W.A.D.U.H. Scanner v4.0 — Phantom Edition

WordPress Analysis & Debugging Utility Helper

AI-Augmented Offensive Security Platform for Authorized Penetration Testing

Features • What's New • Installation • Usage • AI Integration • Documentation

⚠️ Legal Disclaimer

╔═══════════════════════════════════════════════════════════════════════════╗
║                          AUTHORIZED USE ONLY                               ║
╠═══════════════════════════════════════════════════════════════════════════╣
║  This tool is designed for AUTHORIZED security testing and research.      ║
║  NEVER use this tool against systems without explicit permission.          ║
║                                                                             ║
║  Unauthorized access to computer systems is illegal under:                 ║
║  • Computer Fraud and Abuse Act (CFAA) - United States                    ║
║  • Computer Misuse Act - United Kingdom                                   ║
║  • Similar laws in virtually every country                                ║
║                                                                             ║
║  YOU are responsible for your actions. The authors assume no liability.   ║
╚═══════════════════════════════════════════════════════════════════════════╝

🔥 What Makes WADUH Terrifyingly Powerful?

WADUH v4.0 Phantom Edition isn't just another WordPress scanner — it's an AI-augmented offensive security platform that combines the power of multiple professional tools with intelligent vulnerability analysis into one unified solution.

The Fear Factor

Capability	Description
100+ Attack Vectors	From basic enumeration to advanced XXE, SSRF, deserialization, and template injection
🤖 AI-Powered Analysis	Local (Ollama) or cloud (OpenAI/Anthropic/Groq) AI correlates vulnerabilities into exploit chains
⚔️ Attack Graph Builder	Automatically maps kill chains with success probability and stealth ratings
🕵️ Adaptive Evasion	Profile-based scanning (stealth/normal/aggressive) with WAF-specific payload encoding
📜 JavaScript Analysis	Extracts hidden endpoints, detects hardcoded secrets, finds source maps, identifies DOM XSS
🌐 Subdomain Hunting	CT log enumeration, DNS brute-force, and subdomain takeover detection
🛡️ WAF Detection & Bypass	Identifies 8+ WAFs and auto-adapts payloads with 8 encoding techniques
⏸️ Session Persistence	Pause and resume scans with `--session-name` / `--resume`
Multi-Tool Integration	Exports to Metasploit, Burp Suite, ZAP, Nuclei, and SQLMap
Professional Reporting	AI-generated executive summaries, attack narratives, and remediation priorities

🆕 What's New in v4.0

🤖 AI Integration (The Game Changer)

Provider Fallback Chain: Ollama → LM Studio → OpenAI → Anthropic → Groq → Offline

Feature	Description
Vulnerability Correlation	AI identifies exploit chains across individual findings
Executive Summaries	AI generates professional pentest report narratives
Attack Narratives	Step-by-step exploitation stories from AI
WAF Bypass Suggestions	AI recommends evasion strategies for detected WAFs
Risk Contextualization	"Outdated version + exposed XMLRPC + weak users = CRITICAL"
False Positive Reduction	AI validates finding confidence levels
Data Sanitization	Strips target-identifying info before sending to cloud APIs

🏗️ Modular Architecture

Refactored from a single 5,000-line file into 8 specialized packages:

waduh/
├── waduh.py              # CLI entry point
├── core/                 # Engine, models, config, session
├── ai/                   # AI providers & analysis
├── scanners/             # Modular scanner modules
├── evasion/              # WAF bypass & payload encoding
├── exploitation/         # Attack graph builder
├── reporting/            # Report generators
├── utils/                # HTTP client, logging
└── data/                 # Fingerprints, WAF signatures

🎯 New Scanners

Scanner	Capability
JavaScript Analyzer	Endpoint extraction, secret detection, source map discovery, DOM XSS sink/source analysis
Subdomain Scanner	Certificate Transparency logs (crt.sh), DNS brute-force, CNAME takeover detection
Attack Graph Builder	Kill chain mapping, success probability calculation, Mermaid diagram generation

