waf-detect

What this skill does

Detects whether a WAF (Web Application Firewall) is present in front of a target URL using the wafw00f tool or manual curl fingerprinting, and identifies the specific WAF product — Cloudflare, AWS WAF, Akamai, F5 BIG-IP, and others.

When to use

• Before formulating a WAF bypass strategy during the initial reconnaissance phase of a pentest or bug bounty engagement
• When verifying that your own service's WAF is functioning correctly
• When suspecting a WAF as the cause of false positives or false negatives from a scanner

Prerequisites

• Python 3 and pip required (for wafw00f installation)
• curl required (manual fallback method)
• HTTP/HTTPS access to the target URL

Inputs

Variable	Description	Example
TARGET_URL	Target URL to test	https://example.com

Workflow

Step 1: Install wafw00f (if not installed)

# Check for wafw00f and install if missing
if ! command -v wafw00f &>/dev/null; then
  echo "wafw00f not found. Installing..."
  pip install wafw00f --quiet
else
  echo "wafw00f already installed: $(wafw00f --version 2>&1 | head -1)"
fi

Step 2: Detect WAF with wafw00f

TARGET_URL="https://example.com"

echo "=== wafw00f WAF detection ==="
wafw00f "$TARGET_URL" -a 2>&1
# -a : output all WAF candidates

Step 3: Manual fingerprinting when wafw00f is unavailable

echo ""
echo "=== Manual WAF fingerprinting (curl) ==="

# 1) Collect baseline headers with a normal request
echo "--- Normal request ---"
NORMAL=$(curl -s -I "$TARGET_URL" --max-time 10 2>&1)
echo "$NORMAL" | grep -iE "server:|x-powered-by:|cf-ray:|x-amz|x-cache|x-cdn|via:|x-sucuri|x-fw-|x-waf"

# 2) Send a malicious payload to trigger WAF response
echo ""
echo "--- Payload request (checking WAF reaction) ---"
ATTACK=$(curl -s -o /dev/null -w "%{http_code}" \
  "$TARGET_URL/?q=<script>alert(1)</script>" \
  --max-time 10 2>&1)
echo "XSS payload HTTP status: $ATTACK"

SQLI=$(curl -s -o /dev/null -w "%{http_code}" \
  "$TARGET_URL/?id=1'+OR+'1'='1" \
  --max-time 10 2>&1)
echo "SQLi payload HTTP status: $SQLI"

HEADERS_ATTACK=$(curl -s -I \
  "$TARGET_URL/?q=<script>alert(1)</script>" \
  --max-time 10 2>&1)
echo ""
echo "--- Payload request response headers ---"
echo "$HEADERS_ATTACK" | grep -iE "server:|cf-ray:|x-amz|x-cache|x-sucuri|x-iinfo:|x-check-cacheable:|x-fw-|set-cookie:"