Tool: WAF detection for your whole subdomain list in about a minute

I do a lot of recon across large host lists, and WAF detection was always the slow step: wafw00f is the reference tool, but it's Python and one target per process. Wafme0w ports its 172 fingerprints to a concurrent Go matcher. On 600 hosts at 100 parallel it took 22 s vs about 1.5 min, with the same named detections. It also does JSONL output, offline matching of saved responses, strict request budgets, and you can import the matcher as a Go library. You can also stack it with ProjectDiscovery's tools(like https). Benchmark script and methodology are in the repo. Feedback on the generic-detection heuristics is especially welcome. submitted by /u/Due_Criticism_2326 [link] [comments]

from hacking: security in practice https://ift.tt/yqOg1SE