{"id":656,"date":"2018-08-18T15:21:14","date_gmt":"2018-08-18T14:21:14","guid":{"rendered":"http:\/\/louis.hatier.me\/blog\/?p=656"},"modified":"2018-08-31T12:36:14","modified_gmt":"2018-08-31T11:36:14","slug":"wapiti-scan-de-vulnerabilites","status":"publish","type":"post","link":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/","title":{"rendered":"Wapiti : scan de vuln\u00e9rabilit\u00e9s"},"content":{"rendered":"<p><a href=\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\" data-rel=\"lightbox-gallery-eTBLDtr3\" data-rl_title=\"\" data-rl_caption=\"\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-657 alignleft\" src=\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\" alt=\"Logo Wapiti\" width=\"161\" height=\"158\" srcset=\"https:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png 381w, https:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti-300x295.png 300w\" sizes=\"auto, (max-width: 161px) 100vw, 161px\" \/><\/a><a href=\"http:\/\/wapiti.sourceforge.net\/\" target=\"_blank\" rel=\"noopener\">Wapiti<\/a> est un outil de scan d&rsquo;application web en mode <a href=\"https:\/\/fr.wikipedia.org\/wiki\/Fuzzing\" target=\"_blank\" rel=\"noopener\">fuzzer<\/a> afin de d\u00e9tecter d&rsquo;\u00e9ventuels vuln\u00e9rabilit\u00e9s.<\/p>\n<p>Il parse les pages web et renvoie un audit des diff\u00e9rentes failles pr\u00e9sentes : XSS, injection SQL, CRLF etc.<\/p>\n<p>Les instructions d&rsquo;installation sont d\u00e9taill\u00e9es sur le <a href=\"https:\/\/sourceforge.net\/p\/wapiti\/code\/HEAD\/tree\/trunk\/INSTALL.md\" target=\"_blank\" rel=\"noopener\">site officiel<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<p><!--more--><\/p>\n<p>Concernant <a href=\"http:\/\/louis.hatier.me\/blog\/ubuntu-desktop\/\">Ubuntu<\/a>, voici comment proc\u00e9der :<\/p>\n<pre><code class=\"no-highlight\">sudo apt-get install python3-venv libxml2 libxml2-dev libz-dev libxslt1-dev python3-dev\r\ncd wapiti-3.0.0\r\nsudo python3 setup.py install\r\n<\/code><\/pre>\n<p>Le ManPage est disponible sur la <a href=\"http:\/\/wapiti.sourceforge.net\/wapiti.1.html#SYNOPSIS\" target=\"_blank\" rel=\"noopener\">documentation<\/a>.<\/p>\n<h2>Exemple d&rsquo;utilisation<\/h2>\n<pre><code class=\"no-highlight\">wapiti -u http:\/\/devlouis\/myapp\/web\/ -v 2 -o myapp -x http:\/\/devlouis\/myapp\/web\/_profiler* -t 10 --color -f json\r\n<\/code><\/pre>\n<p>Le scan peut \u00eatre int\u00e9grer \u00e0 votre <a href=\"http:\/\/louis.hatier.me\/blog\/jenkins-pipeline-et-blue-ocean\/\">Pipeline Jenkins<\/a> de cette fa\u00e7on.<\/p>\n<h2>Explications<\/h2>\n<ul>\n<li>-u l&rsquo;URL \u00e0 parser<\/li>\n<li>-v 2 verbeux (level 2)<\/li>\n<li>-o myapp nom du dossier pour l&rsquo;output HTML<\/li>\n<li>-x http:\/\/&#8230;.. URL \u00e0 exclure (dans l&rsquo;exemple j\u2019exclu tout apr\u00e8s _profiler)<\/li>\n<li>-t 10 consid\u00e8re une page en timeout apr\u00e8s 10 secondes<\/li>\n<li>&#8211;color plus sympa visuellement dans la console<\/li>\n<li>-f json format d&rsquo;output en JSON (par d\u00e9faut = html)<\/li>\n<\/ul>\n<p>Le reporting au format HTML est plus lisible (Cf. image), mais le format JSON est pr\u00e9f\u00e9rable car il permet de parser le fichier afin de d\u00e9clencher une exception si des vuln\u00e9rabilit\u00e9s sont d\u00e9tect\u00e9es.<br \/>\n<a href=\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/wapiti-output.png\" data-rel=\"lightbox-gallery-eTBLDtr3\" data-rl_title=\"\" data-rl_caption=\"\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-658\" src=\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/wapiti-output.png\" alt=\"Wapiti output\" width=\"544\" height=\"515\" srcset=\"https:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/wapiti-output.png 878w, https:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/wapiti-output-300x284.png 300w, https:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/wapiti-output-768x727.png 768w\" sizes=\"auto, (max-width: 544px) 100vw, 544px\" \/><\/a><\/p>\n<h2>Lister les modules disponibles<\/h2>\n<pre><code class=\"no-highlight\">wapiti --liste-modules\r\n<\/code><\/pre>\n<div style=\"padding-bottom:20px; padding-top:10px;\" class=\"hupso-share-buttons\"><!