Kali Linux Tool: Wapiti
# Kali Linux Tool: Wapiti## Section 5: Mastering Wapiti for Web Application SecurityWelcome to the final section of our comprehensive pentesting course dedicated to the powerful Kali Linux tool, Wapiti. In this section, we will cover the installation and configuration of Wapiti on Kali Linux, followed by a detailed breakdown of its usage with real-world examples. Ensure you have a firm grasp of the fundamentals of web application security, as we will explore various use cases and provide technical insights that can enhance your pentesting arsenal.### 1. Installation and Configuration on Kali LinuxWapiti is a command-line tool used for auditing the security of web applications. It scans web pages to find scripts and forms that can be vulnerable to various attacks, such as SQL injection, XSS, and others. Below are the steps to install and configure Wapiti on your Kali Linux environment.#### 1.1 Installing WapitiKali Linux comes pre-installed with a wide range of pentesting tools, including Wapiti. However, if it's not available on your system, or you wish to install the latest version, you can do so using the following commands:
# Update the package list
sudo apt update
# Install Wapiti
sudo apt install wapiti
You can verify the installation by checking the version of Wapiti:
#### 1.2 Configuring WapitiWapiti stores its configuration files in the `~/.wapiti/` directory. You might want to create or modify the configuration files to customize your scans. The main configuration file is `config.py`, where you can set various parameters like proxy settings, user agents, and more.To edit the configuration file, use your preferred text editor:
Here you can adjust options such as the `user_agent`, `timeout`, and even enable logging. After making changes, save the file and exit the editor.### 2. Step-by-Step Usage of WapitiLet’s dive into the practical usage of Wapiti. In this section, we will simulate a pentesting scenario on a WordPress web application.#### 2.1 Basic ScanTo initiate a basic scan on a target URL, you can run the following command:
wapiti -u http://target-wordpress-site.com
This command will start a basic scan of the specified URL. Wapiti will check for vulnerabilities, and the output will provide a summary report of what it has found.#### 2.2 Advanced OptionsWapiti offers various options that allow you to customize your scans. Below are some commonly used parameters:– **-m**: Specify the modules to be used. For example, if you want to focus on SQL injection and XSS, you can specify them as follows:
wapiti -u http://target-wordpress-site.com -m sqli,xss
– **-p**: Set the HTTP proxy to route your requests. This is useful for monitoring or filtering web traffic:
wapiti -u http://target-wordpress-site.com -p http://127.0.0.1:8080
– **-o**: Output the results to a file in desired formats such as HTML or JSON:
wapiti -u http://target-wordpress-site.com -o report.html
#### 2.3 Real-World Usage Example: WordPress ScanLet’s consider a scenario where you’re tasked with testing a WordPress installation for vulnerabilities. Start by identifying the target URL:
TARGET="http://example-wordpress-site.com"
Next, launch Wapiti with the following command:
wapiti -u $TARGET -m sqli,xss,csrf -o report.html
#### 2.4 Understanding the OutputOnce the scan completes, Wapiti generates a report that includes:– **Vulnerability Findings**: Detailed findings of potential vulnerabilities discovered during the scan.
– **Severity Levels**: Each vulnerability is associated with a severity level (low, medium, high) to aid in risk assessment.
– **Remediation Suggestions**: Recommendations on how to fix or mitigate the vulnerabilities.The report can be viewed in an HTML or JSON format depending on your preference. Open the report in a web browser for a user-friendly interface:
### 3. Detailed Technical Explanations#### 3.1 SQL Injection VulnerabilitySQL injection (SQLi) is a critical vulnerability that allows an attacker to manipulate SQL queries by injecting malicious code. Wapiti scans for SQL injection points in forms and URL parameters. It does this by:– Testing various payloads against input fields.
– Analyzing the server's response for SQL errors.**Example Vulnerable Code in WordPress:**[/dm_code_snippet]php
$userid = $_GET['userid'];
$query = "SELECT * FROM users WHERE id = '$userid'";
$result = mysqli_query($conn, $query);
[/dm_code_snippet]In the above code, if `$userid` is not sanitized, an attacker could manipulate the `userid` parameter to execute arbitrary SQL commands.#### 3.2 Cross-Site Scripting (XSS)Cross-Site Scripting allows attackers to inject malicious scripts into web pages viewed by other users. Wapiti identifies potential XSS vulnerabilities by:– Injecting scripts into input fields.
– Checking if the script is reflected in the response.**Example of XSS in WordPress:**[/dm_code_snippet]php
echo $_GET['comment']; // Possible XSS vulnerability
[/dm_code_snippet]If an attacker inputs a script tag in the comment parameter, it will be executed in the context of other users’ browsers.### 4. External Reference LinksFor further reading and to deepen your understanding of Wapiti, web application security, and vulnerability assessment, consider checking out the following resources:– [OWASP Top Ten – The Ten Most Critical Web Application Security Risks](https://owasp.org/www-project-top-ten/)
– [Wapiti Documentation](http://wapiti.sourceforge.net/)
– [SQL Injection Prevention Cheat Sheet – OWASP](https://owasp.org/www-community/attacks/SQL_Injection_Prevention_Cheat_Sheet)
– [Cross-Site Scripting (XSS) Prevention Cheat Sheet – OWASP](https://owasp.org/www-community/attacks/xss)### ConclusionIn this section, we’ve navigated through the installation, configuration, and usage of Wapiti for assessing web application vulnerabilities. We explored real-world examples focusing on WordPress while providing detailed explanations of critical vulnerabilities such as SQL injection and XSS. By mastering Wapiti, you enhance your web application security assessments, making you more effective in identifying and mitigating risks.Now that you've completed the Wapiti course, you should feel confident in using this powerful tool for your web application security assessments.Made by pablo rotem / פבלו רותם
