Issue with max-attack-time: Attack Doesn't Stop After Specified Time

[Kundan8000]

I'm running the following command, but it isn't stopping the attack after 1 minute. Instead, it gets stuck, and I think I have to manually move to the next attack by pressing CTRL + C and selecting the next attack from the menu.

wapiti \
  --level 1 \
  -u http://testasp.vulnweb.com \
  -f json \
  -o report.json \
  -m all \
  --scope folder \
  --flush-session \
  -v2 \
  --no-bugreport \
  --max-attack-time 60

[Kundan8000]

@devl00p, please check. It gets stuck after a certain amount of time and either completes after 24 hours or sometimes takes up to 3 days to finish.

[devl00p]

Hello,

Which version are you using ? Which module was running ?

[Kundan8000]

Hello,

Which version are you using ? Which module was running ?

I'm running all modules you can check in command I've mentioned it & I've Wapiti 3.2.0 installed on my server Ubuntu 22.04.4 LTS

[Kundan8000]

Hi @devl00p, Have you found anything why it's getting stuck?
++ @thomasjbradley, @ramiror, @LocutusOfBorg

[LocutusOfBorg]

sorry no idea...

[devl00p]

The --max-attack-time is used to specify a max duration of processing for EACH attach module.

So if you specify 60 seconds with (for example) all 33 attack modules it will take approximately 30 minutes to execute. This is the expected behavior.

The CTRL+C behavior is not perfect though as the stop signal is checked after each crawled URL, not its mutations. Depending on the module it can takes quite some time but I'm looking to improve it thanks to asyncio cancellation features

[Kundan8000]

Hi @devl00p, Thank you for responding. I’ve found another issue: the brute_login_form should automatically detect the login form and attempt brute-force login or SQL injection. Currently, this site is vulnerable to SQL injection through the login form, which appears as a modal but wapiti fails to detect that.

[Kundan8000]

The --max-attack-time is used to specify a max duration of processing for EACH attach module.

So if you specify 60 seconds with (for example) all 33 attack modules it will take approximately 30 minutes to execute. This is the expected behavior.

The CTRL+C behavior is not perfect though as the stop signal is checked after each crawled URL, not its mutations. Depending on the module it can takes quite some time but I'm looking to improve it thanks to asyncio cancellation features

But when I start the scan, all the modules take the specified time except for the buster module, which takes too long and gets stuck.