w3af Guide de l'Utilisateur - Exploit Database

The extensions parameter is a comma separated list of extensionsthat this plugin will try to upload. Many web applicationsverify the extension of the file being uploaded, if specialextensions are required, they can be added here.Some web applications check the contents of the files beinguploaded to see if they are really what their extensionis telling. To bypass this check, this plugin uses filetemplates located at "plugins/audit/fileUpload/", this templatesare valid files for each extension that have a section ( thecomment field in a gif file for example ) that can be replacedby scripting code ( PHP, ASP, etc ).After uploading the file, this plugin will try to find it oncommon directories like "upload" and "files" on every knowdirectory. If the file is found, a vulnerability exists.w3af/plugins>>>Maintenant nous savons ce que fait ce plugin, mais voyons ce qu'il a dans leventre:w3af/plugins>>> audit config xssw3af/plugins/audit/config:xss>>> view|------------------------------------------------------------|| Setting | Value | Description ||------------------------------------------------------------|| checkPersistent | True | Search persistent XSS || numberOfChecks | 2 | Set the amount of checks to || | | perform for each fuzzable || | | parameter. Valid numbers: 1 to || | | 10 ||------------------------------------------------------------|w3af/plugin/xss>>> set checkPersistent Falsew3af/plugin/xss>>> backw3af/plugins>>> audit config sqliw3af/plugins/audit/config:sqli>>> view