Details

Category: Recon

Publisher: trickest-mhmdiaa

Created Date: 1/19/2024

Container: quay.io/trickest/whatwaf:06c815a-patch-3

Source URL: https://github.com/Ekultek/WhatWaf

Parameters

​
csv
boolean
Command: --csv - Send the output to a CSV file
​
url
string
required
Command: --url - Pass a single URL to detect the protection
​
burp
file
Command: --burp - Pass a Burp Suite request file to perform WAF evaluation
​
data
string
Command: --data - Send this data with the POST request (*default=random)
​
hide
boolean
Command: --hide - Hide the banner during the run
​
json
boolean
required
Command: --json - Send the output to a JSON file
​
list
file
required
Command: --list - Pass a file containing URL's (one per line) to detect the protection
​
post
boolean
Command: --post - Send a POST request (*default=GET)
Command: --skip - Skip checking for bypasses and just identify the firewall
​
test
boolean
Command: --test - Test the connection to the website before starting (*default=True)
​
yaml
boolean
Command: --yaml - Send the output to a YAML file
​
proxy
string
Command: --proxy - Provide a proxy to run behind in the format type://address:port (IE socks5://10.54.127.4:1080) (*default=None)
​
encode
string
Command: --encode - Encode a provided payload using provided tamper script(s) you are able to payy multiple tamper script load paths to this argument and the payload will be tampered as requested
​
googler
file
Command: --googler - Pass a JSON file from the Googler CMD line tool (IE googler -n 100 --json >> googler.json)
​
headers
string
Command: --headers - Add your own custom headers to the request. To use multiple separate headers by comma. Your headers need to be exact(IE: Set-Cookie=a345ddsswe,X-Forwarded-For:127.0.0.1) (*default=None)
​
threads
string
Command: --threads - Send requests in parallel (specify number of threads (*default=1)
​
timeout
string
Command: --timeout - Control the timeout time of the requests (*default=15)
​
verbose
boolean
Command: --verbose - Run in verbose mode (more output)
​
payloads
string
Command: --payloads - Provide your own payloads separated by a comma IE AND 1=1,AND 2=2
​
throttle
string
Command: --throttle - Provide a sleep time per request (*default=0)
​
force-ssl
boolean
Command: --force-ssl - Force the assignment of HTTPS instead of HTTP while processing (*default=HTTP unless otherwise specified by URL)
​
force-file
boolean
Command: --force-file - Force the creation of a file even if there is no protection identified
​
tamper-int
string
Command: --tamper-int - Control the amount of tampers that are displayed (*default=5)
​
user-agent
string
Command: --pa - Provide your own personal agent to use it for the HTTP requests
​
verify-num
string
Command: --verify-num - Change the request amount to verify if there really is not a WAF present(*default=5)
​
encode-list
string
Command: --encode-list - Encode a file containing payloads (one per line) by passing the path and load path, files can only encoded using a single tamper script load path
​
fingerprint
boolean
Command: --fingerprint - Save all fingerprints for further investigation
​
payload-list
file
Command: --pl - Provide a file containing a list of payloads 1 per line
​
random-user-agent
boolean
Command: --ra - Use a random user-agent for the HTTP requests (*default=whatwaf/2.1.6.3 (Language=3.10.12; Platform=Linux))
​
determine-webserver
boolean
Command: --determine-webserver - Attempt to determine what web server is running on the backend (IE Apache, Nginx, etc.. *default=False)