WATOBO
WATOBO is intended to enable security professionals to perform highly efficient (semi-automated ) web application security audits. We (watobo team) are convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities.
WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only.
„Ok, how does it work?“
WATOBO works like a local proxy, similar to Webscarab, Paros or BurpSuite.
Additionally, WATOBO supports passive and active checks. Passive checks are more like filter functions. They are used to collect useful information, e.g. email or IP addresses. Passive checks will be performed during normal browsing activities. No additional requests are sent to the (web) application.
Active checks instead will produce a high number of requests (depending on the check module) because they do the automatic part of vulnerability identification, e.g. during a scan.
„So why should I use WATOBO instead of other web application auditing tools?“
The most important advantages are:
WATOBO has Session Management capabilities! You can define login scripts as well as logout signatures. So you don’t have to login manually each time you get logged out.
WATOB can act as an transparent proxy
WATOBO has anti-CSRF features
WATOBO can perform vulnerability checks out of the box.
WATOBO supports Inline De-/Encoding, so you don’t have to copy strings to a transcoder and back again. Just do it inside the request/response window with a simple mouse click.
WATOBO has smart filter functions, so you can find and navigate to the most interesting parts of the application easily.
WATOBO is written in (FX)Ruby and enables you to define your own checks
WATOBO is free software ( licensed under the GNU General Public License Version 2)
It’s by siberas 
Supported operating systems
WATOBO is written in (FX)Ruby which should run on many different operating systems.
WATOBO is developed primarily on Windows systems. Anyway, since version 0.9.2 WATOBO has also been tested successfully on:
Windows (XP..Win7)
Linux (Backtrack4, Ubuntu, openSUSE) - thanks to Dirk Wetter for Ubuntu and openSUSE notes
Mac OS.
The README.txt file contains all the installation notes.
Licensing
WATOBO is licensed under the GNU General Public License Version 2.
Author
WATOBO is developed by Andreas Schmidt, siberas (http://www.siberas.de).
With special thanks to:
Sebastian Apelt
Dominic Koeder aka Fancy
for alpha/beta-testing and new ideas.
Installation
Before you continue you should have a running Ruby environment >= 1.9.2 < 2.0(not tested yet). I prefer 1.9.3
Note: Do not use Ruby 1.9.3p0
Windows 7/Vista/XP
gem install watobo
Linux
The easiest way on to install WATOBO a Linux box is to use the installer script. Tested on
BackTrack
5Samurai WTF
wget http://watobo.sourceforge.net/extras/watobo-installer.sh
chmod 755 watobo-installer.sh
./watobo-installer.sh
If the installer doesn't work try the generic installation steps below.
Generic Linux (with APT)
Install Ruby via RVM
Setting up a build environment for linux
Based on Lyle Johnsons tutorial https://github.com/lylejohnson/fxruby/wiki/Setting-Up-a-Linux-Build-Envi...
apt-get -y install ruby-full
apt-get -y install install zlib1g-dev libbz2-dev libpng12-dev libjpeg62-dev libtiff4-dev
apt-get -y install zlib1g-dev libbz2-dev libpng12-dev libjpeg62-dev libtiff4-dev
apt-get -y install libx11-dev libglu1-xorg-dev libxcursor-dev libxext-dev libxrandr-dev libxft2-dev
apt-get -y install g++
Install the Fox-Toolkit libs
Use version 1.6.44 only. The 1.7 branch is incompatible with fxruby! You can download it from the fox-tookit homepage http://www.fox-toolkit.org/
wget http://ftp.fox-toolkit.org/pub/fox-1.6.44.tar.gz
tar xzvf fox-1.6.44.tar.gz
cd fox-1.6.44
./configure
make
make install
cd ..
Install WATOBO
See Linux installation notes
Basic Usage
In your command prompt start WATOBO with the command:
watobo_gui.rb
A few more steps have to be done before you can use WATOBO
create a new project - this makes the interception proxy listening on localhost:8081
now configure your browser to use WATOBO as its proxy
use your browser and visit the site you want to audit
Import WATOBO CA
You find the CA file in your HOMEPATH or HOME directory:
$HOME/.watobo/CA/cacert.pem