🔧 Fixed Detection Accuracy

Issue	v3 Behavior	v4 Fix
SSTI Detection	Checked for `'49'` in response (many false positives)	Canary-based: random `a*b` calculation, verifies result isn't naturally present
Blind SQLi	Single time check (false positives from slow servers)	3-step confirmation: baseline → delay → no-delay

🕶️ Adaptive Evasion Engine

Profile	Rate	Evasion	Use Case
`stealth`	2-7s delays	Level 4-5	Production targets, WAF evasion
`normal`	0.5-2s delays	Level 2	Standard assessments
`aggressive`	0.1-0.3s delays	Level 0	Lab environments

8 payload encoding techniques: URL, double-URL, Unicode, hex, case alternation, SQL comment injection, whitespace substitution, HTML entities — with presets for Cloudflare, ModSecurity, Sucuri, Wordfence, AWS WAF, and Imperva.

📐 Architecture Overview

flowchart TB
    subgraph Input
        CLI["waduh.py CLI (48 flags)"]
        Config[Environment Variables]
        Session[Saved Sessions]
    end

    subgraph Engine["WADUH v4.0 Engine (8 Phases)"]
        direction TB
        P1["Phase 1: Reconnaissance"]
        P2["Phase 2: Enumeration"]
        P3["Phase 3: Vulnerability Testing"]
        P4["Phase 4: Advanced Testing"]
        P5["Phase 5: AI Analysis"]
        P6["Phase 6: Attack Graph"]
        P7["Phase 7: CVSS Scoring"]
        P8["Phase 8: Reporting"]
    end

    subgraph AI["AI Engine"]
        Ollama[Ollama / LM Studio]
        Cloud[OpenAI / Anthropic / Groq]
        Analyzer[Vulnerability Correlator]
    end

    subgraph Scanners
        FP[Fingerprinting]
        WAF[WAF Detection]
        Enum[Plugin/Theme/User Enum]
        JS[JavaScript Analyzer]
        Sub[Subdomain Scanner]
        Inject[Injection Tests]
    end

    subgraph Output
        JSON[JSON Report]
        HTML[HTML Report]
        MD[Exploitation Guide]
        MSF[Metasploit RC]
        AG[Attack Graph]
        AIS[AI Executive Summary]
    end

    Input --> Engine
    P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7 --> P8
    Engine --> Scanners
    P5 --> AI
    P8 --> Output

✨ Features

🔍 Reconnaissance & Enumeration

WordPress Version Detection — 5 detection methods (meta tags, readme.html, RSS feeds, hash-based fingerprinting, asset versioning)
Plugin & Theme Enumeration — Automatic detection with WPScan API vulnerability checks
User Enumeration — Author archives, REST API users, login form analysis
REST API Analysis — Complete endpoint mapping with 100+ routes analyzed
WAF Detection — Cloudflare, Sucuri, Wordfence, ModSecurity, AWS WAF, Akamai, Imperva, F5 BIG-IP
JavaScript Analysis — Hidden endpoint extraction, hardcoded secret detection, source map discovery
Subdomain Enumeration — CT logs, DNS brute-force, takeover detection

⚡ Vulnerability Assessment

Category	Tests
Web Attacks	SQL Injection (time/error/union-based with confirmation), XSS, XXE, SSRF, SSTI (canary-based)
Authentication	Auth bypass, CSRF protection, JWT security, session management
File Security	Path traversal/LFI, file upload security, backup exposure
Config Issues	Security headers, CORS, cookies, SSL/TLS configuration
Information Disclosure	API keys, secrets, version exposure, directory listing
JavaScript	DOM XSS sinks, hardcoded credentials, exposed source maps