-- Hupso Share Buttons - https:\/\/www.hupso.com\/share\/ --><a class=\"hupso_counters\" href=\"https:\/\/www.hupso.com\/share\/\"><img decoding=\"async\" src=\"https:\/\/static.hupso.com\/share\/buttons\/dot.png\" style=\"border:0px; padding-top:2px; float:left;\" alt=\"Share Button\"\/><\/a><script type=\"text\/javascript\">var hupso_services_c=new Array(\"twitter\",\"facebook_like\",\"pinterest\",\"email\",\"linkedin\");var hupso_counters_lang = \"en_US\";var hupso_image_folder_url = \"\";var hupso_url_c=\"\";var hupso_title_c=\"Wapiti%20%3A%20scan%20de%20vuln%C3%A9rabilit%C3%A9s\";<\/script><script type=\"text\/javascript\" src=\"https:\/\/static.hupso.com\/share\/js\/counters.js\"><\/script><!-- Hupso Share Buttons --><\/div>","protected":false},"excerpt":{"rendered":"<p>Wapiti est un outil de scan d&rsquo;application web en mode fuzzer afin de d\u00e9tecter d&rsquo;\u00e9ventuels vuln\u00e9rabilit\u00e9s. Il parse les pages web et renvoie un audit des diff\u00e9rentes failles pr\u00e9sentes : XSS, injection SQL, CRLF etc. Les instructions d&rsquo;installation sont d\u00e9taill\u00e9es sur le site officiel. &nbsp;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68,66],"tags":[70,63,69,73],"class_list":["post-656","post","type-post","status-publish","format-standard","hentry","category-ci-cd","category-python","tag-jenkins","tag-open-source","tag-security","tag-wapiti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre<\/title>\n<meta name=\"description\" content=\"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre\" \/>\n<meta property=\"og:description\" content=\"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s\" \/>\n<meta property=\"og:url\" content=\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\" \/>\n<meta property=\"og:site_name\" content=\"Melting Poutre\" \/>\n<meta property=\"article:published_time\" content=\"2018-08-18T14:21:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-08-31T11:36:14+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\" \/>\n<meta name=\"author\" content=\"Louis Hatier\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Louis Hatier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\"},\"author\":{\"name\":\"Louis Hatier\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11\"},\"headline\":\"Wapiti : scan de vuln\u00e9rabilit\u00e9s\",\"datePublished\":\"2018-08-18T14:21:14+00:00\",\"dateModified\":\"2018-08-31T11:36:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\"},\"wordCount\":184,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11\"},\"image\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\",\"keywords\":[\"Jenkins\",\"Open source\",\"Security\",\"Wapiti\"],\"articleSection\":[\"CI\/CD\",\"Python\"],\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\",\"url\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\",\"name\":\"Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre\",\"isPartOf\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\",\"datePublished\":\"2018-08-18T14:21:14+00:00\",\"dateModified\":\"2018-08-31T11:36:14+00:00\",\"description\":\"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s\",\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage\",\"url\":\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\",\"contentUrl\":\"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/#website\",\"url\":\"https:\/\/louis.hatier.me\/blog\/\",\"name\":\"Melting Poutre\",\"description\":\"Du web et d&#039;autres choses\",\"publisher\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/louis.hatier.me\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11\",\"name\":\"Louis Hatier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cd8d107ede5a4ec340326655e74a00ca62b02e41a02442f961c36f085aa89942?