https://github.com/stamparm/identYwaf
Blind WAF identification tool
https://github.com/stamparm/identYwaf
blind inference infosec network security waf
Last synced: about 2 months ago
JSON representation
Blind WAF identification tool
- Host: GitHub
- URL: https://github.com/stamparm/identYwaf
- Owner: stamparm
- License: mit
- Created: 2019-01-10T11:27:58.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2024-06-25T08:15:40.000Z (10 months ago)
- Last Synced: 2025-03-11T12:08:29.551Z (about 2 months ago)
- Topics: blind, inference, infosec, network, security, waf
- Language: Python
- Homepage:
- Size: 2.95 MB
- Stars: 654
- Watchers: 13
- Forks: 124
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - stamparm/identYwaf - Blind WAF identification tool (Python)
README
[](https://travis-ci.org/stamparm/identYwaf) [](https://www.python.org/) [](https://github.com/stamparm/identYwaf/blob/master/LICENSE) [](https://github.com/stamparm/identYwaf/blob/master/data.json)
**identYwaf** is an identification tool that can recognize web protection type (i.e. WAF) based on blind inference. Blind inference is being done by inspecting responses provoked by a set of predefined offensive (non-destructive) payloads, where those are used only to trigger the web protection system in between (e.g. `http://?aeD0oowi=1 AND 2>1`). Currently it supports more than 80 different protection products (e.g. `aeSecure`, `Airlock`, `CleanTalk`, `CrawlProtect`, `Imunify360`, `MalCare`, `ModSecurity`, `Palo Alto`, `SiteGuard`, `UrlScan`, `Wallarm`, `WatchGuard`, `Wordfence`, etc.), while the knowledge-base is constantly growing.
For more information you can check [slides](https://www.slideshare.net/stamparm/blind-waf-identification) for a talk "**Blind WAF identification**" held at *Sh3llCON 2019* (Santander / Spain).
Note: as part of this project, [screenshots](https://github.com/stamparm/identYwaf/tree/master/screenshots) of characteristic responses for different web protection systems are being gathered (manually) for the future reference.
## Screenshots
## Installation
You can download the latest zipball by clicking [here](https://github.com/stamparm/identYwaf/archive/master.zip).
Preferably, you can download identYwaf by cloning the Git repository:
`git clone --depth 1 https://github.com/stamparm/identYwaf.git`
**identYwaf** works out of the box with any Python version from **2.6.x** to **3.x** on any platform.
## Usage
```
$ python identYwaf.py
__ __
____ ___ ___ ____ ______ | T T __ __ ____ _____
l j| \ / _]| \ | T| | || T__T T / T| __|
| T | \ / [_ | _ Yl_j l_j| ~ || | | |Y o || l_
| | | D YY _]| | | | | |___ || | | || || _|
j l | || [_ | | | | | | ! \ / | | || ]
|____jl_____jl_____jl__j__j l__j l____/ \_/\_/ l__j__jl__j (1.0.XX)
Usage: python identYwaf.py [options]
Options:
--version Show program's version number and exit
-h, --help Show this help message and exit
--delay=DELAY Delay (sec) between tests (default: 0)
--timeout=TIMEOUT Response timeout (sec) (default: 10)
--proxy=PROXY HTTP proxy address (e.g. "http://127.0.0.1:8080")
--proxy-file=PRO.. Load (rotating) HTTP(s) proxy list from a file
--random-agent Use random HTTP User-Agent header value
--code=CODE Expected HTTP code in rejected responses
--string=STRING Expected string in rejected responses
--post Use POST body for sending payloads
```