identYwaf

What is identYwaf?

identYwaf is an open source, blind web application firewall identification tool. As we all know the term blind SQL injection, this tool recognizes more than 70 types of web application firewalls based on blind inference. What does this mean? Well, identYwaf has a set of pre-defined, non-destructive payloads which will incite a response from the web application firewall being tested. This response is then matched against individual ‘signatures’ of these firewalls. They can be found in the data.json file of the project. These signatures are nothing but simple well known strings like “1 AND 1=1” on which these web application firewalls react. Which firewalls you may ask? Well, here’s a list:

List of Web Application Firewalls supported by identYwaf:

1. 360 Web Application Firewall (360)
2. aeSecure
3. Airlock (Phion/Ergon)
4. Alibaba Cloud Security Server Guard (Server Security)
5. Anquanbao Web Application Firewall (Anquanbao)
6. Approach Web Application Firewall (Approach)
7. Armor Protection (Armor Defense)
8. F5 Networks (Application Security Manager)
9. Amazon (AWS WAF)
10. Barracuda Networks WAF
11. BitNinja
12. Bluedon Web Application Firewall
13. CdnNs/WdidcNet (CdnNsWAF)
14. WP Cerber Security
15. Check Point Next Generation Firewall
16. Yunaq (Chuangyu shield)
17. Cloudbric
18. CloudFlare
19. Comodo WAF
20. CrawlProtect (Jean-Denis Brun)
21. Distil Guard
22. dotDefender (Applicure Technologies)
23. ExpressionEngine (EllisLab)
24. FortiWeb (FortiNet)
25. GoDaddy Website Security
26. Grey Wizard Shield
27. Imunify360 WebShield
28. Incapsula/Imperva
29. Microsoft ISA Server
30. Janusec Application Gateway
31. Jiasule WAF
32. Knownsec WAF
33. Akamai Technologies Kona Site Defender
34. MalCare (Inactiv)
35. ModSecurity (Trustwave)
36. NAXSI
37. Citrix NetScaler AppFirewall
38. Newdefend
39. NinjaFirewall (NinTechNet)
40. onMessage Shield (Blackbaud)
41. Palo Alto
42. PerimeterX Defender
43. Radware AppWall
44. Reblaze
45. Microsoft ASP.NET Request Validation
46. RSFirewall (RSJoomla!)
47. Safe3 Web Firewall
48. Safedog WAF
49. Secure Entry Server (United Security Providers)
50. SecureIIS Web Server Security (BeyondTrust)
51. Shield Security (One Dollar Plugin)
52. Imperva SecureSphere
53. SiteGround
54. SiteGuard (JP-Secure)
55. TrueShield (SiteLock)
56. Dell SonicWALL
57. Sophos UTM Web Protection
58. Squarespace WAF
59. StackPath
60. Sucuri
61. Tencent Cloud
62. Microsoft Forefront Threat Management Gateway
63. Microsoft URLScan
64. Url Master SecurityCheck (iFinity/DotNetNuke)
65. OWASP Varnish Firewall
66. Virusdie WAF
67. Varnish Security Firewall
68. Wallarm WAF
69. WatchGuard Firewall
70. AQTRONIX WebKnight Application Firewall
71. Wordfence
72. YUNDUN Cloud WAF
73. Yunsuo Web Application Firewall
74. Zenedge

Whoa! That’s a long list for sure! The best part of this architecture is that if you find that a certain web application firewall is not being detected by identYwaf, you can simply edit the data.json file and you are done! That’s what I did! These are the before and after results:

Before identYwaf data.json update:

       __ __ 
 ____  ___      ___  ____   ______ |  T  T __    __   ____  _____ 
l    j|   \    /  _]|    \ |      T|  |  ||  T__T  T /    T|   __|
 |  T |    \  /  [_ |  _  Yl_j  l_j|  ~  ||  |  |  |Y  o  ||  l_
 |  | |  D  YY    _]|  |  |  |  |  |___  ||  |  |  ||     ||   _|
 j  l |     ||   [_ |  |  |  |  |  |     ! \      / |  |  ||  ] 
|____jl_____jl_____jl__j__j  l__j  l____/   \_/\_/  l__j__jl__j  (1.0.64)

[o] loading data...
[o] initializing handlers...
[i] checking hostname 'testing.com'...
[i] running basic heuristic test...
[i] rejected summary: 200
[-] non-blind match: -
[!] multiple (reactive) rejection HTTP codes detected (200, 302)
[!] multiple (reactive) rejection HTML responses detected
[i] running payload tests... (45/45)
[=] results: '....................xx..x.......x......xx.xx.'
[=] hardness: easy (17%)
[=] signature: 'xxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
[+] blind match: 'SiteGround' (97%), 'Kona Site Defender (Akamai Technologies)' (93%), 'WatchGuard (WatchGuard Technologies)' (91%), 'Shield Security (One Dollar Plugin)' (91%)

After identYwaf data.json update:

       __ __ 
 ____  ___      ___  ____   ______ |  T  T __    __   ____  _____ 
l    j|   \    /  _]|    \ |      T|  |  ||  T__T  T /    T|   __|
 |  T |    \  /  [_ |  _  Yl_j  l_j|  ~  ||  |  |  |Y  o  ||  l_
 |  | |  D  YY    _]|  |  |  |  |  |___  ||  |  |  ||     ||   _|
 j  l |     ||   [_ |  |  |  |  |  |     ! \      / |  |  ||  ] 
|____jl_____jl_____jl__j__j  l__j  l____/   \_/\_/  l__j__jl__j  (1.0.64)

[o] loading data...
[o] initializing handlers...
[i] checking hostname 'testing.com'...
[i] running basic heuristic test...
[i] rejected summary: 200
[-] non-blind match: -
[!] multiple (reactive) rejection HTTP codes detected (200, 302)
[!] multiple (reactive) rejection HTML responses detected
[i] running payload tests... (45/45)
[=] results: '....................xx..x.......x......xx.xx.'
[=] hardness: easy (17%)
[=] signature: 'xxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
[+] blind match: 'CloudFlare' (100%)

So you see, it is very easy to customize and use this tool. In fact, If you have used sqlmap before, then you know that this tool works as this tool seems to have born out of the former.

Download identYwaf:

The tool has had frequent updates since it was first published last week and it works on *NIX & Windows as well. As of now, you can get identYwaf v1.0.64 from it's GitHub repository. Else, if you are comfortable using git, follow these steps:

git clone --depth 1 https://github.com/stamparm/identYwaf.git
cd identYwaf/
python identYwaf https://yourtargethere.com

Share this post on: