identYwaf

identYwaf Description

identYwaf is an identification tool that can recognize web protection type (i.e. Web Application Firewall (WAF)) based on blind inference. Blind inference is being done by inspecting responses provoked by a set of predefined offensive (non-destructive) payloads, where those are used only to trigger the web protection system in between (e.g. http://<host>?aeD0oowi=1 AND 2>1). Currently it supports more than 80 different protection products (e.g. aeSecure, Airlock, CleanTalk, CrawlProtect, Imunify360, MalCare, ModSecurity, Palo Alto, SiteGuard, UrlScan, Wallarm, WatchGuard, Wordfence, etc.), while the knowledge-base is constantly growing.

GitHub: https://github.com/stamparm/identYwaf

Author: Miroslav Stampar

License: MIT

identYwaf Help

Usage:

python identYwaf.py [options] <host|url>

Options:

  --version           Show program's version number and exit
  -h, --help          Show this help message and exit
  --delay=DELAY       Delay (sec) between tests (default: 0)
  --timeout=TIMEOUT   Response timeout (sec) (default: 10)
  --proxy=PROXY       HTTP proxy address (e.g. "http://127.0.0.1:8080")
  --proxy-file=PRO..  Load (rotating) HTTP(s) proxy list from a file
  --random-agent      Use random HTTP User-Agent header value
  --code=CODE         Expected HTTP code in rejected responses
  --string=STRING     Expected string in rejected responses
  --post              Use POST body for sending payloads

identYwaf Usage Example

Recognize web protection type (Web Application Firewall (WAF)) of wise.com website:

python3 identYwaf.py wise.com

How to install identYwaf

Installation on Kali Linux

git clone --depth 1 https://github.com/stamparm/identYwaf
cd identYwaf
python3 identYwaf.py -h

Installation on Debian, Linux Mint, Ubuntu

sudo apt update
sudo apt install git
git clone --depth 1 https://github.com/stamparm/identYwaf
cd identYwaf
python3 identYwaf.py -h

Installation on BlackArch

The program is pre-installed on BlackArch. To install in minimal builds run:

sudo pacman -S identywaf

identYwaf Screenshots

identYwaf Tutorials

Coming soon…