RE: no standards for webapp exploitation

> I'm not sure how best to support something like this without introducing

Right. And this API would have to expand enough to accomodate every new exploit that comes out. AND there's a big difference between being "a way to do exploits" and being "the best way to do exploits"

> Of course, if there is some other reason why you think that VulnXML is not

Well, it's capable of threading different tests, but one test often needs to make and hold multiple connections, if you're talking about a full exploit engine.

Frankly, I think no "XML" description will ever be a very useful exploitation engine. This is why people write Python classes to do that. You give up the lightweight XML structure for actual execution of code. It's a lot easier to write too. Can you imagine writing a working exploit in XML?!

-dave Received on Thu Jul 3 11:39:44 2003