20/10/2013 Version 2.3.0 Fixed a colosseum of bugs, especially related to unicode. Software is much more stable. New report template for HTML (using Kube CSS). Using v2.1.5 of Nikto database for mod_nikto. Replaced httplib2 with (python-)requests for everything related to HTTP. Remove BeautifulSoup from package. It is still required however. Core rewrite (PEP8 + more Pythonic) New payloads for the backup, XSS, blind SQL, exec and file modules + more detection rules. So many improvements on lswww (crawler) that I can't make a list here. But Wapiti reached 48% on Wivet. Wapiti cookie format is now based on JSON. Removed SOCKS proxy support (you will have to use a HTTP to SOCKS proxy). Added a HTTPResource class for easier module creation. Code restructuration for better setup. Attack of parameters in query string even for HTTP POST requests. Attack on file uploads (injection in file names). Simpler (and less buggy) colored output with -c. A CURL PoC is given for each vulnerability/anomaly found + raw HTTP request representation in reports. No more parameter reordering + can handle parameters repetition. Added a JSON report generator + fixed the HTML report generator. Added an option to not check SSL certificates. mod_xss : noscipt tag escaping. Can work on parameters that don't have a value in query string. mod_crlf is not activated by default anymore (must call it with -m). Startings URLs (-s) will be fetched even if out of scope. Proxy support for wapiti-getcookie. and wapiti-cookie. Attempt to bring an OpenVAS report generator. Added an home-made SWF parser to extract URLs from flash files. Added an home-made (and more than basic) JS interpreter based on the pynarcissus parser. Lot of work still needs to be done on this. New logo and webpage at wapiti.sf.net. Added german and malaysian translations. Added a script to create standalone archive for Windows (with py2exe). 29/12/2009 Version 2.2.1 (already) Bugfixes only Fixed a bug in lswww if root url is not given complete. Fixed a bug in lswww with a call to BeautifulSoup made on non text files. Fixed a bug that occured when verbosity = 2. Unicode error on stderr. Check the document's content-type and extension before attacking files on the query string. Added a timeout check in the nikto module when downloading the database. 28/12/2009 Version 2.2.0 Added a manpage. Internationalization : translations of Wapiti in spanish and french. Options -k and -i allow the scan to be saved and restored later. Added option -b to set the scope of the scan based on the root url given. Wrote a library to save handle cookies and save them in XML format. Modules are now loaded dynamically with a dependency system. Rewrote the -m option used to activate / deactivate attack modules. New module to search for backup files of scripts on the target webserver. New module to search for weakly configured .htaccess. New module to search dangerous files based on the Nikto database. Differ "raw" XSS from "urlencoded" XSS. Updated BeautifulSoup to version 3.0.8. Better encoding support for webpages (convert to Unicode) Added "resource consumption" as a vulnerability type. Fixed bug ID 2779441 "Python Version 2.5 required?" Fixed bug with special characters in HTML reports. 05/04/2008 Added more patterns for file handling vulnerabilities in PHP. Added GET_SQL and POST_SQL as modules (-m) for attacks. Modifier getcookie.py and cookie.py so they try to get the cookies even if cookielib fails. 27/03/2007 Updated ChangeLogs 26/03/2009 Fixed bug ID 2433127. Comparison was made with HTTP error codes on numeric values but httplib2 return the status code as a string. Forbid httplib2 to handle HTTP redirections. Wapiti and lswww will take care of this (more checks on urls...) Fixed a bug with Blind SQL attacks (the same attack could be launched several times) Fixed an error in blindSQLPayloads.txt. Changed the error message when Wapiti don't get any data from lswww. Verifications to be sure blind SQL attacks won't be launched if "standard" SQL attacks works. 