wafw00f – WEB防火墙(WAF)探测工具

admin 2022年7月13日23:41:44评论651 views字数 3360阅读11分12秒阅读模式

####################
免责声明:工具本身并无好坏,希望大家以遵守《网络安全法》相关法律为前提来使用该工具,支持研究学习,切勿用于非法犯罪活动,对于恶意使用该工具造成的损失,和本人及开发者无关。
####################

WAFW00F是一个Web应用防火墙(WAF)指纹识别的工具。

wafw00f – WEB防火墙(WAF)探测工具

WAFW00F工作原理

  • 是首先通过发送一个正常http请求,然后观察其返回有没有一些特征字符

  • 如果不成功,它将发送大量(潜在的恶意) HTTP 请求,并使用简单的逻辑推断出它是哪个WAF

  • 如果这也不成功,它将分析以前返回的响应,并使用另一个简单的算法来猜测 WAF 或安全解决方案是否正在积极响应我们的攻击

WAFW00F使用

支持非常多的WAF。要查看它能够检测到哪些WAF,请使用-l 选项运行WAFW00F。输出如下:

$ wafw00f -l             ______            /                 (  Woof! )            ______/                      )            ,,                           ) (_       .-. -    _______                 ( |__|      ()``; |==|_______)                .)|__|      / ('        /|                  (  |__|  (  /  )        / |                   . |__|   (_)_))      /  |                     |__|     WAFW00F - Web Application Firewall Detection Tool Can test for these WAFs: BlockDoS (BlockDoS)Armor Defense (Armor)ACE XML Gateway (Cisco)Malcare (Inactiv)RSFirewall (RSJoomla!)PerimeterX (PerimeterX)Varnish (OWASP)Barracuda Application Firewall (Barracuda Networks)Anquanbao (Anquanbao)NetContinuum (Barracuda Networks)HyperGuard (Art of Defense)Incapsula (Imperva Inc.)Safedog (SafeDog)NevisProxy (AdNovum)SEnginx (Neusoft)BitNinja (BitNinja)Janusec Application Gateway (Janusec)NinjaFirewall (NinTechNet)Edgecast (Verizon Digital Media)Alert Logic (Alert Logic)Cloudflare (Cloudflare Inc.)SecureSphere (Imperva Inc.)Bekchy (Faydata Technologies Inc.)Kona Site Defender (Akamai)Wallarm (Wallarm Inc.)Cloudfront (Amazon)aeSecure (aeSecure)eEye SecureIIS (BeyondTrust)VirusDie (VirusDie LLC)DOSarrest (DOSarrest Internet Security)SiteGround (SiteGround)Chuang Yu Shield (Yunaq)Yunsuo (Yunsuo)NAXSI (NBS Systems)UTM Web Protection (Sophos)Approach (Approach)NetScaler AppFirewall (Citrix Systems)DynamicWeb Injection Check (DynamicWeb)XuanwudunWebTotem (WebTotem)Comodo (Comodo CyberSecurity Solutions)WTS-WAF (WTS)PowerCDN (PowerCDN)BIG-IP Access Policy Manager (F5 Networks)BinarySec (BinarySec)Greywizard (Grey Wizard)Shield Security (One Dollar Plugin)ASP.NET Generic Protection (Microsoft)CacheWall (Varnish)Expression Engine (EllisLab)Airlock (Phion/Ergon)WatchGuard (WatchGuard Technologies)WP Cerber Security (Cerber Tech)Yunjiasu (Baidu Cloud Computing)DenyALL (Rohde & Schwarz CyberSecurity)AnYu (AnYu Technologies)Secure Entry (United Security Providers)ISA Server (Microsoft)Yundun (Yundun)FirePass (F5 Networks)GoDaddy Website Protection (GoDaddy)Imunify360 (CloudLinux)Safe3 Web Firewall (Safe3)WebSEAL (IBM)NSFocus (NSFocus Global Inc.)360WangZhanBao (360 Technologies)Squarespace (Squarespace)Imperva SecureSphereBluedon (Bluedon IST)AliYunDun (Alibaba Cloud Computing)Wordfence (Feedjit)Palo Alto Next Gen Firewall (Palo Alto Networks)Tencent Cloud Firewall (Tencent Technologies)West263CDNWebARX (WebARX Security Solutions)Mission Control Application Shield (Mission Control)BIG-IP Local Traffic Manager (F5 Networks)Sitelock (TrueShield)ZScaler (Accenture)CrawlProtect (Jean-Denis Brun)Teros (Citrix Systems)AWS Elastic Load Balancer (Amazon)Cloudbric (Penta Security)StackPath (StackPath)URLScan (Microsoft)Sucuri (Sucuri Inc.)TransIP Web Firewall (TransIP)OnMessage Shield (BlackBaud)Distil (Distil Networks)Profense (ArmorLogic)ModSecurity (SpiderLabs)FortiWeb (Fortinet)XLabs Security WAF (XLabs)ASP.NET RequestValidationMode (Microsoft)Jiasule (Jiasule)ChinaCache CDN Load Balancer (ChinaCache)URLMaster SecurityCheck (iFinity/DotNetNuke)Reblaze (Reblaze)Newdefend (NewDefend)Trafficshield (F5 Networks)KS-WAF (KnownSec)SiteGuard (Sakura Inc.)CdnNS Application Gateway (CdnNs/WdidcNet)DataPower (IBM)WebKnight (AQTRONIX)BIG-IP Application Security Manager (F5 Networks)Barikode (Ethic Ninja)Zenedge (Zenedge)SonicWall (Dell)DotDefender (Applicure Technologies)USP Secure Entry ServerAppWall (Radware)

WAFW00F安装

python setup.py install

项目地址:https://github.com/EnableSecurity/wafw00f

原文始发于微信公众号(菜鸟小新):wafw00f – WEB防火墙(WAF)探测工具

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年7月13日23:41:44
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   wafw00f – WEB防火墙(WAF)探测工具http://cn-sec.com/archives/1176170.html

发表评论

匿名网友 填写信息