JSON - specifies that the request's body should be in JSON format.Not applicable to payloads in API and MFD directories. Applicable only to for ARGS, BODY, COOKIE and HEADER zone. Multiple values are indicated with a space (e.g.
ENCODE - specifies the type of payload encoding ( Base64, HTML-ENTITY, UTF-16) in addition to the encoding for the payload.Applicable only to payloads in the MFD directory. BOUNDARY - specifies the contents of the request's boundary.When compiling a payload, the following zones, method and options are used: SSTI - Server-Side Template Injection payloads.SSRF - Server-side request forgery payloads.Multiple use is allowed.ĭepending on the purpose, payloads are located in the appropriate folders: '-exclude-dir' - exclude the payload's directory ( -exclude-dir='SQLi' -exclude-dir='XSS'). '-details' - display the False Positive and False Negative payloads. '-json-format' - an option that allows you to display the result of the work in JSON format (useful for integrating the tool with security platforms). '-timeout' ( -timeout=10) - option allows to specify a request processing timeout in sec. '-threads' ( -threads=15) - option allows to specify the number of parallel scan threads (default is 10). '-block-code' ( -block-code='403' -block-code='222') - option allows you to specify the HTTP status code to expect when the WAF is blocked. '-user-agent' ( -user-agent 'MyUserAgent 1/1') - option allows to specify the HTTP User-Agent to send with all requests, except when the User-Agent is set by the payload ( "USER-AGENT"). '-header' ( -header 'Authorization: Basic YWRtaW46YWRtaW4=' -header 'X-TOKEN: ABCDEF') - option allows to specify the HTTP header to send with all requests (e.g. '-proxy' ( -proxy=' ') - option allows to specify where to connect to instead of the host. # python3 /opt/waf-bypass/main.py -host=''
# python3 -m pip install -r /opt/waf-bypass/requirements.txt Run source code from GitHub # git clone /opt/waf-bypass/ # docker run nemesida/waf-bypass -host='' It can be easily pulled via the following command: # docker pull nemesida/waf-bypass
The latest waf-bypass always available via the Docker Hub. We are not responsible for possible risks associated with the use of this software. It is forbidden to use for illegal and illegal purposes. WAF Bypass Tool is developed by Nemesida WAF team with the participation of community. WAF bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads.
0 kommentar(er)
