w4af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. It is originally based on w3af and is currently in an early alpha development phase. We welcome early user experience and bug reports, but we don't make any warranties about the software - it's still a work in progress.
The scanner is able to identify 200+ vulnerabilities, including Cross-Site Scripting, SQL injection and OS commanding.
We recommend you to read the user guide before starting to use w4af, there are many FAQs, tips and tricks and other important pieces of information in the manual.
The project expects to use Python 3.11, currently only Ubuntu 22.04 LTS is supported. The project's Python dependencies can be installed by running pipenv in the project's root folder:
python -m pip install --upgrade pipenv wheel
pipenv install
Running pipenv shell with then launch a shell from which it is possible to run w4af.
The project uses NodeJS libraries for some features. To install those dependencies, run:
npm install
Use pytest to run the unit tests:
$ pytest --help
By default, pytest will run all tests, including tests that depend on internet connection, a clean git checkout, and a running integration environment.
The unit tests should run without any integration environment (though some do rely on a live internet connection):
pytest -m "not moth and not wavsep and not w4af_moth and not sqlmap and not mcir and not wivet and not phpmoth and not fails and not git and not gui and not integration and not ci_ignore and not slow and not wordpress and not modsecurity"
You can launch the integration environment with docker-compose:
./w4af/tests/add-test-routes.sh
docker-compose -f ./w4af/tests/docker-compose.yml up
With that running, the integration tests should also pass. Integration tests are tagged according to which environment they rely on - the tag of the test matches the label for the docker service in docker-compose.yml. This will be one of moth, w4af_moth, sqlmap, mcir, wivet, or phpmoth, for example:
docker-compose -f ./w4af/tests/docker-compose.yml up w4af_moth
pytest -m "w4af_moth and not fails"
First install sphinx within a virtual environment and then build documentation
python -m pip install sphinx
sphinx-build -b html doc/sphinx/ doc/sphinx/_build/
The purpose of this software is to help security researches to scan their sites to find vulnerabilities.
You are only allowed to scan websites that you own and/or have permissions to scan. The developers can not be made responsible for any damage that occurs by using this software. Use at your own risk.
Pull requests are always welcome! If you're not sure where to start, please take a look at the TODO First steps as a contributor document in our wiki. All contributions, no matter how small, are welcome.