Overview
The WAF Detector identifies whether a target website is protected by a Web Application Firewall (WAF) and attempts to determine which WAF product is in use. It can detect 98 different WAF products and attempts to find the origin IP address to bypass the WAF. The WAF Detector is a discovery tool: it identifies protection mechanisms but does not test for vulnerabilities. It does not add data to your Attack Surface or generate findings.Parameters
How it works
The tool uses a multi-stage approach to detect WAF presence:1
Heuristic attack
Sends a request containing a combined payload that simulates multiple attack types (XSS, SQLi, directory traversal, RCE, XXE). This is designed to trigger WAF responses.
2
Response analysis
Analyzes the response using pattern matching against 98 known WAF signatures. Checks HTTP headers, response body, and status codes.
3
Generic detection
If no specific WAF is identified, performs additional tests to detect WAF behavior:
- Removes User-Agent header and compares responses
- Sends individual attack vectors (XSS, SQLi, directory traversal)
- Checks for Server header changes after attacks
4
Origin IP search
If a WAF is detected, attempts to find the origin IP address that bypasses the WAF protection.
Detection methods
The tool analyzes multiple signals to identify WAF presence:Supported WAFs
The tool can identify 98 WAF products, including Cloudflare, AWS WAF, Akamai Kona, Imperva Incapsula, F5 BIG-IP ASM, Fortinet FortiWeb, Barracuda, Sucuri, ModSecurity, and Wordfence.Detection is based on identYwaf signatures.
Origin IP discovery
When a WAF is detected, the tool attempts to find the origin IP address, which may be accessible directly without WAF protection:
Each discovered IP is validated by:
- Requesting the page with the original Host header
- Comparing the response’s HTML structure similarity (must be ≥90%)
- Running WAF detection again to confirm bypass