{"id":88992,"date":"2020-07-17T07:42:02","date_gmt":"2020-07-17T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami"},"modified":"2020-07-17T07:42:02","modified_gmt":"2020-07-17T05:42:02","slug":"wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","title":{"rendered":"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/c52b58a326ba424d73a93614818c82f5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nEelmises osas <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/news\/t\/507776\/\">artiklis<\/a><\/noindex> oleme r\u00e4\u00e4kinud <strong>Nemesida WAF Free<\/strong> \u2014 tasuta t\u00f6\u00f6riist, mis kaitseb veebisaite ja API-sid h\u00e4kkerite r\u00fcnnakute eest, ning seekord teeme \u00fclevaate populaarsest haavatavuste skannerist <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">Wapiti<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Veebisaidi haavatavuste skaneerimine on h\u00e4davajalik tegevus, mis koos l\u00e4htekoodi anal\u00fc\u00fcsiga v\u00f5imaldab hinnata selle kaitset ohte eest. Veebiresurssi saab skaneerida spetsialiseeritud t\u00f6\u00f6riistade abil.<\/p>\n<p><\/p>\n<p>Nikto, W3af (kirjutatud Python 2.7-s, mille toetamine on l\u00f5ppenud) v\u00f5i Arachni (pole enam toetatud alates veebruarist) \u2014 need on k\u00f5ige populaarsemad lahendused tasuta segmentis. Loomulikult on ka teisi, n\u00e4iteks Wapiti, millele me keskendume.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3 id=\"wapiti-rabotaet-so-sleduyuschimi-tipami-uyazvimostey\">Wapiti t\u00f6\u00f6tab j\u00e4rgmiste haavatavus liikidega:<\/h3>\n<p><\/p>\n<ul>\n<li>failide avamine (kohalikud ja eemalolevad, fopen, readfile);<\/li>\n<li>sisestused (PHP \/ JSP \/ ASP \/ SQL-sisestused ja XPath-sisestused);<\/li>\n<li>XSS (rist-saitide skripteerimine) (peegeldunud ja p\u00fcsiv);<\/li>\n<li>k\u00e4skude avastamine ja t\u00e4itmine (eval(), system(), passtru());<\/li>\n<li>CRLF-sisestused (HTTP vastuste eraldamine, sessiooni fikseerimine);<\/li>\n<li>XXE (XML v\u00e4line entiteet) sisestamine;<\/li>\n<li>SSRF (serveri poolel p\u00e4ringu vale esitamine);<\/li>\n<li>kuulsate potentsiaalselt ohtlike failide kasutamine (t\u00e4nu Nikto andmebaasile);<\/li>\n<li>.htaccess n\u00f5rkade konfiguratsioonide v\u00f5imalus, mida saab \u00fcletada;<\/li>\n<li>tagatseid faile, mis paljastavad konfidentsiaalset teavet (allika kood);<\/li>\n<li>Shellshock;<\/li>\n<li>avatud suunamised;<\/li>\n<li>ebastandardsete HTTP meetodite lubamine (PUT).<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"vozmozhnosti\">V\u00f5imalused:<\/h4>\n<p><\/p>\n<ul>\n<li>HTTP, HTTPS ja SOCKS5 proxy tugi;<\/li>\n<li>mitme autentimismeetodi tugi: Basic, Digest, Kerberos v\u00f5i NTLM;<\/li>\n<li>v\u00f5ime piirata skaneerimisala (domeen, kaust, leht, URL);<\/li>\n<li>\u00fche URL parameetri automaatne eemaldamine;<\/li>\n<li>mitmed ettevaatusabin\u00f5ud l\u00f5pmatute skaneerimise ts\u00fcklite vastu (n\u00e4ide: ifor, parameetri v\u00e4\u00e4rtuste piiramise abil);<\/li>\n<li>v\u00f5ime seada prioriteedi URL-ide uurimiseks (isegi kui need ei ole skaneerimisalas);<\/li>\n<li>v\u00f5ime teatud URL-e skaneerimisest ja r\u00fcnnakutest v\u00e4lja j\u00e4tta (nt: URL logout);<\/li>\n<li>k\u00fcpsiste importimine (neid saamine t\u00f6\u00f6riista wapiti-getcookie abil);<\/li>\n<li>v\u00f5ime aktiveerida \/ deaktiveerida SSL-sertifikaatide kontrolli;<\/li>\n<li>v\u00f5ime JavaScriptist URL-e v\u00e4ljav\u00f5tta (v\u00e4ga lihtne JS t\u00f5lgendan);<\/li>\n<li>interaktsioon HTML5-ga;<\/li>\n<li>mitmesuguseid crawler'i k\u00e4itumise ja piirangute juhtimise v\u00f5imalusi;<\/li>\n<li>skaneerimisprotsessi maksimaalse aja seadmine;<\/li>\n<li>m\u00f5nede kohandatavate HTTP-pealkirjade lisamine v\u00f5i kasutajakonto User-Agent seadistamine.