WAFW00F(8)

📦
version 2.4.2 · 3 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💅 NAME 💅

okay so bestie, listen up — wafw00f is the Web Application Firewall Identification and Fingerprinting Tool. that's it. that's the whole vibe. it looks at a website and goes "hm, that firewall is giving... Cloudflare." no cap. this page is from the User Commands manual, section 8, and it's your new fave.

✨ SYNOPSIS ✨

wafw00f url1 [url2 [url3 ... ]]

yep. you just hand it urls. as many as you want. it'll take them all, one after another, like a girl with a list of exes to check up on. 🕵️♀️

🦋 DESCRIPTION 🦋

The Web Application Firewall Identification and Fingerprinting Tool. periodt. 💖

so like, to do its little magic trick, wafw00f runs this whole detective arc:

  • first it sends a normal HTTP request and analyses the response — this alone identifies a bunch of WAF solutions. slay.
  • if that doesn't work out (it's not you, it's the firewall), it sends a number of potentially malicious HTTP requests and uses some simple logic to deduce which WAF it is. dramatic but effective.
  • if that's also a flop, it goes back and analyses the responses it already got, then uses another simple algorithm to guess whether a WAF or security solution is active> 🫠

three chances. three stages. main character energy only.

🔥 OPTIONS 🔥

  • -h, --help — show available options. the "what do i do now" button.
  • -v, --verbose — enable verbosity. and bestie, you can stack multiple -v options to increase verbosity. more v's, more tea. 🍵
  • -a, --findall — find all the WAFs, don't stop testing at the first one. completionist behaviour. we love.
  • -r, --noredirect — do not follow redirections given by 3xx responses. stay in your lane.
  • *-t *WAF, --test=WAF — test for one specific WAF product. just the one. laser focus. 💅
  • *-o *OUTPUT, --output=OUTPUT — write output to a csv, json or text file, depending on the file extension. and for stdout, specify - as the filename. iconique.
  • *-f, --format=FORMAT* — force the output format to csv, json or text. when the extension isn't giving what you need.
  • *-i *INPUT, --input=INPUT — read targets from a file. input format can be csv, json or text. for csv and json, a url column name or element is required. (yes. required. non-negotiable. 🙈)
  • -l, --list — list all the WAFs that wafw00f is able to detect. the full roster. the whole cast. ⭐
  • *-p *PROXY, --proxy=PROXY — use an HTTP proxy to perform requests. example: http://hostname:8080, socks5://hostname:1080. incognito mode but make it network-level.
  • -V, --version — print out the version. (capital V bestie, don't mix it up with -v 😭)
  • *-H *FILE, --headers=FILE — pass custom headers. for example, to overwrite the default user-agent string. glow-up your requests.
  • *-T *TIMEOUT, --timeout=TIMEOUT — set the timeout for the requests. don't wait forever for a reply, you're too busy for that. 💀
  • --no-colors — disable ANSI colors in output. for when you're piping into a file and the escape codes are ruining everything. 🎀

👑 AUTHORS 👑

the girlies behind the genius:

  • Sandro Gauci (@SandroGauci)
  • Pinaki Mondal (@0xInfection)

absolute legends. we stan. 🫶

🐛 REPORTING BUGS 🐛

found a bug? not me discovering a whole new problem 💀 — you can report bugs at the project homepage issue tracker:

<https://github.com/EnableSecurity/wafw00f/issues/>

Copyright (C) 2009-2022 WAFW00F Developers. License: BSD 3-Clause <https://opensource.org/licenses/BSD-3-Clause>.

This is free software: you are free to modify and distribute under the terms as permitted by the license provided alongwith.

(translation: it's free, it's open, go wild, just respect the license bestie ✨)

🌈 SEE ALSO 🌈

full documentation is available at:

<https://github.com/EnableSecurity/wafw00f/wiki/>

and that's the whole page!! 😭💖 this version of the wafw00f page was born in October 2020, and it lives in the wafw00f manual as WAFW00F(8). go forth, fingerprint some firewalls, and stay hydrated. mwah 💅🎀🦋

📦 where this page comes from