Scanners
Identify which WAF protects a target URL
Fingerprint the WAF in front of a site before active scanning.
overview
What wafw00f does
Run wafw00f before fuzzing or nuclei so the pipeline knows which firewall product sits in front of the host. It sends crafted probes and matches headers, cookies, and block-page tells against a signature library.
--findall keeps testing past the first match for stacked WAFs. --test checks one named product. --format forces csv, json, or text, and --input-file batch-reads URL lists.
Trickest runs wafw00f as a managed scanner node that takes URLs or an input file and emits a file plus a results folder. Pair with whatwaf for bypass suggestions, or nomore403 after you know the product.
use cases
Where wafw00f fits
Fingerprint the WAF before scanning
Identify the firewall in front of a target so later fuzzing and scanning can be tuned to the defense it faces.
Detect stacked or chained WAFs
Use --findall so wafw00f keeps testing past the first signature match and reports every WAF layered in front of the site.
Confirm a specific product
Narrow a run with --test to check for one named WAF when you only need to verify a suspicion rather than enumerate.
Fingerprint a list of targets
Feed --input-file of URLs in CSV, JSON, or text so a whole estate gets WAF-tagged in a single node for branching downstream.
reference
wafw00f inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | Specify target url(s) url1 [url2 [url3 ... ]]. |
| input-file | FILE | --input-file | Read targets from a file (csv, json, or text; a url column is required). |
| test | STRING | --test | Test for one specific WAF. |
| findall | BOOLEAN | --findall | Find all matching WAFs; do not stop on the first one. |
| format | STRING | --format | Force output format to csv, json, or text. |
| proxy | STRING | --proxy | Use an HTTP or SOCKS proxy for requests. |
| headers | FILE | --headers | Pass custom headers via a text file to overwrite the default set. |
| noredirect | BOOLEAN | --noredirect | Do not follow redirections given by 3xx responses. |
Showing key inputs. wafw00f exposes 11 inputs in total.
Full flag reference (11 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | Specify target url(s) url1 [url2 [url3 ... ]] |
| list | BOOLEAN | --list | List all WAFs that WAFW00F is able to detect |
| test | STRING | --test | Test for one specific WAF |
| proxy | STRING | --proxy | Use an HTTP proxy to perform requests, examples: http://hostname:8080, socks5://hostname:1080, http://user:pass@hostname:8080 |
| format | STRING | --format | Force output format to csv, json or text. |
| findall | BOOLEAN | --findall | Find all WAFs which match the signatures, do not stop testing on the first one |
| headers | FILE | --headers | Pass custom headers via a text file to overwrite the default header set. |
| verbose | BOOLEAN | --verbose | Enable verbosity |
| no-colors | BOOLEAN | --no-colors | Disable ANSI colors in output. |
| input-file | FILE | --input-file | Read targets from a file. Input format can be csv, json or text. For csv and json, a `url` column name or element is required. |
| noredirect | BOOLEAN | --noredirect | Do not follow redirections given by 3xx responses |
example
Run wafw00f
# fingerprint WAFs on a URL list, keep every match, JSON outwafw00f --input-file urls.txt --findall --format json --noredirect[+] The site https://www.example.com is behind Cloudflare (Cloudflare Inc.)[+] The site https://app.example.com is behind AWS Elastic Load Balancer (Amazon)[+] The site https://api.example.com is behind ModSecurity (OWASP ModSecurity)[*] Number of requests: 42[*] Finding all matches enabled; continuing past first hit[*] Output written (json)guidance
Choosing wafw00f
Use wafw00f before active testing to learn which WAF protects a target so payloads and rate limits can be tuned. It fingerprints the firewall; it does not bypass it. Pair with nomore403 or bypass-403 when a block still needs evasion.
whatwaf
WAF detector that also suggests bypasses. wafw00f stays focused on identification with a broader signature set.
nomore403
Attempts to bypass 403 and WAF blocks. Run it after wafw00f names the firewall.
whatweb
Fingerprints web technologies broadly. wafw00f targets the WAF layer only.
faq
wafw00f questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run wafw00f yourself
A URL feeds wafw00f, which probes the site, matches the response against its signature library, and writes the detected WAF as a queryable output.
Facts on this page come from the live Trickest tool library.