Recon
Identify the WAF in front of a URL
Fingerprint web application firewalls and test tamper bypasses.
overview
What whatwaf does
whatwaf sends crafted payloads at a URL, matches responses to firewall signatures, then can evaluate tamper scripts that may evade the block. Reach for it when you need the product name before heavier scanning.
Operator knobs: --url for one host, --list plus --threads for estates, --skip to stop after identification, --json or --csv for structured results, and --ra for a random user-agent.
Trickest runs whatwaf as a managed recon step that takes a URL or list and writes a file and a folder. Pair with wafw00f for a second fingerprint, then tune scanners to the defense you found.
source github.com/Ekultek/WhatWaf
use cases
Where whatwaf fits
Identify the WAF before active scanning
Run --url against a target so later fuzzing and nuclei templates account for the firewall product.
Fingerprint only, skip bypass tests
Pass --skip when you need the vendor name without spending time on tamper-script evaluation.
Batch-check a URL list
Feed --list of hosts and raise --threads so an estate gets WAF-tagged in one pass.
Capture JSON for workflow branching
Enable --json so downstream nodes can route differently when Cloudflare, ModSecurity, or no WAF is present.
reference
whatwaf inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Single URL to detect protection on. |
| list | FILE | --list | File of URLs, one per line, to detect protection on. |
| skip | BOOLEAN | --skip | Identify the firewall without checking bypasses. |
| json | BOOLEAN | --json | Write output to a JSON file. |
| threads | STRING | --threads | Number of parallel request threads (default 1). |
| determine-webserver | BOOLEAN | --determine-webserver | Attempt to identify the backend web server. |
| fingerprint | BOOLEAN | --fingerprint | Save all fingerprints for further investigation. |
| random-user-agent | BOOLEAN | --ra | Use a random user-agent for HTTP requests. |
Showing key inputs. whatwaf exposes 30 inputs in total.
Full flag reference (30 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| csv | BOOLEAN | --csv | Send the output to a CSV file |
| url | STRING | --url | Pass a single URL to detect the protection |
| burp | FILE | --burp | Pass a Burp Suite request file to perform WAF evaluation |
| data | STRING | --data | Send this data with the POST request (*default=random) |
| hide | BOOLEAN | --hide | Hide the banner during the run |
| json | BOOLEAN | --json | Send the output to a JSON file |
| list | FILE | --list | Pass a file containing URL's (one per line) to detect the protection |
| post | BOOLEAN | --post | Send a POST request (*default=GET) |
| skip | BOOLEAN | --skip | Skip checking for bypasses and just identify the firewall |
| test | BOOLEAN | --test | Test the connection to the website before starting (*default=True) |
| yaml | BOOLEAN | --yaml | Send the output to a YAML file |
| proxy | STRING | --proxy | Provide a proxy to run behind in the format type://address:port (IE socks5://10.54.127.4:1080) (*default=None) |
| encode | STRING | --encode | Encode a provided payload using provided tamper script(s) you are able to payy multiple tamper script load paths to this argument and the payload will be tampered as requested |
| googler | FILE | --googler | Pass a JSON file from the Googler CMD line tool (IE googler -n 100 --json >> googler.json) |
| headers | STRING | --headers | Add your own custom headers to the request. To use multiple separate headers by comma. Your headers need to be exact(IE: Set-Cookie=a345ddsswe,X-Forwarded-For:127.0.0.1) (*default=None) |
| threads | STRING | --threads | Send requests in parallel (specify number of threads (*default=1) |
| timeout | STRING | --timeout | Control the timeout time of the requests (*default=15) |
| verbose | BOOLEAN | --verbose | Run in verbose mode (more output) |
| payloads | STRING | --payloads | Provide your own payloads separated by a comma IE AND 1=1,AND 2=2 |
| throttle | STRING | --throttle | Provide a sleep time per request (*default=0) |
| force-ssl | BOOLEAN | --force-ssl | Force the assignment of HTTPS instead of HTTP while processing (*default=HTTP unless otherwise specified by URL) |
| force-file | BOOLEAN | --force-file | Force the creation of a file even if there is no protection identified |
| tamper-int | STRING | --tamper-int | Control the amount of tampers that are displayed (*default=5) |
| user-agent | STRING | --pa | Provide your own personal agent to use it for the HTTP requests |
| verify-num | STRING | --verify-num | Change the request amount to verify if there really is not a WAF present(*default=5) |
| encode-list | STRING | --encode-list | Encode a file containing payloads (one per line) by passing the path and load path, files can only encoded using a single tamper script load path |
| fingerprint | BOOLEAN | --fingerprint | Save all fingerprints for further investigation |
| payload-list | FILE | --pl | Provide a file containing a list of payloads 1 per line |
| random-user-agent | BOOLEAN | --ra | Use a random user-agent for the HTTP requests (*default=whatwaf/2.1.6.3 (Language=3.10.12; Platform=Linux)) |
| determine-webserver | BOOLEAN | --determine-webserver | Attempt to determine what web server is running on the backend (IE Apache, Nginx, etc.. *default=False) |
example
Run whatwaf
# identify WAF only (no bypass attempts), JSON outwhatwaf --url https://example.com --skip --json --ra[~] checking https://example.com[+] detected: Cloudflare[~] checking https://api.example.com[+] detected: AWS WAF[~] checking https://www.example.com[+] detected: ModSecurity[~] checking https://staging.example.com[*] no WAF detected[~] checking https://198.51.100.55[+] detected: Impervaguidance
Choosing whatwaf
Run whatwaf before scanning to learn whether a WAF guards the target and which tampers to try. It detects and suggests bypasses; it does not exploit. Pair with wafw00f for a second detection opinion, and with a scanner for the actual testing.
wafw00f
Focused WAF fingerprinter. Strong at identification; whatwaf adds tamper-bypass suggestions.
nuclei
Template scanner that can include WAF-detection templates as part of a broader run.
whatweb
Identifies web technologies broadly, including some firewall signals, rather than focusing on WAF bypass.
faq
whatwaf questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run whatwaf yourself
A URL feeds WhatWaf, which fingerprints the firewall in the path before nuclei scans the host and writes findings as a queryable output.
Facts on this page come from the live Trickest tool library.