WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation.
The tool was created with the objective to be easily extendible, simple to use and usable in a team environment.
What can WAFNinja Web Application Firewall Attack Tool Do?
Many payloads and fuzzing strings, which are stored in a local database file come shipped with the tool.
WAFNinja supports:
- HTTP connections
- GET requests
- POST requests
- Using Cookies (for pages behind auth)
- Intercepting proxy
Using WAFNinja for WAF Bypass
|
1
|
wafninja.py [–h] [–v] {fuzz, bypass, insert–fuzz, insert–bypass, set–db} ...
|
REGISTER TODAY FOR YOUR KUBERNETES FOR DEVELOPERS (LFD259) COURSE AND CKAD CERTIFICATION TODAY! $499! $299 now!!
Examples of Web Application Firewall Attacks
Fuzz:
|
1
|
python wafninja.py fuzz –u “http://www.target.com/index.php?id=FUZZ” –c “phpsessid=value” –t xss –o output.html
|
Bypass:
|
1
|
python wafninja.py bypass –u “http://www.target.com/index.php” –p “Name=PAYLOAD&Submit=Submit” –c “phpsessid=value” –t xss –o output.html
|
Insert-fuzz:
|
1
|
python wafninja.py insert–fuzz –i select –e select –t sql
|
You can also check out:
– WAFW00F – Fingerprint & Identify Web Application Firewall (WAF) Products
$299 WILL ENROLL YOU IN OUR SELF PACED COURSE – LFS205 – ADMINISTERING LINUX ON AZURE!
Linux Security Blog 
You must be logged in to post a comment.