Comments (8)
0xInfection
commented on July 17, 2024
1
No problem mate, happens to the best of us. Feel free to ping if you run into further problems. ;)
from wafw00f.
0xInfection
commented on July 17, 2024
Thanks for pulling this up, the modsecurity part is a minor bug. It'll be resolved via #67.
from wafw00f.
0xInfection
commented on July 17, 2024
For the Akamai WAF, it has already been included in #67, but for the Mod Security fingerprint I am not being able to reproduce the attack vector technique on 3+ sites running Mod Security. I do presume that the test GET request is supposed to trigger the WAF, but actually its not being reproduced on the sites found in the wild.
from wafw00f.
sandrogauci
commented on July 17, 2024
#67 should do it. Thanks @Pacodiaz2g , @0xInfection
from wafw00f.
duraki
commented on July 17, 2024
Akamai is sometimes not detected. Ie. it is now obscured, since Apache takes a lead.
POST /getstorelocatoraddress.json HTTP/1.1
Host: *
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://www.superdrug.com/no-referrer
content-type: application/x-www-form-urlencoded; charset=UTF-8
x-csrf-token: 1849b727-47fe-402c-8a31-69af0a2487e2
Origin: https://www.superdrug.com
Content-Length: 23
Connection: close
Cookie: ...
DNT: 1
q=&country=GB&services=
Response:
HTTP/1.1 200 OK
Server: Apache
X-Frame-Options: SAMEORIGIN
...
{"pagination":{"pageSize":0,"sort":...}
In case when body payload is:
q=" and 1=1--&country=GB&services=
AkamaiGhost is visible in the response, so it requires permutation on the given URL. Didn't open a new issue since I don't know if this is normal occurence.
Response:
HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 298
Expires: Tue, 11 Aug 2020 19:47:03 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 11 Aug 2020 19:47:03 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT
Server-Timing: edge; dur=4
<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
You don't have permission to access "http://www.*.com/*.json" on this server.<P>
Reference #18.745b6068.1597175223.24f2341c
</BODY>
</HTML>
from wafw00f.
0xInfection
commented on July 17, 2024
Hi @duraki,
So far in my research I have observed that Akamai will trigger on GET requests too, so any non existent URLs with any random payload should also trigger the WAF. If this seems a new variant, I'll look into it. Thanks for this. =)
from wafw00f.
sandrogauci
commented on July 17, 2024
@duraki could you provide us with the wafw00f command that you're running to reproduce the issue?
I'm using v2.1.0, running wafw00f https://yourtarget/getstorelocatoraddress.json and see the following:
[*] Checking https://yourtarget/getstorelocatoraddress.json
[+] The site https://yourtarget/getstorelocatoraddress.json is behind Kona SiteDefender (Akamai) WAF.
[~] Number of requests: 2
Of course it is not sending a POST request like you are.
from wafw00f.
duraki
commented on July 17, 2024
Ah crap! Forget it. Just did history | grep wafw00f and saw I passed a wrong DNS. Sorry guys, must be lack of caffeine.
from wafw00f.
Related Issues (20)
- The wafw00f command cannot be used on the windows system HOT 3
- wafw00f no response HOT 3
- Number of requests HOT 1
- Change param name of request HOT 1
- Added request-url on which triggered WAF to json output file
- Azure Application Gateway HOT 1
- python setup.py install command not work HOT 5
- Integration HOT 1
- Error in line 22 of the main.py file HOT 3
- HTTPSConnectionPool port 443 conduct to Read timed out - response time from the server is too low? HOT 1
- Enhancing Project Performance: Asynchronous Implementation and Multithreading Support HOT 2
- Cannot check for NAXSI HOT 1
- code plugin HOT 2
- code plugin HOT 2
- Can wafw00f detect the WAF devices being used by IPv6 websites in an IPv6 network? thanks
- 识别不出imperva waf 的securephere
- Standalone binary HOT 1
- Deprecation
- idna does work failed HOT 1
- Incorrect provider for Zscaler HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wafw00f.