WAFW00F Guide: Web Application Firewall Detection
Learn WAFW00F for detecting web application firewalls, identifying WAF types and vendors, and understanding how to adjust testing techniques accordingly.
Why You Need WAFW00F
You hit a target that blocks your probes — is a WAF in the way? WAFW00F detects whether a website is protected by a web application firewall and identifies the specific product (Cloudflare, ModSecurity, Akamai, etc.). Knowing the WAF lets you choose appropriate bypass techniques before continuing your assessment.
Prerequisites
How WAFW00F Works
WAFW00F uses multiple detection techniques:
Signature Matching: Compares response headers, cookies, and content against known WAF patterns.
Request Probing: Sends malicious-looking payloads (SQL injection, XSS) and analyzes responses.
Header Analysis: Examines server headers for WAF-specific fields.
Error Message Analysis: Analyzes error pages for WAF branding.
Cookie Analysis: Checks for WAF-specific cookie names and values.
Installation
# Already installed on Kali
sudo apt install wafw00f
# Using pip
pip install wafw00f
Basic Usage
Simple WAF Detection
wafw00f http://target.com
Key Options
| Option | Description |
|--------|-------------|
| -a | Check all WAF products |
| -l | List all detected WAFs |
| -o FILE | Output file |
| -v | Verbose output |
| -i FILE | Input file with URLs |
Practical Examples
Basic Scan
wafw00f http://example.com
Scan All WAFs
wafw00f http://target.com -a
Verbose Detection
wafw00f http://target.com -v
Scan Multiple Sites
wafw00f -i sites.txt -o results.txt
Understanding Output
[*] Checking http://target.com
[+] The site http://target.com is behind Cloudflare (Cloudflare Inc.)
[+] Number of requests: 12
Common WAF products detected: Cloudflare, ModSecurity, AWS WAF, Akamai, F5 BIG-IP, Barracuda, Sucuri, Imperva, and many more.
WAF Bypass Considerations
Once a WAF is identified, testers can research specific bypass techniques:
Cloudflare: IP address origin disclosure, HTTP methods, encoding tricks.
ModSecurity: Rule bypass via encoding variations, comment injection.
AWS WAF: Size limits, header manipulation, content-type variations.
F5 BIG-IP: URL encoding, parameter pollution, HTTP method override.
Real-World Example: Pre-Assessment WAF Check
# Step 1: Check if target has a WAF
wafw00f http://target.com -v
# Step 2: If WAF detected, identify the product
wafw00f http://target.com -a
# Step 3: Use results to inform testing strategy
# - Certain payloads may need encoding
# - Rate limiting may be active
# - Specific headers may be filtered
Common Mistakes
Assuming No WAF Means No Protection
Some WAFs are configured passively or may not respond to WAFW00F's probes.
Relying Only on WAF Detection
A WAF is only one layer of defense. Test for the actual vulnerabilities regardless.
Not Testing Different Endpoints
WAF rules may apply differently to different paths or methods.
Best Practices
Always check before testing: Knowing the WAF informs your payload selection and testing approach.
Use -a for thorough detection: Some WAFs are only detected with the full scan.
Test multiple endpoints: WAF rules may vary across different paths.
Research WAF-specific bypasses: Each WAF has known bypass techniques.
Document findings: Include WAF information in assessment reports.
Related Tools
Related Articles
Summary
WAFW00F identifies web application firewalls protecting websites. It uses multiple detection techniques including signature matching, payload probing, and header analysis. Knowing which WAF is in use helps testers choose appropriate bypass techniques and understand the security controls in place. Always check for WAFs before conducting web application security testing.