Unwaf

Unwaf is a Go tool designed to help identify WAF bypasses using passive techniques. It automates the process of discovering the real origin IP behind a WAF/CDN by combining multiple discovery methods and verifying candidates through HTML similarity comparison, SSL certificate fingerprinting, and HTTP header analysis.

Unwaf is automating the steps I explained on this LinkedIn Post: Passive WAF bypassing

Current version: 3.0.0 — See CHANGELOG.md for version history.

Table of Contents

• How It Works
• Discovery Methods
• Verification Methods
• Installation
• Usage
• Options
• Examples
• Configuration
• Author
• License

How It Works

1. Dynamic WAF CIDRs — Fetches live Cloudflare IP ranges and combines with hardcoded WAF/CDN ranges (including IPv6).
2. WAF Confirmation — Resolves the domain's current A records, checks if they fall in known WAF/CDN ranges, and fingerprints via HTTP headers.
3. Favicon Hashing — Fetches favicon.ico and generates MD5, SHA256, and MMH3 (Shodan) hashes.
4. IP Discovery — Runs all enabled methods (up to 15 sources) to collect candidate origin IPs.
5. Filtering — Discards IPs belonging to known WAF/CDN ranges and IPs that match the domain's current DNS resolution.
6. Port Scanning — Checks candidates on 8 common web ports concurrently with progress bar.
7. Origin Verification — For each web server:
   • Fetches HTML (direct IP + Host-header injection) and compares with reference
   • Compares SSL certificate fingerprints on TLS ports
   • Compares HTTP response headers
   • Calculates overall score (60% HTML + 25% cert + 15% headers ± status)
8. Neighbor Scanning (optional) — Expands confirmed bypass IPs to /24 subnets and scans neighbors.
9. ASN Lookup — Identifies ASN and organization for confirmed bypass IPs.
10. Results — Reports matches above the threshold with scores, ASN info, and curl verification commands.

Discovery Methods

Method	Type	Description
SPF records	Free	Extracts IPs from ip4:/ip6: SPF mechanisms
MX records	Free	Resolves mail server hostnames (skips Google/Microsoft/etc.)
Subdomain probing	Free	Resolves 30+ common subdomains (mail, dev, staging, cpanel, origin, etc.)
Certificate Transparency	Free	Queries crt.sh for all subdomains, resolves to non-WAF IPs
AlienVault OTX	Free	Passive DNS records (optional API key raises rate limits)
RapidDNS	Free	Subdomain enumeration via HTML scraping
HackerTarget	Free	Host search API (50 req/day)
Wayback Machine	Free	Extracts hostnames from archived URLs via CDX API
WAF detection	Free	Fingerprints the WAF vendor via HTTP headers
Favicon hashing	Free	Generates MD5, SHA256, and MMH3 hashes for Shodan/Censys search
Shodan host search	API (free tier)	Searches by SSL cert CN, hostname, and favicon hash (search requires membership)
SecurityTrails history	API (free tier)	Historical DNS A records (50 req/month free)
ViewDNS history	API (free tier)	Historical DNS A records (250 free requests)
Censys SSL search	API (paid)	Finds hosts presenting SSL certs matching the domain
DNSDB/Farsight	API (free tier)	Historical DNS records via NDJSON API (Community Edition: 500 queries/month)

Verification Methods

Method	Weight	Description
HTML similarity	60%	Diff-based text comparison with reference page
SSL certificate	25%	Serial number (50%), CN match (25%), SAN overlap (25%)
HTTP headers	15%	Server, X-Powered-By, and Set-Cookie name comparison
Status code	±5-20%	Bonus for match, penalty for success/error mismatch

Installation

go install github.com/mmarting/unwaf@latest

Usage

unwaf -h

Options

Flag	Long Flag	Description	Default
-d	--domain	The domain to check	(required unless -l)
-s	--source	Source HTML file to compare	—
-c	--config	Config file path	$HOME/.unwaf.conf
-t	--threshold	Similarity threshold percentage	60
-w	--workers	Number of concurrent workers	50
-v	--verbose	Enable verbose output	false
-q	--quiet	Silent mode: only output bypass IPs	false
	--timeout	HTTP timeout in seconds	10
	--rate-limit	Max HTTP requests per second, 0=unlimited	0
	--proxy	Proxy URL (http:// or socks5://)	—
	--scan-neighbors	Scan /24 neighbors of confirmed bypass IPs	false
	--json	Output results as JSON	false
-l	--list	File containing domains to check, one per line	—
-o	--output	Write results to file	—
	--version	Print version and exit	—
-h	--help	Display help information	—

Examples

Check a domain (free methods only, no API keys needed):

unwaf -d example.com

Both bare domains and full URLs work:

unwaf -d https://example.com/path

Check with a manually saved HTML file (useful when WAF blocks the tool):

unwaf -d example.com -s original.html

Lower the similarity threshold to catch partial matches:

unwaf -d example.com -t 40

Increase concurrency for faster scanning:

unwaf -d example.com -w 100

Verbose mode to see every resolved subdomain/IP:

unwaf -d example.com -v

Silent mode for automation — outputs only IPs, one per line:

unwaf -q -d example.com

JSON output for automation:

unwaf -d example.com --json

Batch mode with domain list:

unwaf -l domains.txt --json -o results.json

Use a proxy (Tor, Burp, etc.):

unwaf -d example.com --proxy socks5://127.0.0.1:9050

Scan /24 neighbors of bypass IPs:

unwaf -d example.com --scan-neighbors

Rate-limit requests to 2/sec with a 5s timeout:

unwaf -d example.com --rate-limit 2 --timeout 5

Piping into other tools

# Feed into nuclei
unwaf -q -d target.com | nuclei -l - -t waf-bypass.yaml

# Feed into httpx
unwaf -q -d target.com | httpx -silent

# Batch recon
cat domains.txt | while read d; do unwaf -q -d "$d" | sed "s/^/$d,/"; done > results.csv

# JSON + jq
unwaf -d target.com --json | jq '.bypasses[].ip'

Configuration

On first run, Unwaf creates $HOME/.unwaf.conf with this template:

# Unwaf config file — API keys for optional discovery methods
# Free methods (SPF, MX, crt.sh, subdomains, OTX, RapidDNS, HackerTarget, Wayback) work without any keys.

# ViewDNS.info — DNS history (250 free requests, no credit card required)
viewdns=""

# SecurityTrails — DNS history (https://securitytrails.com/corp/api)
securitytrails=""

# Censys — SSL certificate search (requires a PAID license)
censys_token=""
censys_org_id=""

# AlienVault OTX — passive DNS (optional, raises rate limits)
otx_api_key=""

# Shodan — host search by SSL cert, hostname, favicon hash
shodan_api_key=""

# DNSDB/Farsight — historical DNS records (Community Edition: 500 queries/month free)
dnsdb_api_key=""

Author

Martín Martín

• Website
• LinkedIn
• GitHub

License

Distributed under the GPL v3 License.