Skip to main content
Name:whatwaf
Category:Recon
Publisher:trickest-mhmdiaa
Created:1/19/2024
Container:quay.io/trickest/whatwaf:06c815a-patch-3
Output Type:
License:Unknown

Parameters

​
csv
boolean
--csvSend the output to a CSV file
​
url
string
required
--urlPass a single URL to detect the protection
​
burp
file
--burpPass a Burp Suite request file to perform WAF evaluation
​
data
string
--dataSend this data with the POST request (*default=random)
​
hide
boolean
--hideHide the banner during the run
​
json
boolean
required
--jsonSend the output to a JSON file
​
list
file
required
--listPass a file containing URL's (one per line) to detect the protection
​
post
boolean
--postSend a POST request (*default=GET)
--skipSkip checking for bypasses and just identify the firewall
​
test
boolean
--testTest the connection to the website before starting (*default=True)
​
yaml
boolean
--yamlSend the output to a YAML file
​
proxy
string
--proxyProvide a proxy to run behind in the format type://address:port (IE socks5://10.54.127.4:1080) (*default=None)
​
encode
string
--encodeEncode a provided payload using provided tamper script(s) you are able to payy multiple tamper script load paths to this argument and the payload will be tampered as requested
​
googler
file
--googlerPass a JSON file from the Googler CMD line tool (IE googler -n 100 --json >> googler.json)
​
headers
string
--headersAdd your own custom headers to the request. To use multiple separate headers by comma. Your headers need to be exact(IE: Set-Cookie=a345ddsswe,X-Forwarded-For:127.0.0.1) (*default=None)
​
threads
string
--threadsSend requests in parallel (specify number of threads (*default=1)
​
timeout
string
--timeoutControl the timeout time of the requests (*default=15)
​
verbose
boolean
--verboseRun in verbose mode (more output)
​
payloads
string
--payloadsProvide your own payloads separated by a comma IE AND 1=1,AND 2=2
​
throttle
string
--throttleProvide a sleep time per request (*default=0)
​
force-ssl
boolean
--force-sslForce the assignment of HTTPS instead of HTTP while processing (*default=HTTP unless otherwise specified by URL)
​
force-file
boolean
--force-fileForce the creation of a file even if there is no protection identified
​
tamper-int
string
--tamper-intControl the amount of tampers that are displayed (*default=5)
​
user-agent
string
--paProvide your own personal agent to use it for the HTTP requests
​
verify-num
string
--verify-numChange the request amount to verify if there really is not a WAF present(*default=5)
​
encode-list
string
--encode-listEncode a file containing payloads (one per line) by passing the path and load path, files can only encoded using a single tamper script load path
​
fingerprint
boolean
--fingerprintSave all fingerprints for further investigation
​
payload-list
file
--plProvide a file containing a list of payloads 1 per line
​
random-user-agent
boolean
--raUse a random user-agent for the HTTP requests (*default=whatwaf/2.1.6.3 (Language=3.10.12; Platform=Linux))
​
determine-webserver
boolean
--determine-webserverAttempt to determine what web server is running on the backend (IE Apache, Nginx, etc.. *default=False)