Watobo

Description

Web Application ToolBox aka Watobo is a tool that behaves like BurpSuite or WebScarab. It is capable of passive as well as active scanning and this latest is its real value added. It enables to automatize the discovery of common vulnerabilities (XSS, LFI, SQL injections, ...) in web applications. Its interface is developed in (Fx)Ruby and is quite simple to use. In the time of this writing (version0.9.5rev226), following tests are available:

JBoss AS Basic JBoss Enumeration File Inclusion Local File Inclusion (LFI) Misc Directory Walker File Extensions HTTP Methods Lotus Domino Lotus Domino DB Enumeration

SQL Injection Boolean SQL Injection Simple SQL Injection SAP SAP ITS: Default Services SAP ITS: Services Parameters SAP ITS: Default Commands SAP ITS: XSS XSS Simple Cross Site Scripting Checks

I would like to thank Andreas Schmidt for his reviews.

Table of content

Installation Compatibility Installation under Windows Installation under *ubuntu Installation under OpenSUSE Jssh for Firefox Watobo interface Menu Icons Settings Views Findings/Sites Chat table Dashboard Logs Tools Browser View Fuzzer Manual Request Transcoder Interceptor Plugins Catalog-Scanner SSL-Checker

Learn to use Watobo Lesson1: Project, workspace and session Lesson 2: Passive and active scans Lesson 3: Session management (login and logout simulations) Lesson 4: Interceptor - tamper a request or a response Lesson 5: Manual request and differ - forge manual requests and use the differ to point the differences Lesson 6: Fuzzer - fuzzing basics Lesson 7: Plugins - Catalog-Scanner and SSL-Checker