25/03/2009 Exported blind SQL payloads from the code. Now in config file blindSQLPayloads.txt. Set timeout for time-based BSQL attacks to timetout used for HTTP requests + 1 second. Added Blind SQL as a type of vulnerability in the report generator. More verbosity for permanent XSS scan. More docstrings. Updated the REAME. 24/03/2009 Added some docstring to the code. Removed warnign on alpha code. First Blind SQL Injection implementation in Wapiti. Fixed some timeout errors. 22/03/2009 Fixed character encoding error in sql injection module. Changed the md5 and sha1 import in httplib2 to hashlib. 28/11/2008 Google Charts API is added to generate the charts of the reports. 15/11/2008 Re-integration of standard HTTP proxies in httplib2. Integration of HTTP CONNECT tunneling in Wapiti. Fixed bug ID 2257654 "getcookie.py error missing action in html form" 02/11/2008 Integraded the proxy implementation of httplib2 in Wapiti. Can now use SOCKSv5 and SOCKSv4 proxies. 22/10/2008 Fixed a bug with Cookie headers. 19/10/2008 Remplaced urllib2 by httplib2. Wapiti now use persistent HTTP connections, speed up the scan. Included a python SOCKS library. 09/10/2008 Version 2.0.0-beta Added the possibility to generate reports of the vulnerabilities found in HTML, XML or plain-text format. See options -o and -f. HTTP authentification now works. Added the option -n (or --nice) to prevent endless loops during scanning. More patterns for SQL vulnerability detection Code refactoring : more clear and more object-oriented New XSS function is now fully implemented The payloads have been separated from the code into configuration files. Updated BeautifulSoup 15/09/2008 Version 1.1.7-alpha Use GET method if not specified in "method" tag Keep an history of XSS payloads New XSS engine for GET method using a list of payloads to bypass filters New module HTTP.py for http requests Added fpassthru to file handling warnings Added a new new detection string for MS-SQL, submitted by Joe McCray 28/01/2007 Version 1.1.6 New version of lswww 24/10/2006 Version 1.1.5 Wildcard exclusion with -x (--exclude) option 22/10/2006 Fixed a typo in wapiti.py (setAuthCreddentials : one 'd' is enough) Fixed a bug with setAuthCredentials. 07/10/2006 Version 1.1.4 Some modifications have been made on getccokie.py so it can work on Webmin (and probably more web applications) Added -t (--timeout) option to set the timeout in seconds Added -v (--verbose) option to set the verbosity. Three availables modes : 0: only print found vulnerabilities 1: print current attacked urls (existing urls) 2: print every attack payload and url (very much informations... good for debugging) Wapiti is much more modular and comes with some functions to set scan and attack options... look the code ;) Some defaults options are availables as "modules" with option -m (--module) : GET_XSS: only scan for XSS with HTTP GET method (no post) POST_XSS: XSS attacks using POST and not GET GET_ALL: every attack without POST requests 12/08/2006 Version 1.1.3 Fixed the timeout bug with chunked responses (ID = 1536565 on SourceForge) 09/08/2006 Version 1.1.2 Fixed a bug with HTTP 500 and POST attacks 05/08/2006 Version 1.1.1 Fixed the UnboundLocalError due to socket timeouts (bug ID = 1534415 on SourceForge) 27/07/2006 Version 1.1.0 with urllib2 Detection string for mysql_error() Changed the mysql payload (see http://shiflett.org/archive/184 ) Modification of the README file 22/07/2006 Added CRLF Injection. 20/07/2006 Added LDAP Injection and Command Execution (eval, system, passthru...) 11/07/2006 -r (--remove) option to remove parameters from URLs Support for Basic HTTP Auth added but don't work with Python 2.4. Proxy support. Now use cookie files (option "-c file" or "--cookie file") -u (--underline) option to highlight vulnerable parameter in URL Detect more vulnerabilities. 04/07/2006: Now attacks scripts using QUERY_STRING as a parameter (i.e. http://server/script?attackme) 23/06/2006: Version 1.0.1 Can now use cookies !! (use -c var=data or --cookie var=data) Two utilities added : getcookie.py (interactive) and cookie.py (command line) to get a cookie. Now on Sourceforge 25/04/2006: Version 1.0.0