Feature Request: Add Authentication Header Support

[GangGreenTemperTatum]

Summary

Add support for custom HTTP headers (particularly authentication headers) to enable testing of authenticated
endpoints during WAF bypass fuzzing.

Problem

Currently, Wafer only supports testing unauthenticated endpoints since there's no way to include authentication
headers like Authorization: Bearer <token> or custom session headers. This limits its effectiveness for
real-world penetration testing where most sensitive endpoints require authentication.

Proposed Solution

Add command-line options to specify custom headers:

python3 wafer.py --url "https://api.example.com/search" --param "q" --header "Authorization: Bearer eyJ..."
--header "X-API-Key: abc123"

Implementation Suggestions

• CLI Arguments

args.add_argument("--header", help="Custom header (format: 'Name: Value')",
                 action="append", dest="headers", default=[])

• Chrome WebDriver Integration

Modify the Selenium setup to include custom headers via CDP (Chrome DevTools Protocol):

def set_headers(self, headers):
    header_dict = {}
    for header in headers:
        name, value = header.split(': ', 1)
        header_dict[name] = value

    self.driver.execute_cdp_cmd('Network.setUserAgentOverride', {
        "userAgent": self.driver.execute_script("return navigator.userAgent;")
    })
    self.driver.execute_cdp_cmd('Network.enable', {})
    self.driver.execute_cdp_cmd('Network.setRequestInterception', {"patterns": [{"urlPattern": "*"}]})
    # Add headers to all requests

Alternative Implementation

Cookie-based authentication support:

python3 wafer.py --url "https://app.example.com/search" --param "q" --cookie "session_id=abc123"

Use Cases

• Testing authenticated API endpoints
• Bypassing WAFs on admin panels
• Testing applications with API key authentication
• Session-based authentication testing

Benefits

• Enables testing of realistic attack scenarios
• Increases tool utility for professional penetration testing
• Maintains current functionality while adding auth support
• Simple CLI interface consistent with existing design

Additional Considerations

• Support for multiple authentication methods (Bearer tokens, API keys, cookies)
• Header validation to prevent malformed requests
• Documentation updates with authentication examples
• Backward compatibility with existing usage patter