Re: [W3af-develop] multiprocessing error that might affect w3af

2011-07-26 Thread Steve Pinkham
On 07/26/2011 11:45 AM, Andres Riancho wrote: Steve, If you look at the patch to sqlmap, that's basically how I changed it. They already had a single threaded implementation, just switched to that if import multiprocessing.synchronize fails. And you're sure that the API is 100% the same and

[W3af-develop] LF standardisation

2011-02-17 Thread Steve Pinkham
The following files all have DOS CRLF or mixed CRLF/LF linefeed characters. The diff at https://sourceforge.net/apps/trac/w3af/ticket/161687 changes these to LF *nix style line feeds, or you can run a tool like dos2unix on the files to do the same thing. core/data/dc/tests/test_form.py

[W3af-develop] quick parser question

2011-02-12 Thread Steve Pinkham
Quick question, slightly off topic: I'm selecting a parser for a job where the quality of the parser is critical in the proper performance of the code. How has libxml2 been for w3af so far? Any problems with parsing, unicode handling, language or charset specific bugs, or any other strange corner

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-09 Thread Steve Pinkham
The only nosql databases I've used so far are key/value oriented(mostly riak). You've convinced me that there might be some benefits to documented oriented storage I haven't considered, so thank you for that. On 02/09/2011 02:39 PM, Martin Holst Swende wrote: I also disagree that they are

Re: [W3af-develop] 2 ideas

2011-02-08 Thread Steve Pinkham
time I was singing the praises of git, the the discussion stopped with: On 01/20/2011 01:56 PM, Andres Riancho wrote: On Thu, Jan 20, 2011 at 1:03 PM, Steve Pinkham steve.pink...@gmail.com wrote: My main point is that if you're not branching for tool limitation reasons, perhaps it's time to re

[W3af-develop] From OWASP summit 2011: Tools Interoperability (Data Instrumentation)

2011-02-08 Thread Steve Pinkham
I'm planning on remotely attending the following OWASP Summit session (as well as others), and I think it is relavent both to the w3af project and open source web appsec improvement in general. http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session056 Unfortunately, it's not

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Steve Pinkham
On 02/08/2011 07:07 PM, Andres Riancho wrote: Steve, On Tue, Feb 8, 2011 at 8:45 PM, Steve Pinkham steve.pink...@gmail.com wrote: On 02/03/2011 12:04 PM, Andres Riancho wrote: Do we know about any noSQL database that's file based like sqlite? Maybe we could use this small rewrite to compare

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Steve Pinkham
On 02/08/2011 08:08 PM, Andres Riancho wrote: Steve, noSQL servers are usually fast because they are in-memory systems. sqlite can be used in that mode also if you like. mongodb is not an in-memory db! In practice, it is. It stores all indexes in memory and uses memory mapped files. It

[W3af-develop] sqlite3 weirdness (AKA I hate python ;-)

2011-02-08 Thread Steve Pinkham
Meh. sqlite has been threadsafe since 2006, and the python adapter still won't let you use connections across multiple threads because you might have an old version. You're using an explicitly unsupported workaround (check_same_thread=False) that may cause dataloss due to optimisations in python

Re: [W3af-develop] [W3af-users] Auto-update feature fully included in w3af

2011-01-27 Thread Steve Pinkham
On 01/27/2011 03:49 AM, Taras wrote: ---snip--- cons 1. svn up from trunk is not always good idea because it can make problems for user (trunk usually is for development) This is also my main concern with the feature. The 3 main failure modes I've seen in the past with my own w3af updates

Re: [W3af-develop] w3af roadmap for the next sprints

2011-01-20 Thread Steve Pinkham
On 01/18/2011 01:57 PM, Andres Riancho wrote: List, Just wanted to let you know that for the next sprints we have the following ideas planned: --snip- - ./w3af_console -t , our integration test, will have a way of exporting its information so Mr. Hudson will be able to parse it and

Re: [W3af-develop] w3af roadmap for the next sprints

2011-01-20 Thread Steve Pinkham
./w3af_console -s scripts/script-archive_dot_org.w3af You have to install nltk. - On Debian based distributions: apt-get install python-nltk- If that's not working for you, please try the following:wget http://pyyaml.org/download/pyyaml/PyYAML-3.09.tar.gztar -xzvf

Re: [W3af-develop] Help on reproducing a HIGH bug

2010-11-15 Thread Steve Pinkham
On 11/15/2010 05:33 PM, Viktor Gazdag wrote: Hi! I forgot to send to the list. If you stop the webserver when you are scanning, it will crash. I tested it. :) Best regards woodspeed That's actually the expected behaviour, annoying but not quite the same as this bug.. Though it might be

[W3af-develop] Sprint 4 - New Moth

2010-11-03 Thread Steve Pinkham
I notice sprint 4 is to include a new release of Moth. I would be happy to assist in that goal. I'm not sure what you have in mind, but there are currently repeatable build scripts in the Web Security Dojo git repo that currently match the Moth w3af test environment bug for bug at the moment.

Re: [W3af-develop] Sprint 4 - New Moth

2010-11-03 Thread Steve Pinkham
On 11/03/2010 03:19 PM, Andres Riancho wrote: but there are currently repeatable build scripts in the Web Security Dojo git repo that currently match the Moth w3af test environment bug for bug at the moment. Could you please send me the link to those build scripts? To

Re: [W3af-develop] W3AF for enterprise?

2010-08-19 Thread Steve Pinkham
On 08/19/2010 06:48 AM, Taras wrote: Hi, all! I have some ideas about things W3AF needs to become enterprise solution: 1. Usable login area scan capabilities. We can make something like in Acunetix (How it made in other scanners). e.g. special (plain text) files with auth information:

[W3af-develop] Test environment bugs (was Re: w3af test environment license)

2010-06-09 Thread Steve Pinkham
On 06/09/2010 01:41 PM, Steve Pinkham wrote: Andres, Are you maintaining the version that is in CVS, or is there later code in another location? I've found lots of problems due to renames and moves and such in the CVS version, and don't want to spend a lot of time creating patches

Re: [W3af-develop] [Task #150826] slash and no slash

2009-03-19 Thread Steve Pinkham
Nicolas Rotta wrote: Andres, could you please send me the virtual machine with the test environment setup. Cheers, Nicolas Rotta So far he hasn't released his VM that I know of(that's a separate project), but a few hints on how to set up the w3af specific test environment can be found