Fingerprint the WAF sitting in front of a target URL

wafw00f tells you which Web Application Firewall sits in front of a site. It sends crafted probes and reads how the target reacts, then matches that behavior against a library of signatures covering dozens of commercial and open-source WAFs. Knowing the product up front shapes later fuzzing and scanning, because defenses differ by vendor.

Each WAF leaves tells: headers, block-page wording, cookie names, or status patterns under attack-like probes. wafw00f triggers and reads those tells. --findall keeps testing past the first match so stacked WAFs both show up, and --test narrows a run to one product when you only need to confirm a suspicion.

Run it before active scanning so the rest of the pipeline knows what defense it faces. Emit JSON or CSV with --format so the detected WAF becomes a structured field downstream tooling can branch on. On Trickest the Scanners node takes URLs or an input file and writes a file and a folder of results.