🤖 AI-Powered Analysis

Feature	Description
Exploit Chain Mapping	AI correlates individual findings into multi-step attack paths
Executive Summary	Professional narrative for C-level stakeholders
Risk Contextualization	AI considers WAF, hosting, WP version in risk assessment
Attack Playbook	Prioritized exploitation guide with exact commands
Remediation Priorities	Fixes ranked by effort-to-impact ratio

📊 Reporting & Integration

JSON Reports — Machine-readable output with full finding details
Markdown Exploitation Guides — Step-by-step exploitation with AI attack narratives
HTML Reports — Professional styled reports with severity visualization
Attack Graph — Mermaid diagrams showing kill chain paths
Metasploit Export — Ready-to-use .rc resource files
Nuclei Templates — YAML templates for continuous scanning
Burp Suite XML — Import findings directly into Burp
SQLMap Commands — Copy-paste SQL injection testing
Webhook Notifications — Slack, Discord, Microsoft Teams

📦 Installation

Prerequisites

Python 3.8 or higher
pip (Python package manager)
(Optional) Ollama for local AI analysis

Quick Install

# Clone the repository
git clone https://github.com/Masriyan/Waduh.git
cd Waduh

# Install required dependencies
pip install -r requirements.txt

# Verify installation
python waduh.py --help

Dependencies

Package	Purpose	Required
`requests`	HTTP requests	✅ Yes
`colorama`	Terminal colors	✅ Yes
`urllib3`	URL handling	✅ Yes
`pyyaml`	Config files	Optional
`jinja2`	HTML reports	Optional
`rich`	Progress bars	Optional

Optional: AI Setup

Local AI (Recommended for OPSEC — zero data exfiltration):

# Install Ollama
curl -fsSL https://ollama.ai/install.sh | sh

# Pull a model
ollama pull llama3:8b

# WADUH auto-detects running Ollama
python waduh.py -u http://target.com --ai-analyze

Cloud AI (More powerful, requires API key):

# Set environment variable
export WADUH_AI_KEY="your-api-key"

# Or use directly
python waduh.py -u http://target.com --ai-provider openai --ai-api-key "sk-..."

Optional: WPScan API Token

# Get free token at https://wpscan.com/api
export WPSCAN_API_TOKEN="your-token-here"

🚀 Usage

Basic Scan

# Interactive mode
python waduh.py

# Direct URL scan
python waduh.py -u https://target-wordpress.com

Full Red Team Assessment

python waduh.py -u https://target.com \
    --advanced \
    --ai-analyze \
    --ai-summary \
    --detect-waf \
    --attack-graph \
    --scan-js \
    --cvss-scoring \
    --export-html \
    -o ./reports

Stealth Scan with Local AI

python waduh.py -u https://target.com \
    --stealth \
    --ai-provider ollama \
    --ai-analyze \
    --rotate-ua \
    --proxy http://127.0.0.1:8080

JavaScript & Subdomain Analysis

python waduh.py -u https://target.com \
    --scan-js \
    --scan-subdomains \
    --scan-secrets \
    --attack-graph

Multi-Target Scanning

# Create targets.txt with one URL per line
python waduh.py --target-list targets.txt --parallel 5

Resume Interrupted Scan

# Save session
python waduh.py -u https://target.com --session-name my_pentest --advanced

# Resume later
python waduh.py --resume my_pentest

📋 Command-Line Options

Target & Profile

Option	Description
`-u, --url`	Target URL
`--target-list`	File with list of target URLs
`--parallel`	Parallel scans (default: 3)
`-d, --deep`	Deep scan mode
`--advanced`	Enable ALL advanced precision tests
`--scan-profile`	`stealth` / `normal` / `aggressive`
`--stealth`	Shortcut for stealth profile
`--evasion-level`	0-5 (default: 2)

