summary = \{ 'total_vulnerabilities': total_vulns, 'by_type': \{k: len(v) for k, v in vulnerabilities.items()\} \}

with open(os.path.join(results_dir, 'summary.json'), 'w') as f: json.dump(summary, f, indent=2) EOF ```_

Continuous Monitoring Script

```bash

!/bin/bash

Continuous web application monitoring

CONFIG_FILE="monitor_config.conf" LOG_FILE="wapiti_monitor.log"

Configuration

TARGETS=( "https://app1.example.com" "https://app2.example.com" "https://api.example.com" )

SCAN_INTERVAL=86400 # 24 hours ALERT_EMAIL="security@example.com"

log_message() \{ echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"|tee -a "$LOG_FILE" \}

send_alert() \{ local target="$1" local vuln_count="$2" local report_file="$3"

if [ "$vuln_count" -gt 0 ]; then
    log_message "ALERT: $vuln_count vulnerabilities found in $target"

    # Send email alert (requires mail command)
    if command -v mail >``/dev/null 2>&1; then
        echo "Wapiti scan found $vuln_count vulnerabilities in $target. See attached report."|\
            mail -s "Security Alert: Vulnerabilities Detected" -A "$report_file" "$ALERT_EMAIL"
    fi
fi

\\}

scan_target() \\{ local target="$1" local timestamp=$(date +%Y%m%d_%H%M%S) local output_dir="monitor_$\\{timestamp\\}" local report_file="$\\{output_dir\\}/scan_report.json"

log_message "Starting scan for: $target"

mkdir -p "$output_dir"

# Run Wapiti scan
wapiti -u "$target" \
    -m "sql,xss,file,exec,csrf" \
    -f json \
    -o "$report_file" \
    --timeout 30 \
    --max-pages 200 \
    --level 1 \
    2>>"$LOG_FILE"

if [ -f "$report_file" ]; then
    # Count vulnerabilities
    vuln_count=$(python3 -c "

import json try: with open('$report_file', 'r') as f: data = json.load(f) print(len(data.get('vulnerabilities', []))) except: print(0) ")

    log_message "Scan completed for $target. Found $vuln_count vulnerabilities."
    send_alert "$target" "$vuln_count" "$report_file"

    # Cleanup old reports (keep last 10)

| ls -t monitor_*/scan_report.json 2>/dev/null | tail -n +11 | xargs rm -f 2>/dev/null |

else
    log_message "ERROR: Scan failed for $target"
fi

\\}

Main monitoring loop

while true; do log_message "Starting monitoring cycle"

for target in "$\\\\{TARGETS[@]\\\\}"; do
    scan_target "$target"
    sleep 60  # Wait between targets
done

log_message "Monitoring cycle completed. Sleeping for $SCAN_INTERVAL seconds."
sleep "$SCAN_INTERVAL"

done ```_

CI/CD Integrationsskript

```bash

!/bin/bash

CI/CD pipeline integration script

set -e

TARGET_URL="$1" FAIL_ON_VULN="$\\{2:-true\\}" OUTPUT_DIR="wapiti_ci_$(date +%Y%m%d_%H%M%S)"

if [ -z "$TARGET_URL" ]; then echo "Usage: $0 [fail_on_vulnerabilities]" exit 1 fi

mkdir -p "$OUTPUT_DIR"

echo "Starting security scan for: $TARGET_URL"

Run Wapiti scan

wapiti -u "$TARGET_URL" \ -m "sql,xss,file,exec,csrf" \ -f json,html \ -o "$OUTPUT_DIR/security_scan" \ --timeout 30 \ --max-pages 100 \ --level 1

Process results

REPORT_FILE="$OUTPUT_DIR/security_scan.json"

if [ -f "$REPORT_FILE" ]; then # Count vulnerabilities by severity python3 << EOF import json import sys

with open('$REPORT_FILE', 'r') as f: data = json.load(f)

vulnerabilities = data.get('vulnerabilities', []) total = len(vulnerabilities)

severity_counts = \\{'high': 0, 'medium': 0, 'low': 0\\} for vuln in vulnerabilities: severity = vuln.get('level', 'low').lower() if severity in severity_counts: severity_counts[severity] += 1

print(f"Security Scan Results:") print(f"Total vulnerabilities: \\{total\\}") print(f"High severity: \\{severity_counts['high']\\}") print(f"Medium severity: \\{severity_counts['medium']\\}") print(f"Low severity: \\{severity_counts['low']\\}")

Exit with error code if vulnerabilities found and fail_on_vuln is true

if '$FAIL_ON_VULN' == 'true' and total > 0: print("\nSecurity vulnerabilities detected. Failing build.") sys.exit(1) else: print("\nSecurity scan completed successfully.") sys.exit(0) EOF

else echo "ERROR: Scan report not found" exit 1 fi ```_

Integration mit anderen Tools

Integration von Burp Suite

```bash

Use Burp as proxy for Wapiti

wapiti -u http://target.com --proxy http://127.0.0.1:8080

Export discovered URLs to Burp

wapiti -u http://target.com --crawl-only -f txt -o burp_targets.txt ```_

OWASP ZAP Integration

