Michael,
On Wed, Jun 22, 2011 at 8:42 PM, Michael Brooks
<firealwayswo...@gmail.com> wrote:
> When writing a module how do I know what variable to obscure from the IDS?
> When I override the modifyRequest() function it seems too late because I am
> missing mutant.getVar(). Without this information i can't write my new
> IDS bypass exploit for w3af (period).
Yep, your analysis is correct, that information does NOT reach the
modifyRequest() method
> What do I do, is this vital feature really missing?
Until now, this wasn't needed, so it doesn't sound like a vital
feature. For writing all the other plugins what we did is simply
"apply the evasion to all parameters" disregarding if they hold a
payload or not.
If you *really* need this feature, we can think about implementing
it (but it will have low priority) or you can code it and we'll test
and integrate into the trunk.
Regards,
> ------------------------------------------------------------------------------
> Simplify data backup and recovery for your virtual environment with vRanger.
> Installation's a snap, and flexible recovery options mean your data is safe,
> secure and there when you need it. Data protection magic?
> Nope - It's vRanger. Get your free trial download today.
> http://p.sf.net/sfu/quest-sfdev2dev
> _______________________________________________
> W3af-develop mailing list
> W3af-develop@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/w3af-develop
>
>
--
Andrés Riancho
Director of Web Security at Rapid7 LLC
Founder at Bonsai Information Security
Project Leader at w3af
------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger.
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Data protection magic?
Nope - It's vRanger. Get your free trial download today.
http://p.sf.net/sfu/quest-sfdev2dev
_______________________________________________
W3af-develop mailing list
W3af-develop@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/w3af-develop
