Now, whatwaf will use our custom which are stored in tampers/whitelisted

Author: clouedoc

autosqli/wafdetect_stage.py

@@ -1,11 +1,48 @@
 # Adapted to the new save system
 from autosqli import log
-from autosqli.whatwaf_interface import whatwaf_target
+from autosqli.whatwaf_interface import whatwaf_target, set_whatwaf_path
 from autosqli import save
 
+import shutil
+import tempfile
+
+WHITELISTED_TAMPERS_PATH = './tampers/whitelisted'
+
+
+def init_whatwaf():
+    """copy WhatWaf in a tmp dir with tampers in ./tampers/whitelisted/*
+    and returns WhatWaf's new path
+    """
+    log.debug("Initializing WhatWaf")
+
+    # create a temporary directory
+    tmp_dir = tempfile.mkdtemp()
+    # always have a / at the end
+    tmp_dir = tmp_dir + '/' if tmp_dir[-1] != '/' else ''
+    tmp_whatwaf_dir = tmp_dir + 'WhatWaf/'
+    log.debug("Tmp dir: {}".format(tmp_dir))
+
+    # copy ./WhatWaf to the temp directory ( without the tampers )
+    shutil.copytree('./WhatWaf', tmp_whatwaf_dir)
+    # remove the `content/tampers` dir
+    shutil.rmtree(tmp_whatwaf_dir + 'content/tampers/')
+    # copy the tampers
+    shutil.copytree(
+        WHITELISTED_TAMPERS_PATH,
+        tmp_whatwaf_dir + 'content/tampers/'
+    )
+
+    log.debug('tmp WhatWaf dir: {}'.format(tmp_whatwaf_dir))
+    return tmp_whatwaf_dir
+
 
 def wafdetect_stage(args):
-    """ add details of the targets of the save """
+    """init whatwaf with custom tampers and add details to the targets of the
+    save
+    """
+    set_whatwaf_path(
+        init_whatwaf()
+    )
 
     while True:
         target = save.getUnwaffedTarget()
@@ -16,3 +53,6 @@ def wafdetect_stage(args):
         else:
             log.debug("All targets got waffed !")
             break
+
+
+print(init_whatwaf())

autosqli/whatwaf_interface.py

@@ -6,14 +6,23 @@
 from autosqli.strings import BANNED_TAMPERS
 from autosqli.satanize import remove_thing_url
 from autosqli.execute import execute
-from autosqli.consts import WHATWAF_VERIFY_NUM, WHATWAF_DEBUG, WHATWAF_DEBUG_REPORT
+from autosqli.consts import WHATWAF_VERIFY_NUM, WHATWAF_DEBUG, \
+    WHATWAF_DEBUG_REPORT
+
+
+whatwaf_path = None
+
+
+def set_whatwaf_path(path):
+    global whatwaf_path
+    whatwaf_path = path
 
 
 def whatwaf_url(url):
     """ return WhatWaf's results for a specified url """
     log.debug("Launching WhatWaf on {}".format(url))
     return execute([
-        "python2.7", paths.WHATWAF_NAME, "-u",
+        "python2.7", whatwaf_path, "-u",
         remove_thing_url(url), "--ra", "--hide", "--json", "--verify-num",
         str(WHATWAF_VERIFY_NUM)
     ], paths.WHATWAF_PATH, None, True)