WAF Detector
About this tool
Discover if a website is protected by a web application firewall (WAF).
Detecting which web application firewall is used by a website is an important step in the information gathering phase of a penetration test. A pentester may want to know which WAF is used by a website in order to adapt his attacks for a successful bypass.
A WAF or web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site scripting (XSS), directory traversal, and SQL injection, among others.
Parameters
Target URL: This is the URL of the website that will be scanned. All URLs must start with http:// or https://.
How it works
The tool tries to trigger custom responses from a Web Application Firewall by using a series of techniques.
We send a series of non-harmful requests that look like attacks. We analyze the responses and check if any of them match known WAFs.
If no match is found, we compare the contents of the HTTP responses for a benign and injected request. If things like the status code and Server header are different, there might be a WAF in play. This case warrants manual investigation.
A variation of the previous case is when the server stops responding to an injected request. It might indicate that malicious requests are dropped altogether. Again, you should investigate this manually.