{"id":88992,"date":"2020-07-17T07:42:02","date_gmt":"2020-07-17T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami"},"modified":"2020-07-17T07:42:02","modified_gmt":"2020-07-17T05:42:02","slug":"wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","title":{"rendered":"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/c52b58a326ba424d73a93614818c82f5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u00cen trecut, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/news\/t\/507776\/\">pe care l-a\u021bi citit<\/a><\/noindex> am discutat despre <strong>Nemesida WAF Free<\/strong> \u2014 un instrument gratuit pentru protec\u021bia site-urilor \u0219i API-urilor \u00eempotriva atacurilor cibernetice, iar \u00een aceast\u0103 prezentare am decis s\u0103 facem o recenzie a unui scanner de vulnerabilit\u0103\u021bi popular <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">Wapiti<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Scanarea site-ului pentru vulnerabilit\u0103\u021bi este o m\u0103sur\u0103 necesar\u0103, care, \u00eempreun\u0103 cu analiza codului surs\u0103, permite evaluarea nivelului s\u0103u de securitate \u00eempotriva amenin\u021b\u0103rilor de compromitere. Scanarea resursei web poate fi realizat\u0103 cu ajutorul unor instrumente specializate.<\/p>\n<p><\/p>\n<p>Nikto, W3af (scris \u00een Python 2.7, al c\u0103rui suport s-a \u00eencheiat) sau Arachni (care nu mai este suportat din februarie) \u2014 cele mai populare solu\u021bii disponibile \u00een segmentul gratuit. Desigur, exist\u0103 \u0219i altele, de exemplu, Wapiti, pe care ne vom opri.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3 id=\"wapiti-rabotaet-so-sleduyuschimi-tipami-uyazvimostey\">Wapiti func\u021bioneaz\u0103 cu urm\u0103toarele tipuri de vulnerabilit\u0103\u021bi:<\/h3>\n<p><\/p>\n<ul>\n<li>divulgarea fi\u0219ierului (locale \u0219i externe, fopen, readfile);<\/li>\n<li>injec\u021bii (PHP \/ JSP \/ ASP \/ SQL-injec\u021bii \u0219i injec\u021bii XPath);<\/li>\n<li>XSS (cross-site scripting) (reflexiv \u0219i persistent);<\/li>\n<li>detectarea \u0219i executarea comenzilor (eval(), system(), passtru());<\/li>\n<li>injec\u021bii CRLF (separarea r\u0103spunsurilor HTTP, fixarea sesiunii);<\/li>\n<li>inser\u021bie XXE (XML external entity);<\/li>\n<li>SSRF (falsificarea cererii pe partea serverului);<\/li>\n<li>utilizarea fi\u0219ierelor poten\u021bial periculoase cunoscute (datorit\u0103 bazei de date Nikto);<\/li>\n<li>configura\u021bii slabe ale .htaccess, care pot fi ocolite;<\/li>\n<li>prezen\u021ba fi\u0219ierelor de rezerv\u0103 care dezv\u0103luie informa\u021bii confiden\u021biale (divulgarea codului surs\u0103);<\/li>\n<li>Shellshock;<\/li>\n<li>redirect\u0103ri deschise;<\/li>\n<li>metode HTTP neobi\u0219nuite care pot fi permise (PUT).<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"vozmozhnosti\">Func\u021bionalit\u0103\u021bi:<\/h4>\n<p><\/p>\n<ul>\n<li>suport pentru proxy HTTP, HTTPS \u0219i SOCKS5;<\/li>\n<li>autentificare prin mai multe metode: Basic, Digest, Kerberos sau NTLM;<\/li>\n<li>posibilitatea de a restric\u021biona domeniul de scanare (domeniu, folder, pagin\u0103, URL);<\/li>\n<li>\u0219tergerea automat\u0103 a unuia dintre parametrii din URL;<\/li>\n<li>m\u0103suri multiple de precau\u021bie \u00eempotriva loop-urilor infinite de scanare (de exemplu: ifor, restric\u021bionarea valorilor pentru parametru);<\/li>\n<li>posibilitatea de a stabili un priorit\u0103\u021bi pentru studierea URL-urilor (chiar dac\u0103 nu se afl\u0103 \u00een domeniul de scanare);<\/li>\n<li>posibilitatea de a exclude anumite URL-uri din scanare \u0219i atacuri (de exemplu: URL logout);<\/li>\n<li>importul