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"dopolnitelnye-vozmozhnosti\">Lisafunktsioonid:<\/h4>\n<p><\/p>\n<ul>\n<li>haavatavuste aruannete genereerimine erinevates formaatides (HTML, XML, JSON, TXT);<\/li>\n<li>skaneerimise v\u00f5i r\u00fcnnakute peatamine ja taastamine (seansimehhanism SQLite3 andmebaasiga);<\/li>\n<li>terminali silendamine haavatavuse esitlemiseks;<\/li>\n<li>erinevad logimise tasemed;<\/li>\n<li>kiire ja lihtne viis r\u00fcnnakumoodulite aktiveerimiseks \/ deaktiveerimiseks.<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"ustanovka\">Installeerimine<\/h3>\n<p><\/p>\n<p>Wapiti uusimat versiooni saab installida 2 viisil:<\/p>\n<p><\/p>\n<ul>\n<li>laadige alla allikas ametlikult <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">lehelt<\/a><\/noindex> ja k\u00e4ivitage installiskript, eelnevalt installides Python3;<\/li>\n<li>kasutades k\u00e4sku pip3 install wapiti3.<\/li>\n<\/ul>\n<p><\/p>\n<p>P\u00e4rast seda on Wapiti kasutamiseks valmis.<\/p>\n<p><\/p>\n<h3 id=\"rabota-s-instrumentom\">T\u00f6\u00f6riista kasutamine<\/h3>\n<p><\/p>\n<p>Wapiti t\u00f6\u00f6 demonstreerimiseks kasutame spetsiaalselt ette valmistatud seisu sites.vulns.pentestit.ru (siseressurss), mis sisaldab erinevaid haavatavusi (Injection, XSS, LFI\/RFI) ja muid veebirakenduste puudusi. <\/p>\n<p><\/p>\n<p><strong>Teave antakse ainult tutvumiseks. \u00c4ra riku seadusandlust!<\/strong><\/p>\n<p><\/p>\n<p>P\u00f5hik\u00e4sk skanneri k\u00e4ivitamiseks:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u &lt;target&gt; &lt;options&gt;<\/code><\/pre>\n<p><\/p>\n<p>Sellel on \u00fcsna p\u00f5hjalik juhend, kus on suur hulk k\u00e4ivitamisv\u00f5imalusi, n\u00e4iteks:<\/p>\n<p><\/p>\n<p><strong>\u2014ulatus<\/strong> \u2014 rakendusalad<br \/>\nKui koos URL-iga skaneerimiseks m\u00e4\u00e4rata parameter scope, saab reguleerida saidi skaneerimist, m\u00e4\u00e4rates nii eraldi lehek\u00fclge kui ka k\u00f5ik lehed, mida on v\u00f5imalik saidilt leida.<\/p>\n<p><\/p>\n<p><strong>-s<\/strong> ja <strong>-x<\/strong> \u2014 spetsiifiliste URL-ide lisamise v\u00f5i eemaldamise parameetrid. Need parameetrid on kasulikud, kui on vaja lisada v\u00f5i eemaldada konkreetne URL skaneerimise protsessis.<\/p>\n<p><\/p>\n<p><strong>\u2014vahelej\u00e4tmine<\/strong> \u2014 m\u00e4rgitud parameeter koos selle v\u00f5tmega skaneeritakse, kuid r\u00fcnnatakse mitte. Kasulik, kui on mingeid ohtlikke parameetreid, mida on parem skaneerimise ajal v\u00e4ltida.<\/p>\n<p><\/p>\n<p><strong>\u2014SSL-i kontrollimine<\/strong> \u2014 sertifikaadi kontrollimise sissel\u00fclitamine v\u00f5i v\u00e4ljal\u00fclitamine.