OWTF is an offensive web testing framework developed in Python, featuring around 150 categorized plugins and a web-based UI. It supports various modes, such as botnet mode for using proxies and offers installation instructions via GitHub. The project is open for contributions, with ongoing Google Summer of Code projects and opportunities for students and non-students alike.

1. OWASP OWTF
Bharadwaj ‘tunnelshade’ Machiraju

2. #whoami
Student (B.Tech)
Core developer of OWTF
OWASP GSoC Mentor

3. OWASP OWTF
Offensive Web Testing Framework
Written in python by Abraham Aranguren (@7a_)
Runs a bunch of tools the way you want
Highly extensible, so easy to add own plugins
Web based UI
Currently under heavy development

4. Funded by
OWASP
Google
BruCon
ElearnSecurity

5. Present Features
Has approx 150 well categorised plugins
Botnet Mode - Allows usage of proxies and even tor network to avoid
detection.
Plug-n-hack Phase-I support
Inbound proxy
and much more…..

6. DEMO TIME

7. Requirements
A linux distribution (Kali is highly recommended)
Internet connection
git, python2 & wget installed
A bit of patience

8. Installation
!
Clone from our github repo (https://github.com/owtf)
Development branch(lions_2014)
Run the install script (install/install.py)
Ready!!

9. Usage
Fire up owtf with a target (./owtf.py demo.testfire.net)
Visit the web interface (default at http://127.0.0.1:8009/ui/)
Open targets and click on your target
Run some plugins/browse using plug-n-hack
Check the report and logs

10. Plugins?
Three main categories web, net & aux
Web
External - Help links to external resources
Passive - No traffic is sent to target
Semi passive - Non intrusive traffic is sent to target
grep - Passive analysis of transactions
active - Intrusive traffic is sent to target

11. Special Features (ongoing GSoC projects)
Plug-n-Hack Phase II - Cornel Punga
Sessions support - Viyat Bhalodia
Zest support - Deep Shah
Automated vulnerability rankings - Tao Sauvage
Online passive scanner (demo - lucif3rr.github.io) - Anirudh Anand
WAF Bypasser - Marios Kourtesis

12. How can you help?
Student? (GSoC, MWoS, Similar OWASP program)
Non-Student? You can get fame, goodies & chance to speak at
conferences ;)

13. Lots of links
OWTF Presentations - http://www.slideshare.net/abrahamaranguren
OWASP Page - http://owtf.org
Twitter - @owtfp
Github Org - https://github.com/owtf
Wiki - https://github.com/owtf/owtf/wiki
Freenode IRC Channel - #owtf
*I am providing a sneak peek into the future owtf release ;)

14. You can Contact Me!
bharadwaj.machiraju@gmail.com
aka tunnelshade
http://blog.tunnelshade.in
@tunnelshade_