GO KALI FREE

wafw00f

Web Application

Beginnerlow risk

wafw00f identifies and fingerprints Web Application Firewalls (WAFs) protecting a website. It works by sending standard HTTP requests and analyzing responses to detect passive or active firewall signatures across over 100 different WAF products.

Installation

sudo apt install wafw00f

Basic Syntax

wafw00f <url>

Quick Facts

Full Name
wafw00f (Web Application Firewall Detector)
License
BSD
Written In
Python
Platforms
Linux, macOS, Windows
Category
WAF Detection
Detection Methods
Passive + Active fingerprinting
First Release
2013
Author
Enable Security

Tool Overview

wafw00f is a specialized web application firewall detection tool that identifies whether a website is protected by a WAF and which specific product is in use. It sends various HTTP requests and analyzes response headers, cookies, status codes, and content patterns to fingerprint the WAF.

Developed by Enable Security, wafw00f supports detection of over 100 WAF products including cloud-based services like Cloudflare and AWS WAF, as well as on-premise solutions like ModSecurity and F5 BIG-IP ASM.

Security professionals use wafw00f during the reconnaissance phase of penetration tests to understand target defenses before developing bypass strategies. Identifying the WAF type helps select appropriate evasion techniques for SQL injection, XSS, and other attack payloads.

Common Commands

wafw00f example.comDetect the WAF protecting a single target site
wafw00f https://example.comScan an explicit HTTPS URL for a web application firewall
wafw00f https://example.com https://target.example.comFingerprint the WAF on several URLs in one run
wafw00f -a example.comFind all matching WAFs instead of stopping at the first hit
wafw00f -v example.comEnable verbose output to see the detection steps
wafw00f -vv example.comIncrease verbosity further for detailed request/response info
wafw00f -lList every WAF product wafw00f is able to detect
wafw00f -t Cloudflare example.comTest only for one specific WAF product
wafw00f -r example.comDo not follow 3xx redirects during detection
wafw00f -o results.json example.comWrite output to a file, format inferred from the .json extension
wafw00f -o results.csv example.comSave detection results to a CSV file
wafw00f -o - -f json example.comPrint JSON output to stdout
wafw00f -f csv -o out.csv example.comForce CSV output format regardless of file extension
wafw00f -i target.txtRead a list of target URLs from an input file
wafw00f -i targets.csv -o results.jsonRead targets from a CSV file and export findings as JSON

Step-by-Step Guide

  1. 1Run wafw00f against target
  2. 2Note detected WAF type
  3. 3Research WAF bypass techniques
  4. 4Adjust attack payloads accordingly

Warnings

Use Cases

WAF Identification

Detect whether a website is protected by a web application firewall.

WAF Fingerprinting

Identify the specific WAF product and version from over 100 supported signatures.

Bypass Planning

Determine appropriate bypass techniques based on detected WAF product.

Security Assessment

Include WAF detection in the reconnaissance phase of penetration testing.

Competitive Analysis

Identify WAF technologies used by competitors or target organizations.

WAF Configuration Audit

Verify your own WAF is properly configured and detectable from external perspective.

Related Tools

Nuclei

Vulnerability Analysis

Fast and customizable vulnerability scanner based on YAML templates.

Nikto

Web Application

Web server scanner that tests for dangerous files, outdated software, and misconfigurations.

SQLMap

Web Application

Automated SQL injection and database takeover tool.

WhatWeb

Information Gathering

Website fingerprinter that identifies technologies, CMS, and frameworks.

Masscan

Information Gathering

The fastest Internet port scanner for large-scale network discovery.

Frequently Asked Questions

What is wafw00f used for?

wafw00f identifies and fingerprints web application firewalls protecting a website. It sends specially crafted HTTP requests and analyzes responses to determine if a WAF is present and which product is being used.

How many WAFs can wafw00f detect?

wafw00f can detect over 100 different WAF products and services, including Cloudflare, ModSecurity, AWS WAF, Akamai, F5 BIG-IP, Imperva, Sucuri, and many others.

Is wafw00f detection safe?

Yes, wafw00f primarily sends normal HTTP requests and analyzes response patterns. Active mode sends slightly more aggressive probes, but generally does not cause damage or trigger alerts.

Why would I need to detect a WAF?

Knowing the WAF product helps penetration testers plan bypass strategies, understand what filtering rules may be in place, and select appropriate evasion techniques for further testing.

How does wafw00f detect WAFs?

wafw00f detects WAFs by sending HTTP requests and analyzing response headers, cookies, status codes, and content patterns for known WAF signatures and behavioral patterns.

What are common WAF bypass techniques after detection?

Common bypass techniques include payload encoding, HTTP parameter pollution, request fragmentation, using HTTP/2 features, and exploiting WAF-specific vulnerabilities.

How many WAF products does wafw00f support?

wafw00f supports detection of over 100 WAF products including Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, F5 BIG-IP, and many others.

Can wafw00f detect multiple WAFs on the same site?

Yes, wafw00f can detect layered WAF deployments where multiple security products protect the same application, though detection accuracy may vary with complex configurations.

How does wafw00f integrate with other security tools?

wafw00f output can be used to inform payload selection in tools like SQLMap and XSSer, helping choose bypass techniques appropriate for the detected WAF product.

Is wafw00f detection passive or active?

wafw00f uses both passive and active detection methods. Passive mode analyzes normal HTTP responses, while active mode sends crafted requests to trigger WAF responses for identification.

How do I run wafw00f in verbose mode?

Use the -v flag for verbose output: wafw00f -v http://target.com. Verbose mode shows detailed matching information including which signatures matched and why, helping understand detection methodology.

Can wafw00f scan behind a proxy?

Yes, use the -p flag to route detection through a proxy: wafw00f http://target.com -p http://127.0.0.1:8080. This allows scanning through corporate proxies or anonymizing your scan origin.

How do I list all supported WAF products?

Use the -l flag to list all 100+ supported WAF products: wafw00f -l. This displays each supported product name and its detection signature for reference.

Can wafw00f detect Cloudflare WAF?

Yes, wafw00f detects Cloudflare through the CF-Ray header, __cfduid cookie, and other Cloudflare-specific response patterns. Detection includes the specific Cloudflare product tier when identifiable.

How does wafw00f handle multiple WAF layers?

wafw00f can detect multiple WAF products on the same site when different signatures match. Run multiple scans with different active flags (-a) for thorough detection of layered WAF deployments.

Can wafw00f detect AWS WAF?

Yes, wafw00f detects AWS WAF through characteristic response headers and behavior patterns. Detection identifies the AWS WAF product, helping plan bypass strategies for AWS-hosted targets.

How do I use wafw00f output in reports?

wafw00f outputs results in human-readable format by default. For automated reporting, pipe the output or use the -o flag to save to a file. Combine with other tools for comprehensive WAF assessment reports.

Can wafw00f detect ModSecurity?

Yes, wafw00f detects ModSecurity through the Server header and ModSecurity-specific response behavior. Detection includes identifying the ModSecurity core rule set (CRS) when signatures are present.

How do I set a custom timeout for wafw00f?

Use the --timeout flag: wafw00f http://target.com --timeout=30. This sets the HTTP request timeout in seconds. Increase for slow networks or targets with high latency.

Tags

#web-application#waf-detection#fingerprinting#reconnaissance

Output Explanation

Shows detected WAF product name and version if identifiable.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.