# WAES | Web Auto Enum & Scanner and Dumps Files as Result

**URL:** <https://onehack.st/t/waes-web-auto-enum-scanner-and-dumps-files-as-result/205684>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking\
**Created:** [November 1, 2021, 7:15am UTC](https://onehack.st/t/waes-web-auto-enum-scanner-and-dumps-files-as-result/205684 "2021-11-01T07:15:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hannah](https://onehack.st/user_avatar/onehack.st/hannah/32/174875_2.png) [@Hannah](https://onehack.st/u/Hannah)\
**Post date:** [November 1, 2021, 7:15am UTC](https://onehack.st/t/waes-web-auto-enum-scanner-and-dumps-files-as-result/205684/1 "2021-11-01T07:15:08Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/f/cf4eb3949940af7c0a763b167fe2223894472dc6.png)

## CPH:SEC WAES at a Glance

Doing HTB or other CTFs enumeration against targets with HTTP(S) can become trivial. It can get tiresome to always run the same script/tests on every box eg. nmap, nikto, dirb and so on. A one-click on target with automatic reports coming solves the issue. Furthermore, with a script the enum process can be optimized while saving time for hacker. This is what **CPH:SEC WAES** or _Web Auto Enum & Scanner_ is created for. WAES runs 4 steps of scanning against target (see more below) to optimize the time spend scanning. While multi core or multi-threaded scanning could be implemented it will almost surely get boxes to hang and so is undesirable.

- From current version and forward WAES will include an install script (see blow) as project moves from alpha to beta phase.
- WAES could have been developed in python but good bash projects are need to learn bash.
- WAES is currently made for CTF boxes but is moving towards online uses (see todo section)

## To install:

```auto
1. $> git clone https://github.com/Shiva108/WAES.git
2. $> cd WAES
2. $> sudo ./install.sh

```

Make sure directories are set correctly in supergobuster.sh. Should be automatic with Kali & Parrot Linux.

- Standard directories for lists : SecLists/Discovery/Web-Content & SecLists/Discovery/Web-Content/CMS
- Kali / Parrot directory list : /usr/share/wordlists/dirbuster/

## To run WAES

Web Auto Enum & Scanner - Auto enums website(s) and dumps files as result.

##############################################################################

```auto
    Web Auto Enum & Scanner

    Auto enums website(s) and dumps files as result

```

##############################################################################

Usage: waes.sh -u {IP} waes.sh -h

```auto
   -h shows this help
   -u IP to test eg. 10.10.10.123
   -p port nummer (default=80)

   Example: ./waes.sh -u 10.10.10.130 -p 8080

```

## Enumeration Process / Method

WAES runs ..

Step 0 - Passive scan - (disabled in the current version)

- whatweb - aggressive mode
- OSIRA (same author) - looks for subdomains

Step 1 - Fast scan

- wafw00 - firewall detection
- nmap with http-enum

Step 2 - Scan - in-depth

- nmap - with NSE scripts: http-date,http-title,http-server-header,http-headers,http-enum,http-devframework,http-dombased-xss,http-stored-xss,http-xssed,http-cookie-flags,http-errors,http-grep,http-traceroute
- nmap with vulscan (CVSS 5.0+)
- nikto - with evasion A and all CGI dirs
- uniscan - all tests except stress test (qweds)

Step 3 - Fuzzing

- super gobuster
  - gobuster with multiple lists
  - dirb with multiple lists

- xss scan (to come)

.. against target while dumping results files in report/ folder.

## To Do

- Implement domain as input
- Add XSS scan
- Add SSL/TLS scanning
- Add domain scans
- Add golismero
- Add dirble
- Add progressbar
- Add CMS detection
- Add CMS specific scans

## GitHub:

> **[GitHub - Shiva108/WAES: CPH:SEC WAES: Web Auto Enum & Scanner - Auto enums...](https://github.com/Shiva108/WAES)**
>
> CPH:SEC WAES: Web Auto Enum & Scanner - Auto enums website(s) and dumps files as result