fi\u0219ierelor cookie (ob\u021binerea acestora cu ajutorul instrumentului wapiti-getcookie);<\/li>\n<li>posibilitatea de a activa \/ dezactiva verificarea certificatelor SSL;<\/li>\n<li>posibilitatea de a extrage URL-uri din JavaScript (un interpret JS foarte simplu);<\/li>\n<li>interac\u021biune cu HTML5;<\/li>\n<li>mai multe op\u021biuni pentru gestionarea comportamentului \u0219i restric\u021biilor crawler-ului;<\/li>\n<li>\u00eent\u00e2rzirea maxim\u0103 pentru procesul de scanare;<\/li>\n<li>ad\u0103ugarea unor antete HTTP personalizabile sau configurarea unui User-Agent personalizat.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"dopolnitelnye-vozmozhnosti\">Func\u021bionalit\u0103\u021bi suplimentare:<\/h4>\n<p><\/p>\n<ul>\n<li>generarea de rapoarte de vulnerabilitate \u00een diverse formate (HTML, XML, JSON, TXT);<\/li>\n<li>suspendarea \u0219i reluarea scan\u0103rii sau atacului (mecanism de sesiune folosind baze de date SQLite3);<\/li>\n<li>eviden\u021biere \u00een terminal pentru a marca vulnerabilitatea;<\/li>\n<li>niveluri variate de logare;<\/li>\n<li>o modalitate rapid\u0103 \u0219i simpl\u0103 de activare \/ dezactivare a modulelor de atac.<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"ustanovka\">Instalare<\/h3>\n<p><\/p>\n<p>Versiunea actual\u0103 a Wapiti poate fi instalat\u0103 \u00een 2 moduri:<\/p>\n<p><\/p>\n<ul>\n<li>desc\u0103rc\u00e2nd sursa de pe oficialul <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">site-ul<\/a><\/noindex> \u0219i rul\u00e2nd scriptul de instalare, dup\u0103 ce a fost instalat Python3;<\/li>\n<li>prin comanda pip3 install wapiti3.<\/li>\n<\/ul>\n<p><\/p>\n<p>Dup\u0103 aceasta, Wapiti va fi gata de utilizare.<\/p>\n<p><\/p>\n<h3 id=\"rabota-s-instrumentom\">Lucrul cu instrumentul<\/h3>\n<p><\/p>\n<p>Pentru a demonstra func\u021bionarea Wapiti, vom folosi un stand special preg\u0103tit sites.vulns.pentestit.ru (resurs\u0103 intern\u0103), care con\u021bine diverse vulnerabilit\u0103\u021bi (Injection, XSS, LFI\/RFI) \u0219i alte deficien\u021be ale aplica\u021biilor web. <\/p>\n<p><\/p>\n<p><strong>Informa\u021biile sunt furnizate exclusiv \u00een scopuri informative. Nu \u00eenc\u0103lca\u021bi legisla\u021bia!<\/strong><\/p>\n<p><\/p>\n<p>Comanda de baz\u0103 pentru a rula scannerul:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u &lt;target&gt; &lt;options&gt;<\/code><\/pre>\n<p><\/p>\n<p>Exist\u0103 o documenta\u021bie destul de detaliat\u0103 cu o mul\u021bime de op\u021biuni de rulare, de exemplu:<\/p>\n<p><\/p>\n<p><strong>\u2014domeniu<\/strong> \u2014 domeniul de aplicare<br \/>\nDac\u0103, \u00eempreun\u0103 cu URL-ul pentru scanare, se specific\u0103 parametrul scope, se poate regla domeniul de scanare al site-ului, indic\u00e2nd fie o pagin\u0103 individual\u0103, fie toate paginile care pot fi g\u0103site pe site.<\/p>\n<p><\/p>\n<p><strong>-s<\/strong> \u0219i <strong>-x<\/strong> \u2014 parametrii pentru ad\u0103ugarea sau eliminarea unor URL-uri specifice. Ace\u0219ti parametri sunt utili atunci c\u00e2nd este necesar s\u0103 se adauge sau s\u0103 se elimine un URL specific \u00een timpul procesului de scanare.<\/p>\n<p><\/p>\n<p><strong>\u2014sari<\/strong> \u2014 parametrul specificat cu aceast\u0103 cheie va fi scanat, dar nu va fi atacat. Utile dac\u0103 exist\u0103 anumite parametrii periculo\u0219i care ar fi mai bine exclu\u0219i \u00een timpul scan\u0103rii.<\/p>\n<p><\/p>\n<p><strong>\u2014verific\u0103-ssl<\/strong> \u2014 activarea sau dezactivarea verific\u0103rii certificatului.