From e1e392397342815dc4e1d8c7750d455a98abf93a Mon Sep 17 00:00:00 2001 From: 0xInfection Date: Mon, 28 Jan 2019 10:57:14 +0530 Subject: [PATCH] Added table based changes --- README.md | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index acedf24..4d2e814 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,25 @@ Feel free to [contribute](). - [Awesome Presentations & Papers](#presentations--research-papers) ## Awesome WAFs List + + + + + + + + + +
+ 360 WangZhanBao WAF + + A WAF solution from 360 Security Team. +
+ Airlock + + The Airlock Web Application Firewall offers a unique combination of protective mechanisms for web applications. Each access is systematically monitored and filtered at every level. Used in conjunction with an authentication solution such as Airlock Login or IAM, Airlock WAF can force upstream user authentication and authorization. + - __Brochure:__ https://www.airlock.com/media/medialibrary/2016/09/Airlock-Suite-en_web.pdf +
## Testing Methodology Alright, now lets see the approach of testing WAFs. Wait, before that we need to know how they work right? Here you go. @@ -65,6 +84,7 @@ __1. Fingerprinting with [NMap](https://nmap.org)__: __Source:__ [GitHub](https://github.com/nmap/nmap) | [SVN](http://svn.nmap.org) - Normal WAF Fingerprinting + ``` nmap --script=http-waf-fingerprint ``` @@ -74,10 +94,12 @@ nmap --script=http-waf-fingerprint --script-args http-waf-fingerprint.intensive ``` - Generic Detection ``` -nmap�--script=http-waf-detect +nmap --script=http-waf-detect ``` __2. Fingerprinting with [WafW00f](https://github.com/EnableSecurity/wafw00f)__: + +__Source:__ [GitHub](https://github.com/enablesecurity/wafw00f) | [Pypi](https://pypi.org/project/wafw00f) ``` wafw00f ``` @@ -107,7 +129,7 @@ sqlmap -u --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostro __2. Evading WAFs with [WAFNinja](https://waf.ninja/)__ -__Source:__ [GitHub](https://githubç +__Source:__ [GitHub](https://github.com/khalilbijjou/wafninja) - Fuzzing ``` python wafninja.py fuzz -u -t xss