A web application firewall (WAF) is a device or a piece of software that checks packages sent to a web server in order to identify and block those that might be malicious, usually based on signatures or regular expressions.
We can end up dealing with a lot of problems in our penetration test if an undetected WAF blocks our requests or bans our IP address. When performing a penetration test, the reconnaissance phase must include the detection and identification of a WAF, intrusion detection system (IDS), or intrusion prevention system (IPS). This is required in order to take the necessary measures to prevent being blocked or banned.
In this recipe, we will use different methods, along with the tools included in Kali Linux, to detect and identify the presence of a web application firewall between our target and us.
nmap -p 80,443 --script=http-waf-detect 192.168.56.102
OK, no WAF is detected in this server, so we have no WAF in this server.
nmap -p 80,443 --script=http-waf-detect www.example.com
Imperva is one of the leading brands in the market of web application firewalls; as we can see here, there is a device protecting this site.
nmap -p 80,443 --script=http-waf-fingerprint www.example.com
wafw00f
. Suppose www.example.com
is a WAF-protected site:wafw00f www.example.com
WAF detection works by sending specific requests to servers and then analyzing the response; for example, in the case of http-waf-detect
, it sends some basic malicious packets and compares the responses while looking for an indicator that a packet was blocked, refused, or detected. The same occurs with http-waf-fingerprint
, but this script also tries to interpret that response and classify it according to known patterns of various IDSs and WAFs. The same applies to wafw00f
.
3.142.199.184