<br \/>\nScannerul Wapiti este modular. Totu\u0219i, pentru a rula module specifice, din cele care sunt conectate automat \u00een timpul func\u021bion\u0103rii scannerului, trebuie utilizat parametrul -m \u0219i enumerate cele necesare prin virgul\u0103. Dac\u0103 parametrul nu este utilizat, vor func\u021biona \u00een mod implicit toate modulele. \u00cen cea mai simpl\u0103 variant\u0103, aceasta va ar\u0103ta astfel:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u http:\/\/sites.vulns.pentestit.ru\/ -m sql,xss,xxe<\/code><\/pre>\n<p><\/p>\n<p>Acest exemplu de utilizare \u00eenseamn\u0103 c\u0103 vom folosi doar modulele SQL, XSS \u0219i XXE atunci c\u00e2nd scan\u0103m \u021binta. \u00cen plus, putem filtra func\u021bionarea modulelor \u00een func\u021bie de metoda dorit\u0103. De exemplu <strong>-m \u201cxss: get, blindsql: post, xxe: post\u201d<\/strong>. \u00cen acest caz, modulul <strong>xss<\/strong> va fi aplicat cererilor trimise prin metoda GET, iar modulul <strong>blibdsql<\/strong> \u2014 la cererile POST etc. De altfel, dac\u0103 un anumit modul, care a fost inclus pe list\u0103, nu a fost necesar \u00een timpul scan\u0103rii sau func\u021bioneaz\u0103 foarte lent, ap\u0103s\u00e2nd combina\u021bia Ctrl+C putem s\u0103 s\u0103rim peste utilizarea modulului curent, aleg\u00e2nd op\u021biunea corespunz\u0103toare din meniul interactiv.<\/p>\n<p><\/p>\n<p>Wapiti suport\u0103 transmiterea cererilor prin intermediul unui server proxy folosind cheia <strong>-p<\/strong> \u0219i autentificarea pe site-ul \u021bint\u0103 prin parametru <strong>-a<\/strong>. De asemenea, se poate specifica tipul de autentificare: <strong>Basi\u0441<\/strong>, <strong>Digest<\/strong>, <strong>Kerberos<\/strong> \u0219i <strong>NTLM<\/strong>. Pentru ultimele dou\u0103 poate fi nevoie de instalarea unor module suplimentare. \u00cen plus, se pot insera \u00een cereri orice anteturi (inclusiv unul arbitrar <strong>User-Agent<\/strong>) \u0219i multe altele.<\/p>\n<p><\/p>\n<p>Pentru utilizarea autentific\u0103rii se poate folosi instrumentul <strong>wapiti-getcookie<\/strong>. Cu ajutorul acestuia form\u0103m <strong>cookie<\/strong>, pe care Wapiti \u00eel va folosi \u00een timpul scan\u0103rii. Formarea <strong>cookie<\/strong> se face cu comanda:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie -u http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json<\/code><\/pre>\n<p><\/p>\n<p>\u00cen timpul func\u021bion\u0103rii \u00een modul interactiv r\u0103spundem la \u00eentreb\u0103ri \u0219i indic\u0103m informa\u021biile necesare, cum ar fi: nume de utilizator, parol\u0103 \u0219i altele:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/1f858db74cd11b0837d0aeca890af816.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>La ie\u0219ire ob\u021binem un fi\u0219ier \u00een format JSON. O alt\u0103 variant\u0103 \u2014 ad\u0103ugarea tuturor informa\u021biilor necesare prin intermediul parametrului <strong>-d<\/strong>:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie - http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json -d &quot;username=admin&amp;password=admin&amp;enter=submit&quot;<\/code><\/pre>\n<p><\/p>\n<p>Rezultatul va fi similar:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/87e0923c3027bdda5f1ccf0d4e08a10f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>C\u00e2nd analiz\u0103m func\u021bionalitatea principal\u0103 a scanner-ului, cererea final\u0103 pentru testarea aplica\u021biei web \u00een cazul nostru a fost:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti --level 1 -u http:\/\/sites.vulns.pentestit.ru\/ -f html -o \/tmp\/vulns.html -m all --color -\u0441 cookie.json --scope folder --flush-session -A 'Pentestit Scans' -p http:\/\/proxy.office.pentestit.ru:3128<\/code><\/pre>\n<p><\/p>\n<p>unde, printre