AI Integration

Option	Description
`--ai-provider`	`auto` / `ollama` / `openai` / `anthropic` / `groq`
`--ai-model`	Specific model (e.g., `llama3:8b`, `gpt-4o-mini`)
`--ai-api-key`	API key (or set `WADUH_AI_KEY` env var)
`--ai-analyze`	Enable AI vulnerability correlation & attack chains
`--ai-summary`	Generate AI executive summary
`--no-ai`	Disable all AI features

Scanning Modules

Option	Description
`--scan-js`	JavaScript endpoint & secret analysis
`--scan-subdomains`	Subdomain enumeration (CT logs + DNS)
`--scan-secrets`	Scan for exposed API keys/secrets
`--scan-cors`	Test CORS misconfigurations
`--scan-cookies`	Analyze cookie security
`--scan-ssl`	Analyze SSL/TLS configuration
`--scan-graphql`	Test GraphQL endpoints
`--detect-waf`	Detect WAF presence
`--attack-graph`	Build attack path graph
`--enhanced-backups`	Enhanced backup fuzzing (50+ patterns)

Advanced Tests

Option	Description
`--test-xxe`	XML External Entity (XXE)
`--test-ssrf`	Server-Side Request Forgery
`--test-sqli`	Advanced SQL injection (confirmed)
`--test-ssti`	Server-Side Template Injection (canary-based)
`--test-auth`	Authentication bypass
`--test-csrf`	CSRF protection analysis
`--test-jwt`	JWT token security
`--test-deserial`	Insecure deserialization
`--test-traversal`	Path traversal / LFI
`--test-cmdi`	OS command injection
`--test-upload`	File upload analysis

Evasion & OPSEC

Option	Description
`-r, --rate-limit`	Delay between requests (default: 0.5s)
`--proxy`	HTTP/SOCKS proxy (e.g., `http://127.0.0.1:8080`)
`--rotate-ua`	Rotate User-Agent headers
`--dns-callback`	OOB testing callback URL

Export & Integration

Option	Description
`--export-html`	Professional HTML security report
`--export-metasploit`	Metasploit .rc resource file
`--export-nuclei`	Nuclei YAML templates
`--export-burp`	Burp Suite XML
`--export-sqlmap`	SQLMap commands
`--generate-pocs`	Proof-of-concept scripts
`--generate-wordlist`	Custom wordlist from site content
`--wpscan-token`	WPScan API token
`--webhook`	Webhook URL (Slack/Discord/Teams)
`--compare-with`	Compare with previous scan JSON
`--cvss-scoring`	CVSS v3.1 scoring
`--session-name`	Name scan for save/resume
`--resume`	Resume from saved session

🤖 AI Integration

How It Works

┌─────────────────────┐
│   Scan Findings     │
│  (vulns, info leaks,│
│   misconfigs, users)│
└─────────┬───────────┘
          │
          ▼
┌─────────────────────┐     ┌──────────────────┐
│  AI Provider Chain  │────▶│  Local: Ollama    │  ← Zero exfiltration
│  (auto-fallback)    │     │  Local: LM Studio │
│                     │     │  Cloud: OpenAI    │  ← Data sanitized
│                     │     │  Cloud: Anthropic │  ← before sending
│                     │     │  Cloud: Groq      │
└─────────┬───────────┘     └──────────────────┘
          │
          ▼
┌─────────────────────┐
│   AI Analysis       │
│  • Exploit chains   │
│  • Risk rating      │
│  • Executive summary│
│  • Attack narrative  │
│  • WAF bypass advice │
└─────────────────────┘

Local vs Cloud AI

Aspect	Local (Ollama)	Cloud (OpenAI/Anthropic)
Privacy	✅ Zero data exfiltration	⚠️ Data sanitized before sending
Speed	Depends on hardware	Fast (API)
Quality	Good (llama3, mistral)	Excellent (GPT-4o, Claude)
Cost	Free	Pay per token
Internet	Not required	Required
OPSEC	✅ Perfect	⚠️ IP logged by provider

