WAFNinja – Web Application Firewall Attack Tool – WAF Bypass


WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation.

WAFNinja - Web Application Firewall Attack Tool - WAF Bypass


The tool was created with the objective to be easily extendible, simple to use and usable in a team environment.

What can WAFNinja Web Application Firewall Attack Tool Do?

Many payloads and fuzzing strings, which are stored in a local database file come shipped with the tool.

WAFNinja supports:

  • HTTP connections
  • GET requests
  • POST requests
  • Using Cookies (for pages behind auth)
  • Intercepting proxy

Using WAFNinja for WAF Bypass

Examples of Web Application Firewall Attacks

Fuzz:

Bypass:

Insert-fuzz:

You can also check out:

WAFW00F – Fingerprint & Identify Web Application Firewall (WAF) Products

You can download WAFNinja here:

WAFNinja-master.zip

Or read more here.

Posted in: Hacking Tools

, ,


Latest Posts:


Socialscan - Command-Line Tool To Check For Email And Social Media Username Usage Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage
socialscan is an accurate command-line tool to check For email and social media username usage on online platforms, given an email address or username,
CFRipper - CloudFormation Security Scanning & Audit Tool CFRipper – CloudFormation Security Scanning & Audit Tool
CFRipper is a Python-based Library and CLI security analyzer that functions as an AWS CloudFormation security scanning and audit tool
CredNinja - Test Credential Validity of Dumped Credentials or Hashes CredNinja – Test Credential Validity of Dumped Credentials or Hashes
CredNinja is a tool to quickly test credential validity of dumped credentials (or hashes) across an entire network or domain very efficiently.
assetfinder - Find Related Domains and Subdomains assetfinder – Find Related Domains and Subdomains
assetfinder is a Go-based tool to find related domains and subdomains that are related to a given domain from a variety of sources including Facebook and more.
Karkinos - Beginner Friendly Penetration Testing Tool Karkinos – Beginner Friendly Penetration Testing Tool
Karkinos is a light-weight Beginner Friendly Penetration Testing Tool, which is basically a 'Swiss Army Knife' for pen-testing and/or hacking CTF's.
Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.


3 Responses to WAFNinja – Web Application Firewall Attack Tool – WAF Bypass

  1. madtester November 2, 2017 at 8:26 am #

    This does not work against F5 ASM despite the claims in the review article here:

    https://waf.ninja/review-wafninja/

    • Darknet November 2, 2017 at 2:59 pm #

      Worked on an earlier version maybe?

    • mishka November 7, 2017 at 1:54 pm #

      The tool wasn’t changed for a year and according to article it has only one XSS payload related to F5 ASM. Probably, it was just mitigated with additional rules and guess the same applies to the rest of vendor-specific payloads.