![]()
![]()
WAFNinja是用Python编写的CLI工具。它应通过自动执行绕过输入验证的必要步骤来帮助渗透测试人员绕过WAF。创建该工具的目的是易于扩展，易于使用并且可在团队环境中使用。该工具附带了许多存储在本地数据库文件中的有效负载和模糊字符串。WAFNinja支持HTTP连接，GET和POST请求以及Cookies的使用，以便访问仅限于经过身份验证的用户的页面。另外，可以设置拦截代理。用法：
wafninja.py [-h] [-v] {fuzz, bypass, insert-fuzz, insert-bypass, set-db} ...例：
python wafninja.py fuzz -u "http://www.target.com/index.php?id=FUZZ"
-c "phpsessid=value" -t xss -o output.html 旁路：
python wafninja.py bypass -u "http://www.target.com/index.php" -p "Name=PAYLOAD&Submit=Submit"
-c "phpsessid=value" -t xss -o output.html插入模糊：
python wafninja.py insert-fuzz -i select -e select -t sql
位置参数：{fuzz，bypass，insert-fuzz，insert-bypass，set-db}
Which function do you want to use?fuzz check which symbols and keywords are allowed by the WAF.
bypass sends payloads from the database to the target.
insert-fuzz add a fuzzing string
insert-bypass add a payload to the bypass list
set-db use another database file. Useful to share the same database with others.optional arguments:
-h, --help show this help message and exit
-v, --version show program's version number and exit文章来源及下载：
https://github.com/unamer/WAFNinja
![]( "微信公众号文章素材之分割线大全")
![]()
文章来源: http://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650457884&idx=4&sn=43cbc112d1cc4e43cc101b60ab4c8e1c&chksm=83bba2f8b4cc2bee2ae9e5a99eabdde351b7f7d97b18667515fb12f665804b321fbaa8ccda37#rd
如有侵权请联系:admin#unsafe.sh