Navigation



WAFW00F – Fingerprint & Identify Web Application Firewall (WAF) Products

Last updated: May 7, 2016 | 5,633 views

WAFW00F is a Python tool to help you fingerprint and identify Web Application Firewall (WAF) products. It is an active reconnaissance tool as it actually connects to the web server, but it starts out with a normal HTTP response and escalates as necessary.

WAFW00F - Fingerprint & Identify Web Application Firewall (WAF) Products

You can override or include your own headers, it has SOCKS and HTTP proxy support and detects a whole bunch of WAF products from hosted solutions like CloudFlare and Incapsula to server side solutions like ModSecurity.

How does it work?

To do its magic, WAFW00F does the following:

  • Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions
  • If that is not successful, it sends a number of (potentially malicious) HTTP requests and uses simple logic to deduce which WAF it is
  • If that is also not successful, it analyses the responses previously returned and uses another simple algorithm to guess if a WAF or security solution is actively responding to our attacks

What does it detect?

It detects a number of WAFs. To view which WAFs it is able to detect run WAFW00F with the -l option. At the time of writing the output is as follows:

  • Anquanbao
  • Juniper WebApp Secure
  • IBM Web Application Security
  • Cisco ACE XML Gateway
  • F5 BIG-IP APM
  • 360WangZhanBao
  • ModSecurity (OWASP CRS)
  • PowerCDN
  • Safedog
  • F5 FirePass
  • DenyALL WAF
  • Trustwave ModSecurity
  • CloudFlare
  • Imperva SecureSphere
  • Incapsula WAF
  • Citrix NetScaler
  • F5 BIG-IP LTM
  • Art of Defence HyperGuard
  • Aqtronix WebKnight
  • Teros WAF
  • eEye Digital Security SecureIIS
  • BinarySec
  • IBM DataPower
  • Microsoft ISA Server
  • NetContinuum
  • NSFocus
  • ChinaCache-CDN
  • West263CDN
  • InfoGuard Airlock
  • Barracuda Application Firewall
  • F5 BIG-IP ASM
  • Profense
  • Mission Control Application Shield
  • Microsoft URLScan
  • Applicure dotDefender
  • USP Secure Entry Server
  • F5 Trafficshield

You can download here:

wafw00f-v0.9.4.zip

Or read more here.

Share64
Tweet14
Share151
Buffer
WhatsApp
Email
229 Shares
Posted in: Hacking Tools, Networking Hacking

, ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
November 1, 2019 - 110 Shares
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
October 24, 2019 - 104 Shares
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
October 7, 2019 - 147 Shares
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
September 23, 2019 - 144 Shares
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
September 7, 2019 - 194 Shares
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.
August 31, 2019 - 78 Shares


Comments are closed.