<br \/>\nWapiti skanner on modulaarselt seadistatud. Siiski, et k\u00e4ivitada konkreetseid mooduleid, mis automaatselt \u00fchendatakse skanneri t\u00f6\u00f6 ajal, tuleb kasutada v\u00f5tmeid -m ja loetleda vajalikud komadega. Kui v\u00f5tme kasutamist ei toimu, siis t\u00f6\u00f6tavad vaikimisi k\u00f5ik moodulid. K\u00f5ige lihtsam variant n\u00e4eb v\u00e4lja j\u00e4rgmiselt:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u http:\/\/sites.vulns.pentestit.ru\/ -m sql,xss,xxe<\/code><\/pre>\n<p><\/p>\n<p>See n\u00e4ide t\u00e4hendab, et kasutame skaneerimisel ainult SQL, XSS ja XXE mooduleid. Lisaks saab moodulite t\u00f6\u00f6d filtreerida vastavalt soovitud meetodile. N\u00e4iteks <strong>-m \u201cxss: get, blindsql: post, xxe: post\u201d<\/strong>. Sellisel juhul moodul <strong>xss<\/strong> rakendatakse GET meetodiga edastatavatele p\u00e4ringutele, samas kui moodul <strong>blibdsql<\/strong> rakendatakse POST-p\u00e4ringutele jne. Muide, kui m\u00f5ni loetellu kuuluv moodul ei osutunud skaneerimise ajal vajalikuks v\u00f5i t\u00f6\u00f6tab liiga kaua, siis kombinatsiooni Ctrl+C vajutamine v\u00f5imaldab m\u00f6\u00f6da p\u00e4\u00e4seda praegusest moodulist, valides vastava punkti interaktiivses men\u00fc\u00fcs.<\/p>\n<p><\/p>\n<p>Wapiti toetab p\u00e4ringute edastamist l\u00e4bi proksi-serveri, kasutades v\u00f5tit <strong>-p<\/strong> ja autentimist sihtveebisaidil l\u00e4bi parameetri <strong>-a<\/strong>. Samuti on v\u00f5imalik m\u00e4\u00e4rata autentimise t\u00fc\u00fcp: <strong>Basi\u0441<\/strong>, <strong>Digest<\/strong>, <strong>Kerberos<\/strong> ja <strong>NTLM<\/strong>. Viimaste kahe jaoks v\u00f5ib osutuda vajalikuks t\u00e4iendavate moodulite installimine. Samuti on v\u00f5imalik p\u00e4ringutesse lisada igasuguseid p\u00e4iseid (sh vabalt valitud <strong>User-Agent<\/strong>) ja palju muud.<\/p>\n<p><\/p>\n<p>Autentimise kasutamiseks saab kasutada t\u00f6\u00f6riista <strong>wapiti-getcookie<\/strong>. Selle abiga vormindame <strong>k\u00fcpsiseid<\/strong>, mida Wapiti skaneerimisel kasutab. Formeerimine <strong>k\u00fcpsiseid<\/strong> toimub k\u00e4su abil:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie -u http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json<\/code><\/pre>\n<p><\/p>\n<p>T\u00f6\u00f6tamise k\u00e4igus interaktiivses re\u017eiimis vastame k\u00fcsimustele ja anname vajalikku teavet, nagu: kasutajanimi, parool ja muud:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/1f858db74cd11b0837d0aeca890af816.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Saame v\u00e4lja faili JSON-formaadis. Teine variant on kogu vajalik teave lisada parameetri kaudu <strong>-d<\/strong>:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie - http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json -d &quot;username=admin&amp;password=admin&amp;enter=submit&quot;<\/code><\/pre>\n<p><\/p>\n<p>Tulemus on analoogne:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/87e0923c3027bdda5f1ccf0d4e08a10f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Skanneri p\u00f5hifunktsiooni arvesse v\u00f5ttes oli meie juhtumi l\u00f5pp-p\u00e4ring veebirakenduse testimiseks j\u00e4rgmine:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti --level 1 -u http:\/\/sites.vulns.pentestit.ru\/ -f html -o \/tmp\/vulns.html -m all --color -\u0441 cookie.json --scope folder --flush-session -A 'Pentestit Scans' -p http:\/\/proxy.office.pentestit.ru:3128<\/code><\/pre>\n<p><\/p>\n<p>kus teiste parameetrite seas:<\/p>\n<p><\/p>\n<p><strong>-f<\/strong> ja <strong>-o<\/strong> \u2014 aruande salvestamise formaat ja