enablesecurity/wafw00f정상 및 악성 요청에 대한 HTTP 응답을 분석하여 200개 이상의 WAF 제품을 식별 및 탐지하는 자동화된 웹 애플리케이션 방화벽 핑거프린팅 도구입니다.
웹 애플리케이션 방화벽 핑거프린팅 도구
— Enable Security 제공
-blue.svg){kind=icon}
WAFW00F는 다음과 같은 과정을 통해 작동합니다:
자세한 내용은 메인 저장소의 소스 코드를 확인하세요.
WAFW00F는 다양한 방화벽을 감지할 수 있습니다. 아래는 그 목록입니다:
$ wafw00f -l
? ,. ( . ) . "
__ ?? (" ) )' ,' ) . (` '`
(___()'`; ??? .; ) ' (( (" ) ;(, (( ( ;) " )")
/,___ /` _"., ,._'_.,)_(..,( . )_ _' )_') (. _..( ' )
\\ \\ |____|____|____|____|____|____|____|____|____|
~ WAFW00F : v2.4.2 ~
~ Sniffing Web Application Firewalls since 2009 ~
[+] 다음 WAF를 테스트할 수 있습니다:
WAF 이름 제조사
-------- ------------
360PanYun 360 Technologies
360WangZhanBao 360 Technologies
ACE XML Gateway Cisco
ASP.NET Generic Microsoft
ASPA Firewall ASPA Engineering Co.
AWS Elastic Load Balancer Amazon
AireeCDN Airee
Airlock Phion/Ergon
Alert Logic Alert Logic
AliYunDun Alibaba Cloud Computing
AnYu AnYu Technologies
Anquanbao Anquanbao
Anubis Techaro
AppWall Radware
Approach Approach
Armor Defense Armor
ArvanCloud ArvanCloud
Astra Czar Securities
Azion Edge Firewall Azion
Azure Application Gateway Microsoft
Azure Front Door Microsoft
BIG-IP AP Manager F5 Networks
BIG-IP AppSec Manager F5 Networks
BIG-IP Local Traffic Manager F5 Networks
Barikode Ethic Ninja
Barracuda Barracuda Networks
Baffin Bay Mastercard
Bekchy Faydata Technologies Inc.
Beluga CDN Beluga
BinarySec BinarySec
BitNinja BitNinja
BlockDoS BlockDoS
Bluedon Bluedon IST
BulletProof Security Pro AITpro Security
CacheFly CDN CacheFly
CacheWall Varnish
CdnNS Application Gateway CdnNs/WdidcNet
ChinaCache Load Balancer ChinaCache
Chuang Yu Shield Yunaq
Cloud Protector Rohde & Schwarz CyberSecurity
Cloudbric Penta Security
Cloudflare Cloudflare Inc.
Cloudfloor Cloudfloor DNS
Cloudfront Amazon
Comodo cWatch Comodo CyberSecurity
CrawlProtect Jean-Denis Brun
DDoS-GUARD DDOS-GUARD CORP.
DOSarrest DOSarrest Internet Security
DataPower IBM
DenyALL Rohde & Schwarz CyberSecurity
Distil Distil Networks
DotDefender Applicure Technologies
DynamicWeb Injection Check DynamicWeb
Edgecast Verizon Digital Media
Eisoo Cloud Firewall Eisoo
Envoy EnvoyProxy
Expression Engine EllisLab
Fastly Fastly CDN
FirePass F5 Networks
FortiGate Fortinet
FortiGuard Fortinet
FortiWeb Fortinet
GoDaddy Website Protection GoDaddy
Google Cloud App Armor Google Cloud
Greywizard Grey Wizard
Huawei Cloud Firewall Huawei
HyperGuard Art of Defense
ISA Server Microsoft
Imunify360 CloudLinux
Incapsula Imperva Inc.
IndusGuard Indusface
Instart DX Instart Logic
Janusec Application Gateway Janusec
Jiasule Jiasule
KS-WAF KnownSec
Kemp LoadMaster Progress Software
KeyCDN KeyCDN
Kona SiteDefender Akamai
LimeLight CDN LimeLight
Link11 WAAP Link11
LiteSpeed LiteSpeed Technologies
Malcare Inactiv
MaxCDN MaxCDN
Mission Control Shield Mission Control
ModSecurity SpiderLabs
NAXSI NBS Systems
NSFocus NSFocus Global Inc.
