loading
Loading content
loading
Scanners
Fingerprint the WAF in front of a site before active scanning.
overview
Run wafw00f before fuzzing or nuclei so the pipeline knows which firewall product sits in front of the host. It sends crafted probes and matches headers, cookies, and block-page tells against a signature library.
--findall keeps testing past the first match for stacked WAFs. --test checks one named product. --format forces csv, json, or text, and --input-file batch-reads URL lists.
Trickest runs wafw00f as a managed scanner node that takes URLs or an input file and emits a file plus a results folder. Pair with whatwaf for bypass suggestions, or nomore403 after you know the product.
use cases
Identify the firewall in front of a target so later fuzzing and scanning can be tuned to the defense it faces.
Use --findall so wafw00f keeps testing past the first signature match and reports every WAF layered in front of the site.
Narrow a run with --test to check for one named WAF when you only need to verify a suspicion rather than enumerate.
Feed --input-file of URLs in CSV, JSON, or text so a whole estate gets WAF-tagged in a single node for branching downstream.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | Specify target url(s) url1 [url2 [url3 ... ]]. |
| input-file | FILE | --input-file | Read targets from a file (csv, json, or text; a url column is required). |
| test | STRING | --test | Test for one specific WAF. |
| findall | BOOLEAN | --findall | Find all matching WAFs; do not stop on the first one. |
| format | STRING | --format | Force output format to csv, json, or text. |
| proxy | STRING | --proxy | Use an HTTP or SOCKS proxy for requests. |
| headers | FILE | --headers | Pass custom headers via a text file to overwrite the default set. |
| noredirect | BOOLEAN | --noredirect | Do not follow redirections given by 3xx responses. |
Showing key inputs. wafw00f exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | Specify target url(s) url1 [url2 [url3 ... ]] |
| list | BOOLEAN | --list | List all WAFs that WAFW00F is able to detect |
| test | STRING | --test | Test for one specific WAF |
| proxy | STRING | --proxy | Use an HTTP proxy to perform requests, examples: http://hostname:8080, socks5://hostname:1080, http://user:pass@hostname:8080 |
| format | STRING | --format | Force output format to csv, json or text. |
| findall | BOOLEAN | --findall | Find all WAFs which match the signatures, do not stop testing on the first one |
| headers | FILE | --headers | Pass custom headers via a text file to overwrite the default header set. |
| verbose | BOOLEAN | --verbose | Enable verbosity |
| no-colors | BOOLEAN | --no-colors | Disable ANSI colors in output. |
| input-file | FILE | --input-file | Read targets from a file. Input format can be csv, json or text. For csv and json, a `url` column name or element is required. |
| noredirect | BOOLEAN | --noredirect | Do not follow redirections given by 3xx responses |
example
# fingerprint WAFs on a URL list, keep every match, JSON outwafw00f --input-file urls.txt --findall --format json --noredirect[+] The site https://www.example.com is behind Cloudflare (Cloudflare Inc.)[+] The site https://app.example.com is behind AWS Elastic Load Balancer (Amazon)[+] The site https://api.example.com is behind ModSecurity (OWASP ModSecurity)[*] Number of requests: 42[*] Finding all matches enabled; continuing past first hit[*] Output written (json)guidance
Use wafw00f before active testing to learn which WAF protects a target so payloads and rate limits can be tuned. It fingerprints the firewall; it does not bypass it. Pair with nomore403 or bypass-403 when a block still needs evasion.
WAF detector that also suggests bypasses. wafw00f stays focused on identification with a broader signature set.
Attempts to bypass 403 and WAF blocks. Run it after wafw00f names the firewall.
Fingerprints web technologies broadly. wafw00f targets the WAF layer only.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A URL feeds wafw00f, which probes the site, matches the response against its signature library, and writes the detected WAF as a queryable output.
Facts on this page come from the live Trickest tool library.