{"id":4441,"date":"2010-07-23T21:59:12","date_gmt":"2010-07-23T19:59:12","guid":{"rendered":"http:\/\/www.corelan.be:8800\/?p=4441"},"modified":"2010-07-23T21:59:12","modified_gmt":"2010-07-23T19:59:12","slug":"watobo-the-unofficial-manual","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/","title":{"rendered":"WATOBO &ndash; the unofficial manual"},"content":{"rendered":"<p><a href=\"\/wp-content\/uploads\/2010\/08\/webhacked.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" style=\"border-right-width: 0px; margin: 0px 10px 0px 30px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px\" title=\"webhacked\" border=\"0\" alt=\"webhacked\" align=\"right\" src=\"\/wp-content\/uploads\/2010\/08\/webhacked_thumb.png\" width=\"147\" height=\"114\" \/><\/a> WATOBO is intended to enable security professionals to perform highly efficient (semi-automated) web application security audits. I am convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities.<\/p>\n<p lang=\"en-GB\">WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only. It works like a local proxy, similar to Webscarab, Paros or BurpSuite<\/p>\n<p lang=\"en-GB\">Additionally, WATOBO supports passive and active checks. Passive checks are more like filter functions. They are used to collect useful information, e.g. email or IP addresses. Passive checks will be performed during normal browsing activities. No additional requests are sent to the (web) application.<\/p>\n<p><!-- \t\t@page { margin: 2cm } \t\tP { margin-bottom: 0.21cm } --><\/p>\n<p lang=\"en-GB\">Active checks instead will produce a high number of requests (depending on the check module) because they do the automatic part of vulnerability identification, e.g. during a scan.<\/p>\n<p><!-- \t\t@page { margin: 2cm } \t\tP { margin-bottom: 0.21cm } --><\/p>\n<p><em><span style=\"text-decoration: underline\"><strong>The functions of WATOBO<\/strong><\/span><\/em><em><strong>:<\/strong><\/em><\/p>\n<p><!-- \t\t@page { margin: 2cm } \t\tP { margin-bottom: 0.21cm } --><\/p>\n<ul>\n<li>Supports session management. <\/li>\n<li>Detects logout and automatically takes a re-login. <\/li>\n<li>Supports filter functions <\/li>\n<li>Inline-Encoder\/Decoder <\/li>\n<li>Includes vulnerability scanner <\/li>\n<li>Quick-scan for targeted scanning a URL <\/li>\n<li>Full-scan to scan a whole session <\/li>\n<li>Manual request editor with special functions <\/li>\n<li>Session information is updated <\/li>\n<li>Login can be done automatically <\/li>\n<li>Transcoder <\/li>\n<li>URL, Base64, MD5, SHA-1 <\/li>\n<li>Interceptor <\/li>\n<li>Fuzzer <\/li>\n<li>Free, Stable and Open source! <\/li>\n<li>Script code easy to understand <\/li>\n<li>Easy to extend \/ adapt <\/li>\n<li>In real-world scenarios tested and developed <\/li>\n<li>Speed \/ usability <\/li>\n<li>Active and Passive checks <\/li>\n<li>Runs under Windows, Linux, BackTrack, MacOS <\/li>\n<\/ul>\n<p>All these great features and functions make WATOBO one of the top free web assessment tools.<\/p>\n<p>I wrote a tutorial about that awesome tool.&#160; Please read and enjoy.<\/p>\n<p>[download id=62]62[\/download]<\/p>\n<p>You can download WATOBO <a href=\"http:\/\/watobo.sourceforge.net\/\" target=\"_blank\" rel=\"noopener\">here<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WATOBO is intended to enable security professionals to perform highly efficient (semi-automated) web application security audits. I am convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities. WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only. It works &hellip; <a href=\"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> \"WATOBO &ndash; the unofficial manual\"<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[2382,127,2394],"tags":[1991,883],"class_list":["post-4441","post","type-post","status-publish","format-standard","hentry","category-security-papers","category-security","category-webapp-security","tag-fuzzing","tag-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"og:description\" content=\"WATOBO is intended to enable security professionals to perform highly efficient (semi-automated) web application security audits. I am convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities. WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only. It works &hellip; Continue reading &quot;WATOBO &ndash; the unofficial manual&quot;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/\" \/>\n<meta property=\"og:site_name\" content=\"Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/corelanconsulting\" \/>\n<meta property=\"article:published_time\" content=\"2010-07-23T19:59:12+00:00\" \/>\n<meta name=\"author\" content=\"Corelan Team (fancy)\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@corelanc0d3r\" \/>\n<meta name=\"twitter:site\" content=\"@corelanc0d3r\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/\"},\"author\":{\"name\":\"Corelan Team (fancy)\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/19ac49794ad03a4f053203b956e97513\"},\"headline\":\"WATOBO &ndash; the unofficial manual\",\"datePublished\":\"2010-07-23T19:59:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/\"},\"wordCount\":268,\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"keywords\":[\"fuzzing\",\"security\"],\"articleSection\":[\"Papers\",\"Security\",\"Web