R-WAF
wafw00f
Identifies and fingerprints which WAF, if any, is protecting a web target.
OVERVIEW
wafw00f sends a handful of normal and slightly malformed HTTP requests to a target and compares the responses (status codes, headers, cookies, block-page content) against a library of signatures for dozens of commercial and open-source WAF/CDN products, reporting which one, if any, is in front of the application.
Knowing this upfront changes how the rest of the engagement runs: it explains unexpected blocks or CAPTCHAs during later active scanning, and helps decide whether to slow down, use evasion techniques, or flag the WAF itself as part of the target's defensive posture in the report.
USE CASES
Practical use cases
- 01
Checking for a WAF before launching noisier active scans, to set expectations and pacing.
- 02
Explaining unexpected 403s or CAPTCHAs seen during later testing.
- 03
Documenting the target's defensive posture (WAF/CDN vendor) in the engagement report.
- 04
Comparing WAF presence across multiple hosts to spot inconsistently protected assets.
QUICK START
Before running noisier active scans, to know whether a WAF is in front of the target and tune tooling accordingly.
- Confirm the target URL is inside the agreed scope.
- Install wafw00f via pip or clone the GitHub repo.
- Run it against the target URL with default settings.
- If no clear match, retry with -a to enumerate all matching signatures instead of stopping at the first.
- Factor the result into pacing and technique choices for the rest of the engagement.
wafw00f https://target.example.com -aBEFORE YOU RUN IT
What to check before running it
A negative result (no WAF detected) isn't a guarantee — some WAFs are configured to fail silently or only trigger on specific attack patterns wafw00f doesn't send.
Signature-based detection can misidentify a WAF version or vendor, especially behind a CDN that layers multiple products — treat the result as a strong hint, not certainty.
Even fingerprinting requests can occasionally trip alerting on a heavily tuned WAF — confirm this step fits the agreed stealth profile before running it.