# Advanced Web Attack Tools

## commix
```
Usage: commix [option(s)]

Options:
  -h, --help            Show help and exit.

  [1m[4mGeneral[0m:
    These options relate to general matters.

    -v VERBOSE          Verbosity level (0-4, Default: 0).
    --version           Show version number and exit.
    --output-dir=OUT..  Set custom output directory path.
    -s SESSION_FILE     Load session from a stored (.sqlite) file.
    --flush-session     Flush session files for current target.
    --ignore-session    Ignore results stored in session file.
    -t TRAFFIC_FILE     Log all HTTP traffic into a textual file.
    --time-limit=TIM..  Run with a time limit in seconds (e.g. 3600).
    --batch             Never ask for user input, use the default behaviour.
    --skip-heuristics   Skip heuristic detection for code injection.
    --codec=CODEC       Force codec for character encoding (e.g. 'ascii').
    --charset=CHARSET   Time-related injection charset (e.g.
                        '0123456789abcdef').
    --check-internet    Check internet connection before assessing the target.
    --answers=ANSWERS   Set predefined answers (e.g. 'quit=N,follow=N').

  [1m[4mTarget[0m:
    This options has to be provided, to define the target URL.

    -u URL, --url=URL   Target URL.
    --url-reload        Reload target URL after command execution.
    -l LOGFILE          Parse target from HTTP proxy log file.
    -m BULKFILE         Scan multiple targets given in a textual file.
    -r REQUESTFILE      Load HTTP request from a file.
    --crawl=CRAWLDEPTH  Crawl the website starting from the target URL
                        (Default: 1).
    --crawl-exclude=..  Regexp to exclude pages from crawling (e.g. 'logout').
    -x SITEMAP_URL      Parse target(s) from remote sitemap(.xml) file.
    --method=METHOD     Force usage of given HTTP method (e.g. 'PUT').

  [1m[4mRequest[0m:
    These options can be used to specify how to connect to the target URL.

    -d DATA, --data=..  Data string to be sent through POST.
    --host=HOST         HTTP Host header.
    --referer=REFERER   HTTP Referer header.
    --user-agent=AGENT  HTTP User-Agent header.
    --random-agent      Use a randomly selected HTTP User-Agent header.
    --param-del=PDEL    Set character for splitting parameter values.
    --cookie=COOKIE     HTTP Cookie header.
    --cookie-del=CDEL   Set character for splitting cookie values.
    --http1.0           Force requests to use the HTTP/1.0 protocol.
    -H HEADER, --hea..  Extra header (e.g. 'X-Forwarded-For: 127.0.0.1').
    --headers=HEADERS   Extra headers (e.g. 'Accept-Language: fr\nETag: 123').
    --proxy=PROXY       Use a proxy to connect to the target URL.
    --tor               Use the Tor network.
    --tor-port=TOR_P..  Set Tor proxy port (Default: 8118).
    --tor-check         Check to see if Tor is used properly.
    --auth-url=AUTH_..  Login panel URL.
    --auth-data=AUTH..  Login parameters and data.
    --auth-type=AUTH..  HTTP authentication type (Basic, Digest, Bearer).
    --auth-cred=AUTH..  HTTP authentication credentials (e.g. 'admin:admin').
    --abort-code=ABO..  Abort on (problematic) HTTP error code(s) (e.g. 401).
    --ignore-code=IG..  Ignore (problematic) HTTP error code(s) (e.g. 401).
    --force-ssl         Force usage of SSL/HTTPS.
    --ignore-proxy      Ignore system default proxy settings.
    --ignore-redirects  Ignore redirection attempts.
    --timeout=TIMEOUT   Seconds to wait before timeout connection (Default:
                        30).
    --retries=RETRIES   Retries when the connection timeouts (Default: 3).
    --drop-set-cookie   Ignore Set-Cookie header from response.

  [1m[4mEnumeration[0m:
    These options can be used to enumerate the target host.

    --all               Retrieve everything.
    --current-user      Retrieve current user name.
    --hostname          Retrieve current hostname.
    --is-root           Check if the current user have root privileges.
    --is-admin          Check if the current user have admin privileges.
    --sys-info          Retrieve system information.
    --users             Retrieve system users.
```