Application Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/\",\"name\":\"WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\"},\"datePublished\":\"2010-07-23T19:59:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/07\\\/23\\\/watobo-the-unofficial-manual\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.corelan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WATOBO &ndash; the unofficial manual\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"name\":\"Corelan CyberSecurity Research\",\"description\":\"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.corelan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\",\"name\":\"Corelan CyberSecurity Research\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"width\":200,\"height\":200,\"caption\":\"Corelan CyberSecurity Research\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/corelanconsulting\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\",\"https:\\\/\\\/x.com\\\/corelanconsulting\",\"https:\\\/\\\/instagram.com\\\/corelanconsult\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/19ac49794ad03a4f053203b956e97513\",\"name\":\"Corelan Team (fancy)\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x\",\"caption\":\"Corelan Team (fancy)\"},\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/author\\\/fancy\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/","og_locale":"en_US","og_type":"article","og_title":"WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research","og_description":"WATOBO is intended to enable security professionals to perform highly efficient (semi-automated) web application security audits. I am convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities. WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only. It works &hellip; Continue reading \"WATOBO &ndash; the unofficial manual\"","og_url":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/","og_site_name":"Corelan | Exploit Development &amp; Vulnerability Research","article_publisher":"https:\/\/www.facebook.com\/corelanconsulting","article_published_time":"2010-07-23T19:59:12+00:00","author":"Corelan Team (fancy)","twitter_card":"summary_large_image","twitter_creator":"@corelanc0d3r","twitter_site":"@corelanc0d3r","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/#article","isPartOf":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/"},"author":{"name":"Corelan Team (fancy)","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/19ac49794ad03a4f053203b956e97513"},"headline":"WATOBO &ndash; the unofficial manual","datePublished":"2010-07-23T19:59:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/"},"wordCount":268,"publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"keywords":["fuzzing","security"],"articleSection":["Papers","Security","Web Application Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/","url":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/","name":"WATOBO &ndash; the unofficial manual - Corelan | Exploit Development &amp; Vulnerability Research","isPartOf":{"@id":"https:\/\/www.corelan.be\/#website"},"datePublished":"2010-07-23T19:59:12+00:00","breadcrumb":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.corelan.be\/index.php\/2010\/07\/23\/watobo-the-unofficial-manual\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.corelan.be\/"},{"@type":"ListItem","position":2,"name":"WATOBO &ndash; the unofficial manual"}]},{"@type":"WebSite","@id":"https:\/\/www.corelan.be\/#website","url":"https:\/\/www.corelan.be\/","name":"Corelan CyberSecurity Research","description":"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.","publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.corelan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.corelan.be\/#organization","name":"Corelan CyberSecurity Research","url":"https:\/\/www.corelan.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","width":200,"height":200,"caption":"Corelan CyberSecurity Research"},"image":{"@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/corelanconsulting","https:\/\/x.com\/corelanc0d3r","https:\/\/x.com\/corelanconsulting","https:\/\/instagram.com\/corelanconsult"]},{"@type":"Person","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/19ac49794ad03a4f053203b956e97513","name":"Corelan Team (fancy)","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x","url":"https:\/\/secure.gravatar.com\/avatar\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e61c2a72c3ac875b017df8edf75c236f8c0147bee76db02a9b84f58d24283ed9?s=96&d=mm&r=x","caption":"Corelan Team (fancy)"},"url":"https:\/\/www.corelan.be\/index.php\/author\/fancy\/"}]}},"views":13863,"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/4441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/comments?post=4441"}],"version-history":[{"count":0,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/4441\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/media?parent=4441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/categories?post=4441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/tags?post=4441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}