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cd8d107ede5a4ec340326655e74a00ca62b02e41a02442f961c36f085aa89942?s=96&d=mm&r=g\",\"caption\":\"Louis Hatier\"},\"logo\":{\"@id\":\"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/image\/\"},\"sameAs\":[\"https:\/\/louis.hatier.me\",\"https:\/\/www.linkedin.com\/in\/louishatier\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre","description":"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/","og_locale":"fr_FR","og_type":"article","og_title":"Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre","og_description":"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s","og_url":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/","og_site_name":"Melting Poutre","article_published_time":"2018-08-18T14:21:14+00:00","article_modified_time":"2018-08-31T11:36:14+00:00","og_image":[{"url":"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png","type":"","width":"","height":""}],"author":"Louis Hatier","twitter_misc":{"\u00c9crit par":"Louis Hatier","Dur\u00e9e de lecture estim\u00e9e":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#article","isPartOf":{"@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/"},"author":{"name":"Louis Hatier","@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11"},"headline":"Wapiti : scan de vuln\u00e9rabilit\u00e9s","datePublished":"2018-08-18T14:21:14+00:00","dateModified":"2018-08-31T11:36:14+00:00","mainEntityOfPage":{"@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/"},"wordCount":184,"commentCount":0,"publisher":{"@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11"},"image":{"@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage"},"thumbnailUrl":"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png","keywords":["Jenkins","Open source","Security","Wapiti"],"articleSection":["CI\/CD","Python"],"inLanguage":"fr-FR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/","url":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/","name":"Wapiti : scan de vuln\u00e9rabilit\u00e9s - Melting Poutre","isPartOf":{"@id":"https:\/\/louis.hatier.me\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage"},"image":{"@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage"},"thumbnailUrl":"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png","datePublished":"2018-08-18T14:21:14+00:00","dateModified":"2018-08-31T11:36:14+00:00","description":"Wapiti est un outil de scan de vuln\u00e9rabilit\u00e9s","inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/louis.hatier.me\/blog\/wapiti-scan-de-vulnerabilites\/#primaryimage","url":"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png","contentUrl":"http:\/\/louis.hatier.me\/blog\/wp-content\/uploads\/2018\/08\/logo-wapiti.png"},{"@type":"WebSite","@id":"https:\/\/louis.hatier.me\/blog\/#website","url":"https:\/\/louis.hatier.me\/blog\/","name":"Melting Poutre","description":"Du web et d&#039;autres choses","publisher":{"@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/louis.hatier.me\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":["Person","Organization"],"@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/2f200d0368def135b452e65491c4dd11","name":"Louis Hatier","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cd8d107ede5a4ec340326655e74a00ca62b02e41a02442f961c36f085aa89942?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cd8d107ede5a4ec340326655e74a00ca62b02e41a02442f961c36f085aa89942?s=96&d=mm&r=g","caption":"Louis Hatier"},"logo":{"@id":"https:\/\/louis.hatier.me\/blog\/#\/schema\/person\/image\/"},"sameAs":["https:\/\/louis.hatier.me","https:\/\/www.linkedin.com\/in\/louishatier\/"]}]}},"_links":{"self":[{"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/posts\/656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/comments?post=656"}],"version-history":[{"count":12,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/posts\/656\/revisions"}],"predecessor-version":[{"id":743,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/posts\/656\/revisions\/743"}],"wp:attachment":[{"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/media?parent=656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/categories?post=656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/louis.hatier.me\/blog\/wp-json\/wp\/v2\/tags?post=656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}