Example: AI-Powered Scan

# Full AI analysis with local model
python waduh.py -u http://target.com \
    --advanced \
    --ai-provider ollama \
    --ai-analyze \
    --ai-summary \
    --attack-graph

Output includes:

AI-identified exploit chains with success probabilities
Executive summary for stakeholders
Attack narrative with step-by-step commands
Remediation priorities ranked by effort vs impact

📊 Vulnerability Severity Classification

Severity	CVSS Score	Examples
🔴 Critical	9.0 - 10.0	RCE, Confirmed SQL Injection, Exposed wp-config.php
🟠 High	7.0 - 8.9	Auth bypass, SSRF, Outdated WordPress core
🟡 Medium	4.0 - 6.9	XSS, XMLRPC enabled, Directory listing
🔵 Low	0.1 - 3.9	User enumeration, Version disclosure

📖 Documentation

USAGE.md — Detailed usage guide with 10+ real-world scenarios
ARCHITECTURE.md — v4.0 module architecture and design decisions
CHANGELOG.md — Complete version history
SECURITY.md — Security policy and responsible disclosure
CONTRIBUTING.md — Contribution guidelines

🛠️ Real-World Examples

Quick Security Audit

python waduh.py -u https://example.com --wpscan-token YOUR_TOKEN

Full Penetration Test with AI

python waduh.py -u https://target.com \
    --advanced --ai-analyze --ai-summary \
    --detect-waf --attack-graph --scan-js \
    --export-html --export-metasploit \
    --cvss-scoring -v -o ./pentest

Bug Bounty (High-Impact Focus)

python waduh.py -u https://target.com \
    --test-xxe --test-ssrf --test-sqli \
    --scan-secrets --scan-cors --scan-js \
    --ai-analyze --webhook https://hooks.slack.com/YOUR/WEBHOOK

Stealth Red Team Operation

python waduh.py -u https://target.corp \
    --stealth --rotate-ua \
    --proxy socks5://127.0.0.1:9050 \
    --ai-provider ollama --ai-analyze \
    --scan-subdomains --scan-js \
    --session-name red_team_op1

CI/CD Security Gate

python waduh.py -u https://staging.company.com \
    --advanced --cvss-scoring -q \
    --webhook https://slack.webhook/staging-alerts

🔄 Migration from v3

WADUH v4.0 is fully backward compatible. The original waduh_v3.py is preserved:

# v3 (still works)
python waduh_v3.py -u http://target.com --advanced

# v4 (new entry point)
python waduh.py -u http://target.com --advanced --ai-analyze

All existing v3 CLI flags work in v4. New v4 flags (AI, evasion profiles, JS analysis, subdomains, attack graph, session management) are additive.

🤝 Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

🐛 Report bugs and issues
💡 Suggest new features
🔧 Submit pull requests
📚 Improve documentation
🤖 Add AI prompt templates
🔌 Create new scanner modules

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

👤 Author

Masriyan

GitHub: @Masriyan
Repository: https://github.com/Masriyan/Waduh

🙏 Acknowledgments

WPScan Team for their vulnerability database API
Ollama for making local AI accessible
WordPress Security Community
All contributors and bug reporters

Made with 💀 for Security Researchers

Report Issues • Request Features • Documentation

⭐ Star this repo if you find it useful!

Name		Name	Last commit message	Last commit date
ai		ai
assets		assets
core		core
data		data
evasion		evasion
exploitation		exploitation
nuclei-templates		nuclei-templates
reporting		reporting
scanners		scanners
utils		utils
.gitignore		.gitignore
ARCHITECTURE.md		ARCHITECTURE.md
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
USAGE.md		USAGE.md
requirements.txt		requirements.txt
waduh.py		waduh.py
waduh_1.py - old ver use the version3.py		waduh_1.py - old ver use the version3.py
waduh_v3.py		waduh_v3.py

Latest commit

History

Folders and files

Repository files navigation