WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation.
The tool was created with the objective to be easily extendible, simple to use and usable in a team environment.
What can WAFNinja Web Application Firewall Attack Tool Do?
Many payloads and fuzzing strings, which are stored in a local database file come shipped with the tool.
WAFNinja supports:
- HTTP connections
- GET requests
- POST requests
- Using Cookies (for pages behind auth)
- Intercepting proxy
Using WAFNinja for WAF Bypass
wafninja.py [–h] [–v] {fuzz, bypass, insert–fuzz, insert–bypass, set–db} ... |
Examples of Web Application Firewall Attacks
Fuzz:
python wafninja.py fuzz –u “http://www.target.com/index.php?id=FUZZ” –c “phpsessid=value” –t xss –o output.html |
Bypass:
python wafninja.py bypass –u “http://www.target.com/index.php” –p “Name=PAYLOAD&Submit=Submit” –c “phpsessid=value” –t xss –o output.html |
Insert-fuzz:
python wafninja.py insert–fuzz –i select –e select –t sql |
You can also check out:
– WAFW00F – Fingerprint & Identify Web Application Firewall (WAF) Products
You can download WAFNinja here:
Or read more here.
Source : DarkNet