OWTF
Presentation Material
Abstract
AI Generated Summary
The presentation introduces the Offensive Web Testing Framework (OWTF), a comprehensive tool designed to integrate and streamline web application security testing. OWTF addresses common tester requirements by providing a unified browser-based interface that eliminates manual command-line interaction, centralizes storage of test data, and aggregates all HTTP transactions from various tools into a single, searchable log.
Key features include a plugin system that categorizes tests (passive, active, network) based on standards like OWASP Testing Guide, a robust transaction log with advanced search capabilities (by response code, headers, body content, or URL), and a checklist system to track coverage. A custom high-performance proxy records every request, and a worker management system allows pausing, resuming, or reordering running plugins—addressing issues like network interruptions. The framework also automates report generation and knowledge resource linking.
Two integrated tools are highlighted: Botnet Mode, which rotates user IPs via proxy lists or Tor to evade IP-based blocking during tests, and W Bypasser, which automates Web Application Firewall (WAF) bypass by detecting filtered characters and encoding payloads, including identification of WAF rule zero-days.
Finally, the talk details a significant codebase refactoring applying SOLID principles—specifically single responsibility, interface segregation, and dependency inversion—to reduce coupling and improve maintainability. This involved introducing a service locator pattern, abstract base classes to enforce component contracts, and automated dependency resolution, making the framework more extensible and sustainable for long-term development.
Practical implications include reduced manual overhead, comprehensive audit trails, resilience during long-running tests, and a foundation for adding new tools or checks without architectural overhaul. The project emphasizes usability for testers while maintaining engineering rigor for developers.