tee;<\/p>\n<p><\/p>\n<p><strong>-m<\/strong> \u2014 k\u00f5igi moodulite \u00fchendamine \u2014 ei soovitata, kuna see m\u00f5jutab testimise aega ja aruande suurust;<\/p>\n<p><\/p>\n<p><strong>\u2014v\u00e4rv<\/strong> \u2014 r\u00f5hutada leitud haavatavusi vastavalt nende kriitilisusele Wapiti enda versiooni j\u00e4rgi;<\/p>\n<p><\/p>\n<p><strong>-c<\/strong> \u2014 kasutada faili <strong>k\u00fcpsiseid<\/strong>, genereeritud kasutades <strong>wapiti-getcookie<\/strong>; <\/p>\n<p><\/p>\n<p><strong>\u2014ulatus<\/strong> \u2014 r\u00fcndeesm\u00e4rgi valik. Valides variandi <strong>kaust<\/strong> skaneeritakse ja r\u00fcnnatakse iga URL-i alates baasist. Baas-URL peab l\u00f5ppema kaldkriipsuga (ilma failinime);<\/p>\n<p><\/p>\n<p><strong>\u2014seansi eemaldamine<\/strong> \u2014 v\u00f5imaldab uuesti skaneerida, arvestamata varasemaid tulemusi;<\/p>\n<p><\/p>\n<p><strong>-A<\/strong> \u2014 kohandatud <strong>User-Agent<\/strong>;<\/p>\n<p><\/p>\n<p><strong>-p<\/strong> \u2014 vahepealse serveri aadress, kui see on vajalik.<\/p>\n<p><\/p>\n<h3 id=\"nemnogo-ob-otchete\">Veidi aruandest<\/h3>\n<p><\/p>\n<p>Skaneerimistulemus esitatakse detailse aruandena k\u00f5igi leitud haavatavuste kohta HTML-lehe vormingus, selge ja arusaadava esitusega. Aruandes on m\u00e4rgitud kategooriad ja leitud haavatavuste arv, nende kirjeldus, p\u00e4ringud, k\u00e4sud <strong>curl<\/strong> ja soovitused nende sulgemiseks. Lihtsustatud navigeerimise huvides lisatakse kategooriate pealkirjadele link, millele klikkides saab neid vaadata:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/39d35304b6f2ea20fd9096e167daabd5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Oluline puudus raportis on, et seal puudub veebirakenduse kaart, mille abil ei ole selge, kas k\u00f5ik aadressid ja parameetrid on anal\u00fc\u00fcsitud. Samuti on valeh\u00e4irete t\u00f5en\u00e4osus. Meie puhul on raportis mainitud 'varukoopia faile' ja 'potentsiaalselt ohtlikke faile'. Nende arv ei vasta t\u00f5ele, kuna selliseid faile serveris ei olnud:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/09c6f8945e6fb6dc6de1388f71fc96bb.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>V\u00f5imalik, et vale t\u00f6\u00f6ga moodulid parandatakse aja jooksul. Samuti v\u00f5ib raporti puuduseks pidada leitud haavatavuste v\u00e4rvilise tuvastamise puudumist (vastavalt nende kriitilisusele) v\u00f5i v\u00e4hemalt nende jagamist kategooriatesse. Ainsana saame me kaudselt m\u00f5ista leitud haavatavuse kriitilisust, kui rakendada parameetrit <strong>\u2014v\u00e4rv<\/strong> skaneerimise ajal ja siis v\u00e4rvilise kodeerimisega tuvastatud haavatavused:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/46f4c34f9215117eeddd96db633e9e3e.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kuid raportis sarnast v\u00e4rvikoodimist ei ole ette n\u00e4htud.<\/p>\n<p><\/p>\n<h3 id=\"uyazvimosti\">Haavatavused<\/h3>\n<p><\/p>\n<h4 id=\"sqli\">SQLi<\/h4>\n<p><\/p>\n<p>Skanner suutis osaliselt leida SQL-i haavatavusi. Halduse n\u00f5udmist mitte vajavatel lehtedel SQL haavatavuste otsimisel ei esine mingeid probleeme:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/f9ffef805a115c1a7d47c068a38794bf.