{"action":"created","issue":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/9626","labels_url":"https://api.github.com/repos/andresriancho/w3af/issues/9626/labels{/name}","comments_url":"https://api.github.com/repos/andresriancho/w3af/issues/9626/comments","events_url":"https://api.github.com/repos/andresriancho/w3af/issues/9626/events","html_url":"https://github.com/andresriancho/w3af/issues/9626","id":70926269,"number":9626,"title":"High memory usage","user":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars.githubusercontent.com/u/865200?v=3","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/andresriancho/w3af/labels/bug","name":"bug","color":"e10c02"},{"url":"https://api.github.com/repos/andresriancho/w3af/labels/core","name":"core","color":"0b02e1"},{"url":"https://api.github.com/repos/andresriancho/w3af/labels/priority:high","name":"priority:high","color":"e10c02"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/andresriancho/w3af/milestones/10","html_url":"https://github.com/andresriancho/w3af/milestones/1.6.50%20-%20Bug%20fixing%20after%201.6.0","labels_url":"https://api.github.com/repos/andresriancho/w3af/milestones/10/labels","id":614510,"number":10,"title":"1.6.50 - Bug fixing after 1.6.0","description":"Bug fixes after 1.6 release, this is a MUST-HAVE since people will start using 1.6 and report severity 1 bugs which need to be fixed and pushed to all users.","creator":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars.githubusercontent.com/u/865200?v=3","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"open_issues":22,"closed_issues":322,"state":"open","created_at":"2014-03-30T17:44:39Z","updated_at":"2015-04-25T15:37:56Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-04-25T15:28:17Z","updated_at":"2015-04-25T19:27:37Z","closed_at":null,"body":"## User story\r\nAs a user I'm scanning a site and after some time w3af uses so much memory that the whole system becomes unusable\r\n\r\n## Affected version\r\nMaster @ 1.6.51\r\nde5613586be9d33dad4a0c4bde2dc2bd20865292\r\nhttps://github.com/andresriancho/w3af/releases/tag/1.6.51\r\n\r\n## How to reproduce\r\n * Site to scan: ecommerce.shopify.com\r\n * Running w3af with: `/opt/w3af/w3af_console  -s /tmp/script.w3af`\r\n * Amazon Small EC2 (2GB 1CPU) with Ubuntu\r\n * w3af script\r\n\r\n```text\r\nhttp-settings\r\nset timeout 30\r\nback\r\n\r\n#Configure scanner global behaviors\r\nmisc-settings\r\nset max_discovery_time 5\r\nset fuzz_cookies True\r\nset fuzz_form_files True\r\nback\r\n\r\nplugins\r\n#Configure entry point (CRAWLING) scanner\r\ncrawl robots_txt\r\ncrawl web_spider\r\ncrawl config web_spider\r\nset only_forward True\r\nset ignore_regex (?i)(logout|disconnect|signout|exit)+\r\nback\r\n\r\n#Configure vulnerability scanners\r\n##Specify list of AUDIT plugins type to use\r\naudit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload, ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli, xpath, xss, xst\r\n##Customize behavior of each audit plugin when needed\r\naudit config file_upload\r\nset extensions jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe\r\nback\r\n\r\n##Specify list of GREP plugins type to use (grep plugin is a type of plugin that can find also vulnerabilities or informations\r\ngrep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages,html_comments, objects, path_disclosure, private_ip, strange_headers, strange_http_codes, strange_parameters, strange_reason, url_session, xss_protection_header\r\n\r\n##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin is