{"id":4807,"date":"2017-11-01T01:20:23","date_gmt":"2017-10-31T17:20:23","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4807"},"modified":"2017-11-01T01:22:03","modified_gmt":"2017-10-31T17:22:03","slug":"wafninja-web-application-firewall-attack-tool-waf-bypass","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2017\/11\/wafninja-web-application-firewall-attack-tool-waf-bypass\/","title":{"rendered":"WAFNinja &#8211; Web Application Firewall Attack Tool &#8211; WAF Bypass"},"content":{"rendered":"<p>WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/WAFNinja-Web-Application-Firewall-Attack-Tool-WAF-Bypass-640x457.jpg\" alt=\"WAFNinja - Web Application Firewall Attack Tool - WAF Bypass\" width=\"640\" height=\"457\" class=\"aligncenter size-medium wp-image-4870\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/WAFNinja-Web-Application-Firewall-Attack-Tool-WAF-Bypass-640x457.jpg 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/WAFNinja-Web-Application-Firewall-Attack-Tool-WAF-Bypass-1024x731.jpg 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/WAFNinja-Web-Application-Firewall-Attack-Tool-WAF-Bypass-1536x1097.jpg 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/WAFNinja-Web-Application-Firewall-Attack-Tool-WAF-Bypass.jpg 1574w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>The tool was created with the objective to be easily extendible, simple to use and usable in a team environment.<\/p>\n<h2>What can WAFNinja Web Application Firewall Attack Tool Do?<\/h2>\n<p>Many payloads and fuzzing strings, which are stored in a local database file come shipped with the tool.<\/p>\n<p>WAFNinja supports:<\/p>\n<ul>\n<li>HTTP connections<\/li>\n<li>GET requests<\/li>\n<li>POST requests<\/li>\n<li>Using Cookies (for pages behind auth)<\/li>\n<li>Intercepting proxy<\/li>\n<\/ul>\n<h3>Using WAFNinja for WAF Bypass<\/h3>\n<pre>wafninja.py [-h] [-v] {fuzz, bypass, insert-fuzz, insert-bypass, set-db} ...<\/pre>\n<h4>Examples of Web Application Firewall Attacks<\/h4>\n<p>Fuzz:<\/p>\n<pre>python wafninja.py fuzz -u \"http:\/\/www.target.com\/index.php?id=FUZZ\" -c \"phpsessid=value\" -t xss -o output.html<\/pre>\n<p>Bypass:<\/p>\n<pre>python wafninja.py bypass -u \"http:\/\/www.target.com\/index.php\"  -p \"Name=PAYLOAD&Submit=Submit\" -c \"phpsessid=value\" -t xss -o output.html<\/pre>\n<p>Insert-fuzz:<\/p>\n<pre>python wafninja.py insert-fuzz -i select -e select -t sql<\/pre>\n<p>You can also check out:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2016\/05\/wafw00f-fingerprint-identify-web-application-firewall-waf-products\/\">WAFW00F \u2013 Fingerprint &#038; Identify Web Application Firewall (WAF) Products<\/a><\/p>\n<p>You can download WAFNinja here:<\/p>\n<p><a href=\"https:\/\/github.com\/khalilbijjou\/WAFNinja\/archive\/master.zip\">WAFNinja-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/khalilbijjou\/WAFNinja\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation. The tool was created with the objective to be easily extendible, simple to use and usable in a team environment. What can WAFNinja Web Application Firewall Attack Tool Do? [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"WAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass through automation.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[8724,10654,4784],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4807"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4807"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4807\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}