The OWASP WebSpa Project is a Java web knocking tool for sending a single HTTP/S request to your web server in order to authorize the execution of a premeditated Operating System (O/S) command. It provides a cryptographically protected “open sesame” mechanism on the web application layer, comparable to well-known port-knocking techniques. It is licensed under the Creative Commons Attribution-ShareAlike 3.0.
This project implements the concept of web knocking by offering a jar file that ‘tails’ the access log of an existing web server. A user submits a specially crafted URL, therefore executing a predefined O/S command. No new ports or services are created.
Similarly to traditional network port-knocking schemes, the OWASP WebSpa Project aims to create a covert channel of communication for O/S commands over the web application layer. This channel is by no means bi-directional: It is only the client that can issue commands to the server. The inverse, i.e. the server issuing commands to the client, is not an option within the current version.
Download location 1
Download location 2
More info: https://www.owasp.org/index.php/OWASP_WebSpa_Project
-
ADD CAPTION HERE
-
ADD CAPTION HERE
-
Helper Blogger
-