```bash

Use ZAP as proxy

wapiti -u http://target.com --proxy http://127.0.0.1:8080

Generate ZAP-compatible report

wapiti -u http://target.com -f xml -o zap_import.xml ```_

Nucles Integration

```bash

Extract URLs for Nuclei

wapiti -u http://target.com --crawl-only --format txt|grep -E '^http' > nuclei_targets.txt

Run Nuclei on discovered URLs

nuclei -l nuclei_targets.txt -t /path/to/nuclei-templates/ ```_

Fehlerbehebung

Gemeinsame Themen

Crawling Probleme

```bash

Increase crawling timeout

wapiti -u http://target.com --timeout 60

Reduce crawling depth

wapiti -u http://target.com --depth 1

Skip problematic URLs

wapiti -u http://target.com --skip-crawl "/problematic-path"

Use different user agent

wapiti -u http://target.com --user-agent "Mozilla/5.0 (compatible; Scanner)" ```_

Authentifizierungsfragen

```bash

Debug authentication

wapiti -u http://target.com --auth-user admin --auth-password secret -v 2

wapiti -u http://target.com --cookie "session=valid_session_id"

Test authentication manually first

curl -u admin:secret http://target.com/protected ```_

Leistungsfragen

```bash

Reduce scan scope

wapiti -u http://target.com --max-pages 50

Increase delays

wapiti -u http://target.com --delay 3

Use fewer modules

wapiti -u http://target.com -m "sql,xss"

Set scan time limit

wapiti -u http://target.com --max-scan-time 1800 ```_

SSL/TLS Ausgaben

```bash

Disable SSL verification

wapiti -u https://target.com --verify-ssl 0

Use specific SSL version

wapiti -u https://target.com --ssl-version TLSv1.2

Debug SSL issues

wapiti -u https://target.com -v 2 --verify-ssl 0 ```_

Debugging und Logging

```bash

Enable verbose logging

wapiti -u http://target.com -v 2

Save debug information

wapiti -u http://target.com -v 2 2>&1|tee wapiti_debug.log

Test specific module

wapiti -u http://target.com -m sql -v 2

Dry run (crawl only)

wapiti -u http://target.com --crawl-only -v 1 ```_

Ressourcen

[offizielle Wapiti-Dokumentation](LINK_7 -%20Wapiti%20GitHub%20Repository
[OWASP Web Security Testing Guide](LINK_7 -%20[Web%20Application%20Security%20Scanner%20Evaluation](LINK_7 -%20(__LINK_7___)
Web Application Penetration Testing
(LINK_7)

--

*Dieses Betrügereiblatt bietet eine umfassende Referenz für die Verwendung von Wapiti für das Scannen von Webanwendungen. Stellen Sie immer sicher, dass Sie eine richtige Berechtigung haben, bevor Sie dieses Tool in jeder Umgebung verwenden. *

Wapiti Cheat Blatt

Überblick

Installation

Python Paket Installation

Install via pip

Install with all dependencies

Install development version

Verify installation

Systempaket Installation

Ubuntu/Debian

CentOS/RHEL/Fedora

or

Arch Linux

macOS with Homebrew

Docker Installation

Pull Docker image

Run with Docker

Create alias for easier usage

Manuelle Installation

Clone repository

Install dependencies

Install

Or run directly

Basisnutzung

Einfache Schwachstelle Scannen

Basic scan

Scan with specific modules

Scan with all modules

Verbose scan

Quiet scan

Crawling Optionen

Set crawling depth

Set maximum pages to crawl

Set crawling scope

Include/exclude specific paths

Follow external links

Authentication

Basic authentication

Cookie-based authentication

Custom headers

Login form authentication

Schwachstellenmodule

Verfügbare Module

List all available modules

SQL injection detection

Cross-site scripting (XSS)

File inclusion vulnerabilities

Command execution

Cross-site request forgery (CSRF)

Server-side request forgery (SSRF)

XML external entity (XXE)

Backup file detection

Directory traversal

HTTP security headers

Modulspezifische Scans

Comprehensive SQL injection scan

XSS with custom payloads

File inclusion with time delay

Command execution with specific OS

Multiple modules

Erweiterte Konfiguration

Proxy und Netzwerkeinstellungen

Use HTTP proxy

Use SOCKS proxy

Set timeout

Set delay between requests

Set user agent

Ignore SSL certificate errors

Crawling Konfiguration

Set maximum crawling time

Set maximum parameters per page

Set maximum attack time per URL

Exclude specific file types

Include only specific file types

Set crawling rules

Ausgabe und Reporting

Generate HTML report

Generate XML report

Generate JSON report

Generate TXT report