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Viga leidmine lehtedel, mis on saadaval ainult autentimise j\u00e4rel, ei \u00f5nnestunud isegi valideeritud andmeid kasutades, <strong>k\u00fcpsiseid<\/strong>, kuna t\u00f5en\u00e4oliselt toimub p\u00e4rast edukat autentimist &quot;v\u00e4ljumine sessioonist&quot; ja <strong>k\u00fcpsiseid<\/strong> need muutuvad kehtetuks. Kui deautoriseerimise funktsioon oleks teostatud eraldi skriptina, mis vastutab selle protseduuri t\u00f6\u00f6tlemise eest, oleks seda v\u00f5imalik t\u00e4ielikult v\u00e4listada -x parameetri abil, v\u00e4ltides sellega selle aktiveerimist. Vastasel juhul ei saa seda t\u00f6\u00f6tlemist v\u00e4ltida. See ei ole konkreetse mooduli probleem, vaid t\u00f6\u00f6riista \u00fcldine k\u00fcsimus, kuid selle n\u00fcansi t\u00f5ttu ei \u00f5nnestunud leida mitmeid s\u00fcstimise katseid ressurssi suletud alal.<\/p>\n<p><\/p>\n<h4 id=\"xss\">XSS<\/h4>\n<p><\/p>\n<p>Antud \u00fclesandega skaneerija tegeles suurep\u00e4raselt ja leidis k\u00f5ik ettevalmistatud haavatavused:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/ae43bf1f7d78224a5df5f2ef733f8203.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"lfirfi\">LFI\/RFI<\/h4>\n<p><\/p>\n<p>Skaneerija leidis k\u00f5ik peidetud haavatavused:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 kontrollige oma veebisaidi haavatavuste olemasolu ise\" src=\"\/wp-content\/uploads\/2020\/07\/9056c7911237b607a6b12cc2e5a488d3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kokkuv\u00f5ttes n\u00e4itab Wapiti, tasuta t\u00f6\u00f6riist, vaatamata valeh\u00e4iretele ja haavatavuste vahelej\u00e4tmistele, \u00fcsna h\u00e4id tulemusi. Igal juhul tuleb tunnistada, et skanner on tundlik, paindlik ja mitmekesine ning mis k\u00f5ige t\u00e4htsam \u2014 tasuta, seega on seda \u00f5igust kasutada, aidates administraatoreil ja arendajatel saada p\u00f5hiteavet veebirakenduse turvalisuse seisukorrast.<\/p>\n<p><\/p>\n<p>P\u00fcsige terved ja kaitstud!<\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/510998\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":88993,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-88992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wapiti \u2014 veebisaidi haavatavuste kontrollimine oma j\u00f5ududega | ProHoster","description":"Eelmises artiklis r\u00e4\u00e4kisime Nemesida WAF Free'st \u2014 tasuta t\u00f6\u00f6riistast, mis kaitseb veebisaite ja API-sid h\u00e4kkerir\u00fcnnakute eest, ning selles artiklis anname \u00fclevaate populaarsest haavatavuste skannerist Wapiti. Veebisaidi haavatavuste skaneerimine on vajalik meede, mis koos l\u00e4htekoodi anal\u00fc\u00fcsiga aitab hinnata selle turvalisuse taset kompromissi ohtude suhtes. Veebiresursi skaneerimist saab teostada","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-17T05:42:02+00:00","article:modified_time":"2020-07-17T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"88992","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:45:41","updated":"2022-09-28 15:58:49"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/88992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=88992"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/88992\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/88993"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=88992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=88992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=88992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}