altele, parametrii:<\/p>\n<p><\/p>\n<p><strong>-f<\/strong> \u0219i <strong>-o<\/strong> \u2014 formatul \u0219i calea pentru salvarea raportului;<\/p>\n<p><\/p>\n<p><strong>-m<\/strong> \u2014 conectarea tuturor modulelor \u2014 nu este recomandat, deoarece va influen\u021ba timpul de testare \u0219i dimensiunea raportului;<\/p>\n<p><\/p>\n<p><strong>\u2014culoare<\/strong> \u2014 eviden\u021bierea vulnerabilit\u0103\u021bilor g\u0103site \u00een func\u021bie de severitatea acestora conform versiunii Wapiti;<\/p>\n<p><\/p>\n<p><strong>-c<\/strong> \u2014 utilizarea unui fi\u0219ier cu <strong>cookie<\/strong>, generat cu ajutorul <strong>wapiti-getcookie<\/strong>; <\/p>\n<p><\/p>\n<p><strong>\u2014domeniu<\/strong> \u2014 alegerea \u021bintei pentru atac. Aleg\u00e2nd op\u021biunea <strong>folder<\/strong> se va scana \u0219i ataca fiecare URL, \u00eencep\u00e2nd de la baza. URL-ul de baz\u0103 trebuie s\u0103 aib\u0103 o bar\u0103 oblic\u0103 (f\u0103r\u0103 numele fi\u0219ierului);<\/p>\n<p><\/p>\n<p><strong>\u2014golire-sesiune<\/strong> \u2014 permite efectuarea unei scan\u0103ri repetate, \u00een care rezultatele anterioare nu vor fi luate \u00een considerare;<\/p>\n<p><\/p>\n<p><strong>-A<\/strong> \u2014 propriu <strong>User-Agent<\/strong>;<\/p>\n<p><\/p>\n<p><strong>-p<\/strong> \u2014 adresa serverului proxy, dac\u0103 este necesar.<\/p>\n<p><\/p>\n<h3 id=\"nemnogo-ob-otchete\">C\u00e2teva informa\u021bii despre raport<\/h3>\n<p><\/p>\n<p>Rezultatul scan\u0103rii este prezentat sub form\u0103 de raport detaliat privind toate vulnerabilit\u0103\u021bile g\u0103site, \u00een format de pagin\u0103 HTML, \u00eentr-un mod clar \u0219i u\u0219or de \u00een\u021beles. \u00cen raport vor fi indicate categoriile \u0219i num\u0103rul de vulnerabilit\u0103\u021bi g\u0103site, descrierile acestora, solicit\u0103rile, comenzile pentru <strong>curl<\/strong> \u0219i sfaturi despre cum s\u0103 le remediezi. Pentru u\u0219urin\u021ba navig\u0103rii, \u00een titlurile categoriilor va fi ad\u0103ugat un link prin care se poate accesa:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/39d35304b6f2ea20fd9096e167daabd5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Un dezavantaj semnificativ al raportului este lipsa unei h\u0103r\u021bi a aplica\u021biei web, f\u0103r\u0103 de care nu va fi clar dac\u0103 toate adresele \u0219i parametrii au fost analiza\u021bi. De asemenea, exist\u0103 riscul de alarme false. \u00cen cazul nostru, \u00een raport sunt incluse \"fi\u0219iere de backup\" \u0219i \"fi\u0219iere poten\u021bial periculoase\". Num\u0103rul acestora nu corespunde realit\u0103\u021bii, deoarece nu existau astfel de fi\u0219iere pe server:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/09c6f8945e6fb6dc6de1388f71fc96bb.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Este posibil ca modulele care func\u021bioneaz\u0103 incorect s\u0103 fie corectate \u00een timp. De asemenea, un alt dezavantaj al raportului este lipsa color\u0103rii vulnerabilit\u0103\u021bilor g\u0103site (\u00een func\u021bie de criticialitate), sau m\u0103car clasificarea acestora pe categorii. Singurul mod prin care putem \u00een\u021belege indirect criticialitatea unei vulnerabilit\u0103\u021bi g\u0103site este aplicarea parametrului <strong>\u2014culoare<\/strong> \u00een timpul scan\u0103rii \u0219i atunci vulnerabilit\u0103\u021bile g\u0103site vor fi colorate \u00een diverse culori:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/46f4c34f9215117eeddd96db633e9e3e.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dar \u00een raportul propriu-zis, o astfel de colorare nu este prev\u0103zut\u0103.