hhucn / webvulnscan

automated web application vulnerability scanner
MIT License
38 stars 27 forks source link

WebTest Integration #37

Open rliebig opened 11 years ago

rliebig commented 11 years ago

WebTest is a Framework for testing WSGI-Application without actually performing HTTP-Communicating and has intresting features. It is intresting, because with it, it is possible to lookup the source of the application. One could traceback vulnerable sourcecode to specific functions or maybe even lines. It also offers better integration with forms, etc. However, this should be kept strictly a optional feature.

Links:

rliebig commented 11 years ago

It should be possible to avoid crawling and use the RoutingTable of the Application, as we have access to the environment. This would help to test, as example, APIs.