enhancementgood first issuehelp wanted
仓库指标
- 星标
- (594 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
It might be interesting to add some Web Application Firewall detection techniques. I don't know much about WAFs, but it looks like there are some common oracles:
- Known cookies
- Known weird HTTP codes (
999 No Hacking) - Known HTML responses
Some potential resources:
- https://www.owasp.org/images/b/bf/OWASP_Stammtisch_Frankfurt_WAF_Profiling_and_Evasion.pdf
- https://www.securitynewspaper.com/2018/12/04/detect-web-application-firewall-waf-before-you-attack/ (looks like there's an
nmapscript for WAF detection)