Web security audit base pipeline

resources/com/cadoles/w3af/Dockerfile

@@ -0,0 +1,81 @@
+FROM alpine:3.9
+
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG http_proxy=
+ARG https_proxy=
+
+RUN apk --no-cache add \
+    build-base \
+    git \
+    libffi-dev \
+    libxslt-dev \
+    linux-headers \
+    openssl-dev \
+    py-pillow \
+    py-pip \
+    py-setuptools \
+    python \
+    python-dev \
+    sqlite-dev \
+    yaml-dev \
+    nodejs \
+    npm
+
+RUN pip install --upgrade pip \
+  && pip install \
+    pyClamd==0.4.0 \
+    GitPython==2.1.3 \
+    chardet==3.0.4 \
+    futures==3.2.0 \
+    pyOpenSSL==18.0.0 \
+    ndg-httpsclient==0.4.0 \
+    pyasn1==0.4.2 \
+    scapy==2.4.0 \
+    msgpack==0.5.6 \
+    Jinja2==2.10 \
+    vulndb==0.1.1 \
+    psutil==5.4.8 \
+    ds-store==1.1.2 \
+    pebble==4.3.8 \
+    acora==2.1 \
+    diff-match-patch==20121119 \
+    bravado-core==5.0.2 \
+    lz4==1.1.0 \
+    vulners==1.3.0 \
+    ipaddresses==0.0.2 \
+    PyGithub==1.21.0 \
+    pybloomfiltermmap==0.3.14 \
+    phply==0.9.1 nltk==3.0.1 \
+    tblib==0.2.0 \
+    pdfminer==20140328 \
+    lxml==3.4.4 \
+    guess-language==0.2 \
+    cluster==1.1.1b3 \
+    python-ntlm==1.0.1 \
+    halberd==0.2.4 \
+    darts.util.lru==0.5 \
+    markdown==2.6.1 \
+    termcolor==1.1.0 \
+    mitmproxy==0.13 \
+    ruamel.ordereddict==0.4.8 \
+    Flask==0.10.1 \
+    PyYAML==3.12 \
+    tldextract==1.7.2 \
+    esmre==0.3.1 \
+  && npm install -g retire \
+  && rm -rf /root/.cache/pip \
+  && apk del build-base linux-headers
+
+RUN adduser -D w3af
+
+RUN git clone --depth=1 \
+        --branch=master \
+        https://github.com/andresriancho/w3af.git /home/w3af/w3af \
+  && rm -rf /home/w3af/w3af/.git \
+  && chown -R w3af /home/w3af/w3af
+
+USER w3af
+WORKDIR /home/w3af/w3af
+
+CMD ["./w3af_console"]

resources/com/cadoles/w3af/audit.w3af

@@ -0,0 +1,65 @@
+# -----------------------------------------------------------------------------------------------------------
+#                                              W3AF AUDIT SCRIPT FOR WEB APPLICATION
+# -----------------------------------------------------------------------------------------------------------
+#Configure HTTP settings
+http-settings
+set timeout 30
+back
+#Configure scanner global behaviors
+misc-settings
+set max_discovery_time 20
+set fuzz_cookies True
+set fuzz_form_files True
+set fuzz_url_parts True
+set fuzz_url_filenames True
+back
+plugins
+#Configure entry point (CRAWLING) scanner
+crawl web_spider
+crawl config web_spider
+set only_forward False
+set ignore_regex (?i)(logout|disconnect|signout|exit)+
+back
+#Configure vulnerability scanners
+##Specify list of AUDIT plugins type to use
+audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload, ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli, xpath, xss, xst
+##Customize behavior of each audit plugin when needed
+audit config file_upload
+set extensions jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe
+back
+##Specify list of GREP plugins type to use (grep plugin is a type of plugin that can find also vulnerabilities or informations disclosure)
+grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages, 
+html_comments, objects, path_disclosure, private_ip, strange_headers, strange_http_codes, strange_parameters, strange_reason, url_session, xss_protection_header
+##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin is a type of plugin that can find informations disclosure)
+infrastructure server_header, server_status, domain_dot, dot_net_errors
+#Configure target authentication
+auth detailed
+auth config detailed
+set username admin
+set password password
+set method POST
+set auth_url http://pcdom/dvwa/login.php
+set username_field user	
+set password_field pass
+set check_url http://pcdom/dvwa/index.php
+set check_string 'admin'
+set data_format username=%U&password=%P&Login=Login
+back
+#Configure reporting in order to generate an HTML report
+output console, html_file
+output config html_file
+set output_file /tmp/W3afReport.html
+set verbose False
+back
+output config console
+set verbose False
+back
+back
+#Set target informations, do a cleanup and run the scan
+target 
+set target http://pcdom/dvwa
+set target_os windows
+set target_framework php
+back
+cleanup
+start