[New Tool] OWASP OWTF – Offensive (Web) Testing Framework v0.45.0 Released
OWASP OWTF, Offensive (Web) Testing Framework is an OWASP+PTES-focused try to unite great tools and make pen testing more efficient, written mostly in Python. The purpose of this tool is to automate the manual, uncreative part of pen testing: For example, spending time trying to remember how to call “tool X”, parsing results of “tool X” manually to feed “tool Y”, etc.
By reducing this burden the authors hope pen testers will have more time to:
- See the big picture and think out of the box
- More efficiently find, verify and combine vulnerabilities
- Have time to investigate complex vulnerabilities like business logic/architectural flaws or virtual hosting sessions
- Perform more tactical/targeted fuzzing on seemingly risky areas
- Demonstrate true impact despite the short timeframes we are typically given to test.
Some features like the passive and semi_passive test separation may also assist pen testers wishing to go the extra mile to get a head start and maybe even legitimately start report writing or preparing attacks before they are given the green light to test.
The tool is highly configurable and anybody can trivially create simple plugins or add new tests in the configuration files without having any development experience. Please share your tests with the community! 🙂
This tool is however not a silverbullet and will only be as good as the person using it: Understanding and experience will be required to correctly interpret tool output and decide what to investigate further in order to demonstrate impact.
Features
- OWASP Testing Guide-oriented: owtf will try to classify the findings as closely as possible to the OWASP Testing Guide.
- Report updated on the fly: As soon as each plugin finishes or sometimes before (i.e. after each vulnerability scanner finishes).
- “Scumbag spidering”: Instead of implementing yet another spider (a hard job), owtf will scrub the output of all tools/plugins run to gather as many URLs as possible. This is somewhat “cheating” but tremendously effective since it combines the results of different tools, including several tools that perform brute forcing of files and directories.
- Resilience: If one tool crashes owtf will move on to the next tool/test, saving the partial output of the tool until it crashed.
- Easy to configure: config files are easy to read and modify.
- Easy to run: No strange parameters, DB setup requirements, libraries, complex dependencies, etc.
- Full control of what tests to run, interactivity and hopefully easy to follow examples and help 🙂
- Easy to review transaction logs and plain text files with URLs, simple for scripting.
- Basic Google Hacking without (annoying) API Key requirements via “blanket searches”, trying a bunch of operators at once, you can then narrow the search down if you find something interesting.
- Easy to extract data from the database to parse or pass to other tools: They are all text files.
Changelog v0.45.0 Alpha (14/01/2014)
Code Name: Winter Blizzard
- Dedicated to Alessandro Fanio Gonzalez (@alessandrofg), Ankush Jindal (@ankushjindal278), Assem Chelli (@assem-ch), Bharadwaj Machiraju (@tunnelshade), Marios Kourtesis (@marioskourtesis) & their mentors: Andrés Morales, Andrés Riancho, Gareth Heyes, Krzysztof Kotowicz, and their co-mentors: Abraham Aranguren, Azeddine Islam Mennouchi, Hani Benhabiles, Javier Marcos de Prado, Johanna Curiel, Martin Johns.
- New Feature: OWTF can now be updated using a command line flag <=> Bharadwaj Machiraju (@tunnelshade)
- Added and fixed some tests for plugins <=> Alessandro Fanio Gonzalez (@alessandrofg)
- New Feature: Few tools are proxified through OWTF inbound proxy <=> Bharadwaj Machiraju (@tunnelshade)
- New Feature: Httprint signatures updated (still updating) <=> Azeddine Islam Mennouchi
- New Feature: Plug-n-Hack Phase I implemented in OWTF <=> Bharadwaj Machiraju (@tunnelshade)
- Travis CI service is under usage for tests <=> Alessandro Fanio Gonzalez (@alessandrofg)
- New Feature: OWTF Inbound proxy is made capable of websocket traffic proxying <=> Bharadwaj Machiraju (@tunnelshade)
- New Feature: HTTP AUTH support is implemented in OWTF Inbound proxy <=> Bharadwaj Machiraju (@tunnelshade)
- Enhancement: Spiders, Robots and Crawlers grep plugin added <=> Bharadwaj Machiraju (@tunnelshade)
- Enhancement: Web Services passive discovery plugin improved <=> Bharadwaj Machiraju (@tunnelshade)
- New Feature: User can run multiple instances of OWTF <=> Bharadwaj Machiraju (@tunnelshade)
- New Feature: Outbound socks proxy support implemented <=> Marios Kourtesis (@marioskourtesis)
- New Tool: Added nmap to WAF checks <=> Abraham Aranguren (@7a_)
- New Feature: Tor mode added to OWTF <=> Marios Kourtesis (@marioskourtesis)
- New Feature: New Installation procedure added to OWTF <=> Bharadwaj Machiraju (@tunnelshade)
- 40Bug fixes
Requirements
- Linux (any Ubuntu derivative should work just fine) and python 2.6.5 or greater.
- Latest Kali version not required but helpful (almost 0 setup time).
- You do NOT have to have all tools installed: owtf will move on with an error for the missing tools.
More Information: