WebInspect在cmd下操作教程（带java调用例子）

wi.exe-u url [-s file] [-ws file] [-Framework name] [-CrawlCoverage name]
 [-ps policyID | -pc path][-ab|an|am|ad|aa|ak {creds}] [-o|c]
 [-n name] [-e[abcdefghijklmno] file][-x|xd|xa|xn] [-b filepath] [-v] [-?
]
 [-r report_name -y report_type -w report_favorite-f report_export_file -
g[phacxe]
 [-t compliance_template_file]] [-dfilepath -m filename]
 [-i scanid] [-ir scanid] [-db] [-?]

General---------------------------------------------------------

 -? show usage 命令帮助
 -u {url} url (orIP Address)  URL
 -s {settings file} settings file 设置文件
 -db use the database defined in thesettings file 使用设置中的定义配置数据库
 -ws {designfile} web service design file WEB服务器文件设置
 -o audit only(requires policy -p)
 -c crawl only
 -n {name} scan name (does not apply whenresuming a scan)
 -b {filepath} use given SecureBase file
 -d {filepath} move db to filepath (usedwith -m)
 -m {filename} move db to filename (usedwith -d)
 -i {scan id} scan id
 -ir {scan id} resume scan with thespecified id

Restrictto root folder -----------------------------------------

-xDirectory Only (self)
 -xd Directory and subdirectory(descendants)
 -xa Directory and parents (ancestors)
 -xn No Restrictions

Framework-------------------------------------------------------

-Framework{framework name} framework description
 Oracle optimal scanning of applicationbuilt with
 Oracle ADF Faces technology

CrawlCoverage --------------------------------------------------

-CrawlCoverage{coverage name} crawl coverage description
 Thorough perform an exhaustive crawl ofyour site
 Default focus more on coverage thenperformance
 Moderate an overall good balance ofcoverage and speed
 Quick focus on breadth and performance

AuditPolicy ----------------------------------------------------

-ps{policy ID} policy for audit
 1 Standard
 2 Assault
 3 SOAP
 4 Quick
 5 Safe
 6 Development
 7 Blank
 16 QA
 17 Application
 18 Platform
 1001 SQL Injection
 1002 Cross-Site Scripting
 1003 OWASP Top 10 Application SecurityRisks 2007
 1004 All Checks
 1005 Passive
 1007 SAP
 1008 Criticals and Highs
 1009 OWASP Top 10 Application SecurityRisks 2010

-pc{policy path} custom policy file path

Authentication--------------------------------------------------

-ab"userid:pwd" basic authentication mode 基本身份验证模式
 -an "userid:pwd" NTLMauthentication mode NTLM身份验证模式
 -ad "userid:pwd" digestauthentication mode 摘要式身份验证模式
 -ak "userid:pwd" kerberosauthentication mode Kerberos身份验证模式
 -aa "userid:pwd" automaticauthentication mode 自动身份验证模式
 -am {macro path} web macro authenticationmode 网页宏认证模式

Output----------------------------------------------------------

-ea{filepath} export scan in full XML format完整的XML格式的扫描
 -eb {filepath} export scan details(Full) in XML 在XML导出扫描的详细信息（全）
 -ec {filepath} export scan details(Comments) in XML （评论)
 -ed {filepath}export scan details (Hidden Fields) in XML （隐藏字段）
 -ee {filepath}export scan details (Script) in XML （脚本）
 -ef {filepath} export scan details (SetCookies) in XML (设置Cookies)
 -eg {filepath}export scan details (Web Forms) in XML  （Web窗体）
 -eh {filepath} export scan details(URLs) in XML （网址）
 -ei {filepath} export scan details(Requests) in XML (请求)
 -ej {filepath}export scan details (Sessions) in XML (Session)
 -ek {filepath} export scandetails (Emails) in XML  (电子邮箱)
 -el {filepath}export scan details (Parameters) in XML (参数)
 -em {folderpath} export scan details(Web Dump) in XML (网络转存)
 -en {filepath}export scan details (Offsite Links) in XML (异地链接)
 -eo {filepath}export scan details (Vulnerabilities) in XML (漏洞)

-vverbose output 详细输出

Reports---------------------------------------------------------

-r{report_name} name of the report to run 以该报告的名称来运行

以下为参数

Aggregate
 Alert View
 Attack Status
 Compliance
 Crawled URLS
 Developer Reference
 Duplicates
 Executive Summary
 False Positive
 QA Summary
 Scan Difference
 Scan Log
 Trend
 Vulnerability Summary
 Vulnerability (Classic)

-w{favorite_name} name of the report favorite to run

 -ag aggregate reports in report favorite

-y{report_type} the type of report, either 'Standard' or 'Custom'报告类型分为标准和自定义
 -f {export_file} where to export thereport file - file path and file 报告路径
name

-gpexport report as pdf
 -gh export report as zipped up html
 -ga export report as raw report file
 -gc export report as rich text file
 -gx export report as text
 -ge export report as excel file

-t{filepath} use given compliance template file

 

 

实际列子

 

F:\WebInspect>wi.exe -uhttp://127.1.1.0:8080/jfgl/logon.jsp -ab "SuperAdmin:1"

 -r"Vulnerability (Classic)" -y Standard -eb c:\Temp\Report.xml -fc:\Temp\Repo

rt.pdf –gp  -v

 

F:\WebInspect>wi.exe  启动WebInspect cmd扫描程序

 -uhttp://127.1.1.0:8080/jfgl/logon.jsp -ab url路径

-ab "SuperAdmin:1" 登陆页面用户名密码

-r "Vulnerability (Classic)" 报告运行名称

-y Standard 报告类型为标准

-eb c:\Temp\Report.xml 在XML导出扫描的详细信息（全）

-f c:\Temp\Report.pdf -gh 生成pdf文档

-v

 

 

 

Java调用

publicstaticvoid main(String[] args) {

       try {

 

           Runtime run = Runtime.getRuntime();

 

           String[] cmd = new String[3];

           cmd[0] = "cmd";

           cmd[1] = "/C";

           StringBuffer sb = new StringBuffer();

           sb.append("f:/WebInspect/wi.exe");

           sb.append("-u ");

           //url由用户传入

           sb.append("http://127.1.1.0:8080/jfgl/logon.jsp");

           sb.append("-ab ");

           //用户名密码由用户传入

           sb.append("'SuperAdmin:1'");

           sb.append(" -r'Vulnerability (Classic)' ");

           sb.append("-y Standard");

           sb.append("-ebc:/Temp/Report.xml ");

           sb.append("-f c:/Temp/Report.pdf-gp ");

           sb.append("-v");

           cmd[2] = sb.toString();

           System.out.println("开始扫描...");

           Process p = run.exec(cmd);

          

           InputStream in = p.getInputStream();

           while (in.read() != -1) {

              System.out.println("扫描中...");

           }

           in.close();

           p.destroy();

       } catch (IOException e) {

           System.out.println("扫描失败...");

           e.printStackTrace();

       }

       System.out.println("扫描成功...");

    }