Re: no standards for webapp exploitation

The main benefit of VulnXML, imo, compared to a python-based engine is that you can distribute VulnXML from untrusted sources, and it won't execute on your machine. Another advantage is that it's self-describing, so you can do searches and stuff on a base of it. A major disadvantage is that it's not well suited for writing actual exploits - there's no good way to do something like urllib.quote_plus() or whatever external libraries you need to exploit something. My HTTP exploits for CANVAS tend to be multi-threaded, which VulnXML can't do...

For exploitation, Python is probably your language of choice. But that's not to say a Python class can't have VulnXML in it - SPIKE Proxy is pure Python....

-dave

> In-Reply-To: <Pine.LNX.4.44.0307020019361.2234-100000@felinemenace>
Received on Wed Jul 2 17:05:46 2003