## wapiti
```

     __    __            _ _   _ _____
    / / /\ \ \__ _ _ __ (_) |_(_)___ /
    \ \/  \/ / _` | '_ \| | __| | |_ \
     \  /\  / (_| | |_) | | |_| |___) |
      \/  \/ \__,_| .__/|_|\__|_|____/
                  |_|                 
usage: wapiti [-h] [-u URL] [--swagger URI] [--data data]
              [--scope {url,page,folder,subdomain,domain,punk}]
              [-m MODULES_LIST] [--list-modules] [-l LEVEL] [-p PROXY_URL]
              [--tor] [--mitm-port PORT] [--headless {no,hidden,visible}]
              [--wait TIME] [-a CREDENTIALS] [--auth-user USERNAME]
              [--auth-password PASSWORD] [--auth-method {basic,digest,ntlm}]
              [--form-cred CREDENTIALS] [--form-user USERNAME]
              [--form-password PASSWORD] [--form-url URL] [--form-data DATA]
              [--form-enctype DATA] [--form-script FILENAME] [-c COOKIE_FILE]
              [-sf SIDE_FILE] [-C COOKIE_VALUE] [--drop-set-cookie]
              [--skip-crawl] [--resume-crawl] [--flush-attacks]
              [--flush-session] [--store-session PATH] [--store-config PATH]
              [-s URL] [-x URL] [-r PARAMETER] [--skip PARAMETER] [-d DEPTH]
              [--max-links-per-page MAX] [--max-files-per-dir MAX]
              [--max-scan-time SECONDS] [--max-attack-time SECONDS]
              [--max-parameters MAX] [-S FORCE] [--tasks tasks]
              [--external-endpoint EXTERNAL_ENDPOINT_URL]
              [--internal-endpoint INTERNAL_ENDPOINT_URL]
              [--endpoint ENDPOINT_URL] [--dns-endpoint DNS_ENDPOINT_DOMAIN]
              [-t SECONDS] [-H HEADER] [-A AGENT] [--verify-ssl {0,1}]
              [--color] [-v LEVEL] [--log OUTPUT_PATH] [-f FORMAT]
              [-o OUTPUT_PATH] [-dr DETAILED_REPORT_LEVEL] [--no-bugreport]
              [--update] [--version] [--cms CMS_LIST] [--wapp-url WAPP_URL]
              [--wapp-dir WAPP_DIR]

Wapiti 3.2.10: Web application vulnerability scanner

options:
  -h, --help            show this help message and exit
  -u, --url URL         The base URL used to define the scan scope (default
                        scope is folder)
  --swagger URI         Swagger file URI (path or URL) to target API endpoints
  --data data           Urlencoded data to send with the base URL if it is a
                        POST request
  --scope {url,page,folder,subdomain,domain,punk}
                        Set scan scope
  -m, --module MODULES_LIST
                        List of modules to load
  --list-modules        List Wapiti attack modules and exit
  -l, --level LEVEL     Set attack level
  -p, --proxy PROXY_URL
                        Set the HTTP(S) proxy to use. Supported: http(s) and
                        socks proxies
  --tor                 Use Tor listener (127.0.0.1:9050)
  --mitm-port PORT      Instead of crawling, launch an intercepting proxy on
                        the given port
  --headless {no,hidden,visible}
                        Use a Firefox headless crawler for browsing (slower)
  --wait TIME           Wait the specified amount of seconds before analyzing
                        a webpage (headless mode only)
  -a, --auth-cred CREDENTIALS
                        (DEPRECATED) Set HTTP authentication credentials
  --auth-user USERNAME  Set HTTP authentication username credentials
  --auth-password PASSWORD
                        Set HTTP authentication password credentials
  --auth-method {basic,digest,ntlm}
                        Set the HTTP authentication method to use
  --form-cred CREDENTIALS
                        (DEPRECATED) Set login form credentials
  --form-user USERNAME  Set login form credentials
  --form-password PASSWORD
                        Set password form credentials
  --form-url URL        Set login form URL
  --form-data DATA      Set login form POST data
  --form-enctype DATA   Set enctype to use to POST form data to form URL
  --form-script FILENAME
                        Use a custom Python authentication plugin
  -c, --cookie COOKIE_FILE
                        Set a JSON cookie file to use. You can also pass
                        'firefox' or 'chrome' to load cookies from your
                        browser.
  -sf, --side-file SIDE_FILE
                        Use a .side file generated using Selenium IDE to
```

## wafw00f
```
Usage: wafw00f url1 [url2 [url3 ... ]]
example: wafw00f http://www.victim.org/

Options:
  -h, --help            show this help message and exit
  -v, --verbose         Enable verbosity, multiple -v options increase
                        verbosity
  -a, --findall         Find all WAFs which match the signatures, do not stop
                        testing on the first one
  -r, --noredirect      Do not follow redirections given by 3xx responses
  -t TEST, --test=TEST  Test for one specific WAF
  -o OUTPUT, --output=OUTPUT
                        Write output to csv, json or text file depending on
                        file extension. For stdout, specify - as filename.
  -f FORMAT, --format=FORMAT
                        Force output format to csv, json or text.
  -i INPUT, --input-file=INPUT
                        Read targets from a file. Input format can be csv,
                        json or text. For csv and json, a `url` column name or
                        element is required.
  -l, --list            List all WAFs that WAFW00F is able to detect
  -p PROXY, --proxy=PROXY
                        Use an HTTP proxy to perform requests, examples:
                        http://hostname:8080, socks5://hostname:1080,
                        http://user:pass@hostname:8080
  -V, --version         Print out the current version of WafW00f and exit.
  -H HEADERS, --headers=HEADERS
                        Pass custom headers via a text file to overwrite the
                        default header set.
  -T TIMEOUT, --timeout=TIMEOUT
                        Set the timeout for the requests.
  --no-colors           Disable ANSI colors in output.
```
