wafw00f: Detecting Web Application Firewalls Before You Test

wafw00f (Web Application Firewall Fingerprinting Tool) is a Python-based tool maintained by the EnableSecurity team that identifies whether a target website is protected by a Web Application Firewall (WAF), and if so, attempts to determine which vendor/product it is (Cloudflare, Akamai, F5 BIG-IP ASM, Imperva Incapsula, AWS WAF, ModSecurity, Sucuri, etc.). It works by sending a normal request to establish a baseline, then sending a series of crafted, potentially malicious-looking requests and analyzing differences in response codes, headers, cookies, and body content to fingerprint the WAF. Knowing what WAF protects a target early in an assessment shapes payload crafting and evasion strategy for the rest of the engagement.

2. How to Install

Pre-installed on Kali Linux. To verify or reinstall:

which wafw00f
sudo apt update
sudo apt install wafw00f -y
wafw00f --version

Install via pip (latest from PyPI):

pip install wafw00f --break-system-packages

Install from source:

git clone https://github.com/EnableSecurity/wafw00f.git
cd wafw00f
python3 setup.py install

3. Syntax

wafw00f <url> [options]

4. All Command-Line Options

5. Basic Usage (Expected Output in Bash)

$ wafw00f https://example.com

Output:

                ______
               /      \
              (  W00f! )
               \  ____/
               ,,    ,,
        wafw00f v2.2.0

[*] Checking https://example.com
[+] The site https://example.com is behind Cloudflare (Cloudflare Inc.) WAF.
[~] Number of requests: 7

6. Practical Examples with Output

Example 1 — Basic single target detection

$ wafw00f https://testphp.vulnweb.com

Output:

[*] Checking https://testphp.vulnweb.com
[-] No WAF detected by the generic detection
[~] Number of requests: 4

Example 2 — Find all matching WAF signatures

$ wafw00f -a https://example.com

Output:

[*] Checking https://example.com
[+] Generic Detection results:
[+] The site https://example.com is behind Cloudflare (Cloudflare Inc.)
[+] The site https://example.com is behind Generic (Unknown)
[~] Number of requests: 12

Example 3 — Verbose scan for detailed request/response info

$ wafw00f -v https://example.com

Output:

[*] Sending baseline request...
[*] Response code: 200, length: 1256
[*] Sending malicious payload: ?id=1' OR '1'='1
[*] Response code: 403, length: 89 (anomaly detected)
[+] The site https://example.com is behind Cloudflare (Cloudflare Inc.) WAF.

Example 4 — Scan multiple targets from a file

$ cat targets.txt
example.com
testphp.vulnweb.com
$ wafw00f -i targets.txt

Output:

[*] Checking https://example.com
[+] is behind Cloudflare (Cloudflare Inc.) WAF.
[*] Checking https://testphp.vulnweb.com
[-] No WAF detected

Example 5 — Output as JSON

$ wafw00f https://example.com -f json -o waf-result.json
$ cat waf-result.json

Output:

[
  {
    "url": "https://example.com",
    "detected": true,
    "firewall": "Cloudflare",
    "manufacturer": "Cloudflare Inc.",
    "trigger_url": "https://example.com"
  }
]

Example 6 — Test against a specific WAF signature only

$ wafw00f -t Incapsula https://example.com

Output:

[*] Checking https://example.com against Incapsula signature
[-] Incapsula WAF not detected

Example 7 — Scan through a proxy for correlation with Burp

$ wafw00f -p http://127.0.0.1:8080 https://example.com

Output:

[*] Routing requests through proxy: 127.0.0.1:8080
[+] The site https://example.com is behind Cloudflare (Cloudflare Inc.) WAF.

Example 8 — List all supported WAF signatures

$ wafw00f -l | head -8

Output:

WAF Name                     Manufacturer
----------                   -------------
360 Web Application Firewall 360 Technologies
AWS Elastic Load Balancer    Amazon
Airlock                      Phion/Ergon
Akamai                       Akamai Technologies
Anquanbao                    Anquanbao

7. Common Use Cases

• Early-stage recon to determine whether a WAF is present before choosing scanning aggressiveness.
• Selecting appropriate payload obfuscation/evasion techniques based on identified WAF vendor.
• Deciding whether to slow down scanning (rate-limit) to avoid WAF-triggered IP blocking.
• Bulk WAF inventory across an organization’s domain portfolio.
• Verifying WAF deployment as part of a defensive security configuration audit.

8. Automation with Bash

#!/bin/bash
# wafw00f-bulk-scan.sh — check WAF presence across many domains and summarize

DOMAINS_FILE="domains.txt"
OUTPUT="waf-summary.json"

echo "[" > "$OUTPUT"
first=true
while IFS= read -r domain; do
    [ -z "$domain" ] && continue
    result=$(wafw00f -f json "https://$domain" 2>/dev/null)
    if [ "$first" = false ]; then echo "," >> "$OUTPUT"; fi
    echo "$result" | jq -c '.[0]' >> "$OUTPUT"
    first=false
    echo "[+] Checked $domain"
done < "$DOMAINS_FILE"
echo "]" >> "$OUTPUT"

echo "[*] Summary:"
jq -r '.[] | "\(.url) -> \(.firewall // "None detected")"' "$OUTPUT"

9. Tips and Best Practices

• Run wafw00f before any active scanning (Nikto, Nuclei) so you can tune request rate and payload style accordingly.
• Use -a when you suspect multiple layers of protection (e.g., CDN WAF + application-level WAF).
• Combine with manual verification in Burp — automated WAF fingerprints can be inconclusive on well-tuned WAFs.
• Keep signatures updated (-U) since WAF vendors frequently change detectable behaviors.
• Use -p to route through Burp so detection requests are visible alongside the rest of your engagement traffic.

10. Troubleshooting

11. References

• Official GitHub repository: https://github.com/EnableSecurity/wafw00f
• Kali tool page: https://www.kali.org/tools/wafw00f/
• EnableSecurity: https://www.enablesecurity.com/