enhancementgood first issuehelp wanted
倉庫指標
- 星標
- (594 顆星)
- PR 合併指標
- (PR 指標待抓取)
描述
It might be interesting to add some Web Application Firewall detection techniques. I don't know much about WAFs, but it looks like there are some common oracles:
- Known cookies
- Known weird HTTP codes (
999 No Hacking) - Known HTML responses
Some potential resources:
- https://www.owasp.org/images/b/bf/OWASP_Stammtisch_Frankfurt_WAF_Profiling_and_Evasion.pdf
- https://www.securitynewspaper.com/2018/12/04/detect-web-application-firewall-waf-before-you-attack/ (looks like there's an
nmapscript for WAF detection)