lavakumar/ironwasp

Source code of IronWASP

ironwasp's Issues

Textbox limitation in Manual Testing tab

Issue occurs when the POST request has a huge body (common on Multi-Part posts., e.g. uploading docs). The text box allows deleting the characters from the text, but not add to it.

Also happens in the format plugins tab under the same section, where the multi-part request is converted to XML, but I'm unable to modify the text values within the XML. I can deleted individual characters.

What happened to IronWASP? It is discontinued/outdated?

Hello Lavakumar,

There is no update after 2013. Please let me know if the tool is discontinued and/or outdated?

[FEATURE] User controlled Auto Redirection

Ability for user to set custom options in Automated Scanning and Manual Testing tabs to automatically follow 30x redirects, with fine grain control.

E.g. follow only 302 and not 301. Follow redirect based on URL regex in Location header, etc.

Url is not reachable. Error connection faild.

I get this when i run it against my web server which is online

Cookies are URL encoded in CookieParameters

The cookies are being URL encoded within the CookieParameters class. This happens when you manually use the SetCookie methods.

Cookies with the format, CookieABC=XYZ=123&PRQ=456 get converted to CookieABC=XYZ%3d123%26PRQ%3d456. This would create problems in some applications as the cookie value is not valid any more.

According to the RFC6265 the cookie-value must have the following format:

; US-ASCII characters excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash

[FEATURE] Custom Scan profiles

User must be able to create custom scan profiles which stores the options set in the 'Configure Scan' window. This should exclude the 'URL pattern' and/or 'Hostname', so that it can be made as generic as possible.

Disable CSP in server responces if Javascript tracing enabled

CSP blocks inlines and some features don't work properly.

Automated Script

I want to write a script in python to run an automated scan on my website. Is there any API available for it?

Does it work?

many years ago, I can download IronWASp.exe. But now, where could I find it?

Rio

SQL Injection check crash

I receive multiple exceptions for SQL Injection crashes. Here's one in particular:

'SQL Injection' check for Scan ID-5 crashed with an exception

Connection Failed

StackTrace:
at IronWASP.Request.Send()
at IronWASP.Scanner.Inject(String RawPayload, Int32 ReDoCount, Boolean PayloadLessInjection, Boolean Raw)
at IronWASP.Scanner.Inject(String Payload)
at CallSite.Target(Closure , CallSite , CodeContext , Object , Object )
at InjectAndCheckBlindDelay$95(Closure , PythonFunction , Object , Object , Object )
at IronPython.Runtime.PythonFunction.FunctionCaller3.Call3(CallSite site, CodeContext context, Object func, T0 arg0, T1 arg1, T2 arg2) at CallSite.Target(Closure , CallSite , CodeContext , Object , Object , Object ) at CheckBlindTime$94(Closure , PythonFunction , Object ) at IronPython.Runtime.PythonFunction.FunctionCaller1.Call1(CallSite site, CodeContext context, Object func, T0 arg0)
at CallSite.Target(Closure , CallSite , CodeContext , Object )
at IronPython.Compiler.Ast.CallExpression.Invoke0Instruction.Run(InterpretedFrame frame)
at Microsoft.Scripting.Interpreter.Interpreter.Run(InterpretedFrame frame)
at Microsoft.Scripting.Interpreter.LightLambda.Run2[T0,T1,TRet](T0 arg0, T1 arg1)
at IronPython.Runtime.PythonFunction.FunctionCaller1.Call1(CallSite site, CodeContext context, Object func, T0 arg0) at CallSite.Target(Closure , CallSite , CodeContext , Object ) at IronPython.Compiler.Ast.CallExpression.Invoke0Instruction.Run(InterpretedFrame frame) at Microsoft.Scripting.Interpreter.Interpreter.Run(InterpretedFrame frame) at Microsoft.Scripting.Interpreter.LightLambda.Run3[T0,T1,T2,TRet](T0 arg0, T1 arg1, T2 arg2) at IronPython.Runtime.PythonFunction.FunctionCaller2.Call2(CallSite site, CodeContext context, Object func, T0 arg0, T1 arg1)
at CallSite.Target(Closure , CallSite , CodeContext , Object , Object )
at IronPython.NewTypes.IronWASP.ActivePlugin_2$3.Check(Scanner Scan)
at IronWASP.Scanner.CheckWithActivePlugin(String PluginName)

[FEATURE] Exclude common framework parameters

IronWASP must include a list of some commonly known framework parameters / cookie names that can be ignored while scanning or fuzzing.

Here is a list of common params / cookies found in the ASP.NET framework:
Body Parameters:

__VIEWSTATE,__EVENTVALIDATION,__EVENTTARGET,__VIEWSTATEENCRYPTED,__EVENTARGUMENT,__LASTFOCUS,__ASYNCPOST

Cookie Names:

ASP.NET_SessionId

Something similar for popular frameworks like Java (Struts, Spring, etc.) and PHP

[FEATURE] Easier rendering of HTML response

To render HTML response, the user has to go to Tools -> Render HTML -> paste response -> Render

It would be convenient to add a UI feature to directly pass the Respose HTML to the "Render HTML" utility via a button or right-click menu option from the Response tab.