A web application firewall (WAF) is a device or a piece of software that checks packages sent to a web server in order to identify and block those that might be malicious, usually based on signatures or regular expressions.
We can end up dealing with a lot of problems in our penetration test if an undetected WAF blocks our requests or bans our IP address. When performing a penetration test, the reconnaissance phase must include the detection and identification of a WAF, intrusion detection system (IDS), or intrusion prevention system (IPS). This is required in order to take the necessary measures to prevent being blocked or banned.
In this recipe, we will use different methods, along with the tools included in Kali Linux, to detect and identify the presence of a web application firewall between our target and us.
- Nmap includes a couple of scripts to test for the presence of a WAF. Let's try some on our vulnerable-vm:
nmap -p 80,443 --script=http-waf-detect 192.168.56.102
OK, no WAF is detected in this server, so we have no WAF in this server.
- Now, let's try the same command on a server that actually has a firewall protecting it. Here, we will use example.com; however, you may try it over any protected server.
nmap -p 80,443 --script=http-waf-detect www.example.com
Imperva is one of the leading brands in the market of web application firewalls; as we can see here, there is a device protecting this site.
- There is another script in Nmap that can help us to identify the device being used, more precisely. The script is as follows:
nmap -p 80,443 --script=http-waf-fingerprint www.example.com
- Another tool that Kali Linux includes to help us in detecting and identifying a WAF is
wafw00f. Supposewww.example.comis a WAF-protected site:wafw00f www.example.com
WAF detection works by sending specific requests to servers and then analyzing the response; for example, in the case of http-waf-detect, it sends some basic malicious packets and compares the responses while looking for an indicator that a packet was blocked, refused, or detected. The same occurs with http-waf-fingerprint, but this script also tries to interpret that response and classify it according to known patterns of various IDSs and WAFs. The same applies to wafw00f.