WATOBO - THE Web Application Toolbox
WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only.
„Ok, how does it work?“WATOBO works like a local proxy, similar to Webscarab, Paros or BurpSuite.
Additionally, WATOBO supports passive and active checks. Passive checks are more like filter functions. They are used to collect useful information, e.g. email or IP addresses. Passive checks will be performed during normal browsing activities. No additional requests are sent to the (web) application.
Active checks instead will produce a high number of requests (depending on the check module) because they do the automatic part of vulnerability identification, e.g. during a scan.
„So why should I use WATOBO instead of other web application auditing tools?“The most important advantages are:
- WATOBO has Session Management capabilities! You can define login scripts as well as logout signatures. So you don’t have to login manually each time you get logged out.
- WATOBO can perform vulnerability checks out of the box.
- WATOBO supports Inline De-/Encoding, so you don’t have to copy strings to a transcoder and back again. Just do it inside the request/response window with a simple mouse click.
- WATOBO has smart filter functions, so you can find and navigate to the most interesting parts of the application easily.
- WATOBO is written in (FX)Ruby and enables you to define your own checks
- WATOBO is free software ( licensed under the GNU General Public License Version 2)
- It’s by siberas ;)
Supported operating systems
WATOBO is written in (FX)Ruby which should run on many different operating systems.
WATOBO is developed primarily on Windows systems. Anyway, since version 0.9.2 WATOBO has also been tested successfully on:
- Windows (XP..Win7)
- Linux (Backtrack4, Ubuntu, openSUSE) - thanks to Dirk Wetter for Ubuntu and openSUSE notes
- Mac OS.
The README.txt file contains all the installation notes.
Licensing
WATOBO is licensed under the GNU General Public License Version 2.
Documentation
We made some videos about the installation and basic usage of WATOBO.
Installation
Since version 0.9.8 WATOBO can be installed as a gem.
Windows 7/Vista/XP
Please install Ruby (>= 1.9.2) first before you continue. You can get the installer here
After the installation open a command prompt. Then type the following command to install the watobo gem:
gem install watoboBackTrack 5
gem install --user-install selenium-webdriver
gem install --user-install watobo
Add the following line to your ~/.bashrc file:
export PATH=$PATH:/root/.gem/ruby/1.9.2/bin/You can download older versions of WATOBO at http://sourceforge.net/projects/watobo/ or by checking out the svn repo with the following command
svn co https://watobo.svn.sourceforge.net/svnroot/watobo watoboUsage
In your command prompt start WATOBO with the command:
watobo_gui.rbAfter starting WATOBO you create a new session. Afterwards the interception proxy is listening on localhost:8081.
Configure your browser to use WATOBO as its proxy and visit the site you want to audit.
Q&A
If you have any questions please read the FAQ first. In case that you didn't find an answer, write an email to (watobo #at siberas #dot de).
WATOBO in the wild
- Great write up at PenTestIT
- Very good manual at Corelan by Fancy
- Complete documentation of WATOBO with multiple lessons at aldeid by Sébastien Damaye
Author
WATOBO is developed by Andreas Schmidt, siberas (http://www.siberas.de).
With special thanks to:
- Sebastian Apelt
- Dominic Koeder aka Fancy
for alpha/beta-testing and new ideas.
Visit website -
for more information -
Screenshot
