EnableSecurity / wafw00f

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
https://www.enablesecurity.com/
BSD 3-Clause "New" or "Revised" License
5.27k stars 933 forks source link

[BUG] AttributeError: 'NoneType' object has no attribute 'headers' #147

Closed edoardottt closed 2 years ago

edoardottt commented 2 years ago

Describe the bug
The wafw00f execution interrupts giving me back a stack trace (below).

ERROR:wafw00f:Something went wrong HTTPConnectionPool(host='**********', port=80): Read timed out. (read timeout=7)
[+] Generic Detection results:
Traceback (most recent call last):
  File "/usr/local/bin/wafw00f", line 4, in <module>
    __import__('pkg_resources').run_script('wafw00f==2.1.0', 'wafw00f')
  File "/home/edoardottt/.local/lib/python3.9/site-packages/pkg_resources/__init__.py", line 651, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/home/edoardottt/.local/lib/python3.9/site-packages/pkg_resources/__init__.py", line 1448, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/EGG-INFO/scripts/wafw00f", line 8, in <module>
    main.main()
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/wafw00f/main.py", line 451, in main
    if attacker.genericdetect():
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/wafw00f/main.py", line 146, in genericdetect
    if 'server' in response.headers:
AttributeError: 'NoneType' object has no attribute 'headers'

To Reproduce
wafw00f --input-file <file> -o waf.txt
I cannot insert valid steps to reproduce this behavior because it depends on the server.

0xInfection commented 2 years ago

Hey @edoardottt, thanks for pulling this issue up. Can you provide a target so that the issue can be reproduced? Also can you provide some info on how you installed wafw00f?

edoardottt commented 2 years ago

I have installed it with pip install wafw00f.

For the target it's a bit weird, that issue came up with http://twiccrl-twic.tsa.dhs.gov/, but sometimes it works well.
Anyway my changes are not something disruptive :)

[*] Checking http://twiccrl-twic.tsa.dhs.gov/
ERROR:wafw00f:Something went wrong HTTPConnectionPool(host='twiccrl-twic.tsa.dhs.gov', port=80): Read timed out. (read timeout=7)
[+] Generic Detection results:
Traceback (most recent call last):
  File "/usr/local/bin/wafw00f", line 4, in <module>
    __import__('pkg_resources').run_script('wafw00f==2.1.0', 'wafw00f')
  File "/home/edoardottt/.local/lib/python3.9/site-packages/pkg_resources/__init__.py", line 651, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/home/edoardottt/.local/lib/python3.9/site-packages/pkg_resources/__init__.py", line 1448, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/EGG-INFO/scripts/wafw00f", line 8, in <module>
    main.main()
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/wafw00f/main.py", line 451, in main
    if attacker.genericdetect():
  File "/usr/local/lib/python3.9/dist-packages/wafw00f-2.1.0-py3.9.egg/wafw00f/main.py", line 146, in genericdetect
    if 'server' in response.headers:
AttributeError: 'NoneType' object has no attribute 'headers'