<\/p>\n<p><\/p>\n<h3 id=\"uyazvimosti\">Vulnerabilit\u0103\u021bi<\/h3>\n<p><\/p>\n<h4 id=\"sqli\">SQLi<\/h4>\n<p><\/p>\n<p>Scannerul a reu\u0219it par\u021bial s\u0103 identifice SQLi. Atunci c\u00e2nd caut\u0103 vulnerabilit\u0103\u021bi SQL pe paginile unde nu este necesar\u0103 autentificarea, nu apar probleme:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/f9ffef805a115c1a7d47c068a38794bf.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Nu a fost posibil s\u0103 se identifice vulnerabilit\u0103\u021bile pe paginile accesibile numai dup\u0103 autentificare, chiar \u0219i cu utilizarea unor date valide <strong>cookie<\/strong>, deoarece este foarte probabil ca dup\u0103 autentificarea reu\u0219it\u0103 s\u0103 aib\u0103 loc &quot;ie\u0219irea din sesiune&quot; \u0219i <strong>cookie<\/strong> vor deveni invalide. Dac\u0103 func\u021bia de deautentificare ar fi fost implementat\u0103 ca un script separat responsabil pentru gestionarea acestei proceduri, s-ar fi putut exclude complet prin parametrul -x, prevenind astfel activarea acesteia. \u00cen caz contrar, nu va fi posibil s\u0103 se exclud\u0103 procesarea sa. Aceasta nu este o problem\u0103 specific\u0103 unui anumit modul, ci a instrumentului \u00een ansamblu, dar din cauza acestui detaliu nu s-au putut descoperi mai multe injec\u021bii \u00een zona \u00eenchis\u0103 a resursei.<\/p>\n<p><\/p>\n<h4 id=\"xss\">XSS<\/h4>\n<p><\/p>\n<p>Scannerul a gestionat excelent sarcina dat\u0103 \u0219i a identificat toate vulnerabilit\u0103\u021bile preg\u0103tite:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/ae43bf1f7d78224a5df5f2ef733f8203.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"lfirfi\">LFI\/RFI<\/h4>\n<p><\/p>\n<p>Scannerul a g\u0103sit toate vulnerabilit\u0103\u021bile ascunse:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi cu propriile for\u021be.\" src=\"\/wp-content\/uploads\/2020\/07\/9056c7911237b607a6b12cc2e5a488d3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>\u00cen general, \u00een ciuda alarmelor false \u0219i a omisiunilor de vulnerabilit\u0103\u021bi, Wapiti, ca instrument gratuit, ofer\u0103 rezultate destul de bune. Oricum, este important de recunoscut c\u0103 scannerul este destul de puternic, flexibil \u0219i multifunc\u021bional, iar cel mai important \u2014 gratuit, a\u0219a c\u0103 merit\u0103 utilizat, ajut\u00e2nd administratorii \u0219i dezvoltatorii s\u0103 ob\u021bin\u0103 informa\u021bii de baz\u0103 despre starea de securitate a aplica\u021biilor web.<\/p>\n<p><\/p>\n<p>R\u0103m\u00e2ne\u021bi s\u0103n\u0103to\u0219i \u0219i \u00een siguran\u021b\u0103!<\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/510998\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":88993,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-88992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wapiti \u2014 verificarea site-ului pentru vulnerabilit\u0103\u021bi pe cont propriu | ProHoster","description":"\u00cen trecut,","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-17T05:42:02+00:00","article:modified_time":"2020-07-17T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"88992","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:45:41","updated":"2022-09-28 15:58:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/88992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=88992"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/88992\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/88993"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=88992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=88992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=88992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}