WhatWaf?

WhatWaf 是一个高级防火墙检测工具，其目标是让你了解“有 WAF 吗？”的概念。WhatWaf 通过检测 Web 应用程序上的防火墙，并尝试针对该防火墙检测一个（或两个）绕过方法，在指定的目标上工作。

附注：任何不是 WhatWaf 最新版本的问题将会被关闭，恕不讨论

另一附注：我没有太多时间来更新这个项目了，更新将会很慢

有用的链接

• 通过 XMR 挖矿支持 whatwaf
• 创建一个 issue
• 阅读 手册
• WhatWaf 的 特性
• 安装 WhatWaf
• 概念验证
  • 演示视频
  • 概念验证图片
• 参与进来
• 在 上关注我
• 在 上关注我

---

可检测的防火墙

whatwaf --wafs

                             ,------.
                            '  .--.  '
   ,--.   .--.   ,--.   .--.|  |  |  |
   |  |   |  |   |  |   |  |'--'  |  |
   |  |   |  |   |  |   |  |    __.  |
   |  |.'.|  |   |  |.'.|  |   |   .'
   |         |   |         |   |___|
   |   ,'.   |hat|   ,'.   |af .---.
   '--'   '--'   '--'   '--'   '---'
/><s/**/cript>alert("WhatWaf?<|>v1.8($stable)");</scrip/**/t>

[00:58:55][INFO] gathering a list of possible detectable wafs
360 Web Application Firewall (360)
aeSecure (WAF)
Airlock (Phion/Ergon)
AkamaiGHost Website Protection (Akamai Global Host)
Alert Logic (SIEMless Threat Management)
AliYunDun (WAF)
Anquanbao Web Application Firewall (Anquanbao)
AnYu Web Application Firewall (Anyu Technologies)
Apache Generic
Armor Protection (Armor Defense)
Application Security Manager (F5 Networks)
ASP.NET Generic Website Protection (MS)
Apache Traffic Server (ATS web proxy)
Amazon Web Services Web Application Firewall (Amazon)
Yunjiasu Web Application Firewall (Baidu)
Barikode Web Application Firewall
Barracuda Web Application Firewall (Barracuda Networks)
Bekchy (WAF)
BIG-IP (F5 Networks)
BinarySEC Web Application Firewall (BinarySEC)
Bitninja (WAF)
BlockDos DDoS protection (BlockDos)
Chuangyu top government cloud defense platform (WAF)
Cisco ACE XML Firewall (Cisco)
CloudFlare Web Application Firewall (CloudFlare)
CloudFront Firewall (Amazon)
XSS/CSRF Filtering Protection (CodeIgniter)
Comodo Web Application Firewall (Comodo)
IBM Websphere DataPower Firewall (IBM)
Deny All Web Application Firewall (DenyAll)
DiDiYun WAF (DiDi)
DoD Enterprise-Level Protection System (Department of Defense)
DOSarrest (DOSarrest Internet Security)
dotDefender (Applicure Technologies)
DynamicWeb Injection Check (DynamicWeb)
EdgeCast Web Application Firewall (Verizon)
ExpressionEngine (Ellislab WAF)
FortiWeb Web Application Firewall (Fortinet)
Gladius network WAF (Gladius)
Google Web Services
Grey Wizard Protection
Incapsula Web Application Firewall (Incapsula/Imperva)
INFOSAFE by http://7i24.com
Instart Logic (Palo Alto)
Janusec Application Gateway (WAF)
Jiasule (WAF)
Litespeed webserver Generic Protection
Malcare (MalCare Security WAF)
Open Source Web Application Firewall (Modsecurity)
Mod Security (OWASP CSR)
NexusGuard Security (WAF)
Nginx Generic Protection
Palo Alto Firewall (Palo Alto Networks)
Anti Bot Protection (PerimeterX)
pkSecurityModule (IDS)
Powerful Firewall (MyBB plugin)
Radware (AppWall WAF)
RSFirewall (Joomla WAF)
Sabre Firewall (WAF)
SafeDog WAF (SafeDog)
SecuPress (Wordpress WAF)
Shadow Daemon Opensource (WAF)
Shield Security
Website Security SiteGuard (Lite)
SonicWALL Firewall (Dell)
Squid Proxy (IDS)
Stingray Application Firewall (Riverbed/Brocade)
StrictHttpFirewall (WAF)
Sucuri Firewall (Sucuri Cloudproxy)
Teros Web Application Firewall (Citrix)
UEWaf (UCloud)
UrlScan (Microsoft)
Varnish/CacheWall WAF
Viettel WAF (Cloudrity)
Wallarm WAF
WebKnight Application Firewall (AQTRONIX)
IBM Security Access Manager (WebSEAL)
West236 Firewall
Wordfence (Feedjit)
WTS-WAF (Web Application Firewall)
Xuanwudun WAF
Yundun Web Application Firewall (Yundun)
Yunsuo Web Application Firewall (Yunsuo)
Zscaler Cloud Firewall (WAF)
[00:58:55][INFO] WhatWaf can detect a total of 86 web application protection systems

可能的篡改脚本

	                          ,------.  
	                         '  .--.  ' 
	,--.   .--.   ,--.   .--.|  |  |  | 
	|  |   |  |   |  |   |  |'--'  |  | 
	|  |   |  |   |  |   |  |    __.  | 
	|  |.'.|  |   |  |.'.|  |   |   .'  
	|         |   |         |   |___|   
	|   ,'.   |hat|   ,'.   |af .---.   
	'--'   '--'   '--'   '--'   '---'  
\"/><sCRIPT>ALeRt(\"WhatWaf?<|>v1.6.2($dev)\");</scRiPT>