[Cheshire]

I just recently discovered w3af, which is an open source vulnerability scanner that is also cross-platform.
It seems like it has some nice features to it, but I was wondering if anyone had any experience with it, and also if there was a distinct advantage or disadvantage to using w3af over other network tools like ettercap or kismet.

Side question for bonus points: ettercap and kismet both seem so similar; in your experience, is there one that seems to work better for sniffing/spoofing and wireless password cracking?

Thanks!

[Ligeti]

Well...

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

source: http://w3af.org/

For me this sounds too good to be true! I mean "finding and exploiting" together in one solution... I won't go for it!

Now...

Side question for bonus points: ettercap and kismet both seem so similar; in your experience, is there one that seems to work better for sniffing/spoofing and wireless password cracking?

Ettercap is used mainly as a MiTM attack tool (and a sniffer), kismet is:

an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system

source: http://www.kismetwireless.net/

So they are totally different things! and they are not similar at all (IMO)

Random info: Ettercap doesn't crack Wireless, Kismet does (I usually use aircrack-ng suit thoguh), to spoof you need Ettercap, both can sniff...

I would recommend you learn, practice and use both, as they are different tools that are used for different scenarios!

Thanks

[Cheshire]

@Ligeti
Ah, ok, thank you for clearing that up for me. I was having some trouble with that.

Thank you so much for your help!

[Ligeti]

You're welcome

By the way, check this out: http://www.hackcommunity.com/Thread-Has-...-used-W3af