a type of plugin that can find informations disclosure)\r\ninfrastructure server_header, server_status, domain_dot, dot_net_errors\r\n\r\n#Configure target authentication\r\n#back\r\n#Configure reporting in order to generate an HTML report\r\noutput console, html_file, csv_file\r\noutput config html_file\r\nset output_file /output/W3afReport.html\r\nset verbose False\r\nback\r\noutput config csv_file\r\nset output_file /output/W3afReport.csv\r\nback\r\noutput config console\r\nset verbose False\r\nback\r\nback\r\n#Set target informations, do a cleanup and run the scan\r\n\r\ntarget\r\nset target ecommerce.shopify.com\r\n#set target_os windows\r\n#set target_framework php\r\nback\r\n\r\ncleanup\r\nstart\r\nexit\r\n```\r\n\r\n## Docker container to reproduce the issue\r\nDocker container at https://registry.hub.docker.com/u/89berner/w3af/ , reproduce the issue using:\r\n\r\n```bash\r\ndocker pull 89berner/w3af:v1\r\nsudo docker run -t -i 89berner/w3af:v1 /bin/bash\r\n/opt/start.sh ecommerce.shopify.com\r\n```\r\n\r\n## Dockerfile used to create `89berner/w3af:v1`\r\n\r\n```dockerfile\r\nFROM ubuntu:12.04\r\nMAINTAINER Juan Berner <89berner@gmail.com>\r\n\r\n# Initial setup\r\n# Squash errors about \"Falling back to ...\" during package installation\r\n\r\nENV TERM linux\r\nRUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections\r\n\r\n# Update before installing any package\r\nRUN apt-get update -y\r\nRUN apt-get upgrade -y\r\nRUN apt-get dist-upgrade -y\r\n\r\n# Install basic and GUI requirements, python-lxml because it doesn't compile correctly from pip\r\nRUN apt-get install -y python-pip build-essential libxslt1-dev libxml2-dev libsqlite3-dev libyaml-dev openssh-server python-dev git python-lxml wget libssl-dev xdot ubuntu-artwork dmz-cursor-theme ca-certificates\r\nRUN pip install --upgrade pip\r\nRUN apt-get install -y libffi-dev curl\r\n\r\nRUN pip install clamd==1.0.1 PyGithub==1.21.0 GitPython==0.3.2.RC1 pybloomfiltermmap==0.3.11 \\\r\n        esmre==0.3.1 phply==0.9.1 stopit==1.1.0 nltk==2.0.5 chardet==2.1.1 pdfminer==20140328 \\\r\n        futures==2.1.5 pyOpenSSL==0.13.1 scapy-real==2.2.0-dev guess-language==0.2 cluster==1.1.1b3 \\\r\n        msgpack-python==0.4.4 python-ntlm==1.0.1 halberd==0.2.4 darts.util.lru==0.5 \\\r\n        tblib==0.2.0 ndg-httpsclient==0.3.3 pyasn1==0.1.7\r\n\r\nRUN pip install nltk==3.0.1 pyasn1==0.1.3 Jinja2==2.7.3 vulndb==0.0.17 markdown==2.6.1\r\n\r\nEXPOSE 22\r\n\r\nRUN cd /opt/ && git clone https://github.com/andresriancho/w3af.git && cd /opt/w3af/\r\n#RUN echo \"Y\" | /opt/w3af/w3af_console\r\n\r\nADD ./start.sh /opt/start.sh \r\nRUN chmod 777 /opt/start.sh && mkdir -p /var/run/sshd && chmod 0755 /var/run/sshd\r\nCMD [\"/usr/sbin/sshd\", \"-D\"]\r\n```\r\n\r\n## Reporter\r\n@89berner reported this issue via email\r\n\r\n## Related issues\r\n * https://github.com/andresriancho/w3af/issues/8502\r\n * https://github.com/andresriancho/w3af/issues/7503\r\n * https://github.com/andresriancho/w3af/issues/8614"},"comment":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/comments/96267168","html_url":"https://github.com/andresriancho/w3af/issues/9626#issuecomment-96267168","issue_url":"https://api.github.com/repos/andresriancho/w3af/issues/9626","id":96267168,"user":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars.githubusercontent.com/u/865200?v=3","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"created_at":"2015-04-25T19:27:37Z","updated_at":"2015-04-25T19:27:37Z","body":"Thanks for your comments, it's aligned with what I'm seeing."}}