Nemesida PentestIt
NetContinuum Barracuda Networks
NetScaler AppFirewall Citrix Systems
NevisProxy AdNovum
Newdefend NewDefend
NexusGuard Firewall NexusGuard
NinjaFirewall NinTechNet
NullDDoS Protection NullDDoS
OnMessage Shield BlackBaud
Open-Resty Lua Nginx FLOSS
Oracle Cloud Oracle
PT Application Firewall Positive Technologies
Palo Alto Next Gen Firewall Palo Alto Networks
PentaWAF Global Network Services
PerimeterX PerimeterX
PowerCDN PowerCDN
Profense ArmorLogic
Puhui Puhui
Qcloud Tencent Cloud
Qiniu Qiniu CDN
Qrator Qrator
RSFirewall RSJoomla!
RayWAF WebRay Solutions
Reblaze Reblaze
Reflected Networks Reflected Networks
RequestValidationMode Microsoft
SEnginx Neusoft
Sabre Firewall Sabre
Safe3 Web Firewall Safe3
Safedog SafeDog
Safeline Chaitin Tech.
Scutum Secure Sky Technology Inc.
SecKing SecKing
SecuPress WP Security SecuPress
Secure Entry United Security Providers
SecureSphere Imperva Inc.
ServerDefender VP Port80 Software
Shadow Daemon Zecure
Shield Security One Dollar Plugin
SiteGround SiteGround
SiteGuard EG Secure Solutions Inc.
Sitelock TrueShield
SonicWall Dell
Squarespace Squarespace
SquidProxy IDS SquidProxy
StackPath StackPath
Sucuri CloudProxy Sucuri Inc.
Tencent Cloud Firewall Tencent Technologies
Teros Citrix Systems
ThreatX A10 Networks
Trafficshield F5 Networks
TransIP Web Firewall TransIP
UEWaf UCloud
URLMaster SecurityCheck iFinity/DotNetNuke
URLScan Microsoft
UTM Web Protection Sophos
Variti Variti
Varnish OWASP
Vercel WAF Vercel
Viettel Cloudrity
VirusDie VirusDie LLC
WP Cerber Security Cerber Tech
WTS-WAF WTS
Wallarm Wallarm Inc.
WatchGuard WatchGuard Technologies
WebARX WebARX Security Solutions
WebKnight AQTRONIX
WebLand WebLand
WebSEAL IBM
WebTotem WebTotem
West263 CDN West263CDN
Wordfence Defiant
XLabs Security WAF XLabs
Xuanwudun Xuanwudun
YXLink YxLink Technologies
Yundun Yundun
Yunjiasu Baidu Cloud Computing
Yunsuo Yunsuo
ZScaler Accenture
Zenedge Zenedge
aeSecure aeSecure
eEye SecureIIS BeyondTrust
pkSecurity IDS pkSec
wpmudev WAF Incsub
Shieldon Firewall Shieldon.io
먼저, 여기에 설명된 대로 도구를 설치합니다.
도움말을 보려면 --help 옵션을 사용할 수 있습니다. 기본 사용법은 인수로 URL을 전달하는 것입니다. 예:
$ wafw00f https://example.org
______
/ \
( Woof! )
\ ____/ )
,, ) (_
.-. - _______ ( |__|
()``; |==|_______) .)|__|
/ (' /|\ ( |__|
( / ) / | \ . |__|
\(_)_)) / | \ |__|
~ WAFW00F : v2.4.2 ~
The Web Application Firewall Fingerprinting Toolkit
[*] Checking https://example.org
[+] The site https://example.org is behind Edgecast (Verizon Digital Media) WAF.
[~] Number of requests: 2
다음 명령어를 실행하세요:
python3 -m pip install wafw00f
또는
pip3 install wafw00f
Docker 컨테이너 내에서 실행하는 것도 가능합니다. 먼저 이 저장소를 클론하고 다음을 사용하여 Docker 이미지를 빌드하세요:
docker build . -t wafw00f
이제 다음을 실행할 수 있습니다:
docker run --rm -it wafw00f https://example.com
참고: wafw00f를 설치하는 동안 시스템 패키지를 손상시키지 않도록 주의하세요. 필요에 따라 venv를 사용하세요.
저장소를 클론합니다:
git clone https://github.com/enablesecurity/wafw00f.git
그런 다음:
cd wafw00f/
python3 -m pip install .
또는 pipx를 직접 사용하여:
pipx install git+https://github.com/EnableSecurity/wafw00f.git
질문이 있으신가요? GitHub Issue Tracker에 이슈를 올리거나 저에게 연락해 주세요. 풀 리퀘스트, 아이디어 및 이슈는 언제나 환영합니다.
유용한 링크:
현재 개발 및 유지 관리자: