This file contains explanations and tips on how to configure and use OWTF
OWTF's behaviour will depend on how it is called but also on how it was configured
Configuration is performed via files called "profiles"
The idea of the profiles is that the user should be able to define different profiles for different tests as they wish:
There is an experimental option in the command line to load a profile from a specific file location.
So, depending of the kind of tests you are doing you can define a different way to run tools, set defaults, etc
IMPORTANT: You should backup the file prior to modifying it + backup the profiles directory _always_, before upgrading OWTF.
NOTE: The configuration file defaults to Backtrack paths for the simple reason that most tools are already there (convenience)
Regarding the use of Backtrack over other Linux options, that is personal preference:
You will have a little bit less configuration changes to make on Backtrack (more convenience), that is all.
At the moment OWTF has the following configuration files:
General configuration: Tool locations, Icons for review, Default settings, etc
Defines how tools will be run + external links to useful resources and online tools
Defines the order in which web plugins will be run
Internal framework configuration (you can break a lot here, backup first!!)
The review can be stored in two ways: HTML5 localStorage (recommended and default) or window.name (for old browsers)
Why should you care? If you store screenshots in the review you probably want to increase the default HTML5 localStorage size in your browser!
OWTF config setting: JAVASCRIPT_STORAGE: owtf_localStorage.js
Features: Most browsers have a default 5MB limit, Data persistence: screen refresh + closing browser, From FF 8.0 using file:// (before FF 8.0: only worked on http://)
In Firefox localStorage is configurable
OWTF config setting: JAVASCRIPT_STORAGE: sessvars.js,owtf_sessvars.js
Features: Most browsers have a default 2MB limit, Data persistence: screen refresh only, cannot be configured (afaik) but works on old browsers