Unwaf

Unwaf is a Go tool designed to help identify WAF bypasses using passive techniques. It automates the process of discovering the real origin IP behind a WAF/CDN by combining multiple discovery methods and verifying candidates through HTML similarity comparison, SSL certificate fingerprinting, and HTTP header analysis.

Unwaf is automating the steps I explained on this LinkedIn Post: Passive WAF bypassing

Current version: 3.0.0 — See CHANGELOG.md for version history.

Table of Contents

• How It Works
• Discovery Methods
• Verification Methods
• Installation
• Usage
• Options
• Examples
• Configuration
• Author
• License

How It Works

1. Dynamic WAF CIDRs — Fetches live Cloudflare IP ranges and combines with hardcoded WAF/CDN ranges (including IPv6).
2. WAF Confirmation — Resolves the domain's current A records, checks if they fall in known WAF/CDN ranges, and fingerprints via HTTP headers.
3. Favicon Hashing — Fetches favicon.ico and generates MD5, SHA256, and MMH3 (Shodan) hashes.
4. IP Discovery — Runs all enabled methods (up to 15 sources) to collect candidate origin IPs.
5. Filtering — Discards IPs belonging to known WAF/CDN ranges and IPs that match the domain's current DNS resolution.
6. Port Scanning — Checks candidates on 8 common web ports concurrently with progress bar.
7. Origin Verification — For each web server:
   • Fetches HTML (direct IP + Host-header injection) and compares with reference
   • Compares SSL certificate fingerprints on TLS ports
   • Compares HTTP response headers
   • Calculates overall score (60% HTML + 25% cert + 15% headers ± status)
8. Neighbor Scanning (optional) — Expands confirmed bypass IPs to /24 subnets and scans neighbors.
9. ASN Lookup — Identifies ASN and organization for confirmed bypass IPs.
10. Results — Reports matches above the threshold with scores, ASN info, and curl verification commands.

Discovery Methods

Verification Methods

Installation

go install github.com/mmarting/unwaf@latest

Usage

unwaf -h

Options

Examples

Check a domain (free methods only, no API keys needed):

unwaf -d example.com

Both bare domains and full URLs work:

unwaf -d https://example.com/path

Check with a manually saved HTML file (useful when WAF blocks the tool):

unwaf -d example.com -s original.html

Lower the similarity threshold to catch partial matches:

unwaf -d example.com -t 40

Increase concurrency for faster scanning:

unwaf -d example.com -w 100

Verbose mode to see every resolved subdomain/IP:

unwaf -d example.com -v

Silent mode for automation — outputs only IPs, one per line:

unwaf -q -d example.com

JSON output for automation:

unwaf -d example.com --json

Batch mode with domain list:

unwaf -l domains.txt --json -o results.json

Use a proxy (Tor, Burp, etc.):

unwaf -d example.com --proxy socks5://127.0.0.1:9050

Scan /24 neighbors of bypass IPs:

unwaf -d example.com --scan-neighbors

Rate-limit requests to 2/sec with a 5s timeout:

unwaf -d example.com --rate-limit 2 --timeout 5

Piping into other tools

# Feed into nuclei
unwaf -q -d target.com | nuclei -l - -t waf-bypass.yaml

# Feed into httpx
unwaf -q -d target.com | httpx -silent

# Batch recon
cat domains.txt | while read d; do unwaf -q -d "$d" | sed "s/^/$d,/"; done > results.csv

# JSON + jq
unwaf -d target.com --json | jq '.bypasses[].ip'

Configuration

On first run, Unwaf creates $HOME/.unwaf.conf with this template:

# Unwaf config file — API keys for optional discovery methods
# Free methods (SPF, MX, crt.sh, subdomains, OTX, RapidDNS, HackerTarget, Wayback) work without any keys.

# ViewDNS.info — DNS history (250 free requests, no credit card required)
viewdns=""

# SecurityTrails — DNS history (https://securitytrails.com/corp/api)
securitytrails=""

# Censys — SSL certificate search (requires a PAID license)
censys_token=""
censys_org_id=""

# AlienVault OTX — passive DNS (optional, raises rate limits)
otx_api_key=""

# Shodan — host search by SSL cert, hostname, favicon hash
shodan_api_key=""

# DNSDB/Farsight — historical DNS records (Community Edition: 500 queries/month free)
dnsdb_api_key=""

Author

Martín Martín

• Website
• LinkedIn
• GitHub

License

Distributed under the GPL v3 License.