wafw00f
Detect and fingerprint web application firewalls.
KaliParrotlow
pkg: wafw00f
wafw00f sends crafted requests and analyses responses to identify which WAF (if any) protects a site.
Syntax
wafw00f {url}
Example
wafw00f https://example.com
Probes the site and reports the detected WAF vendor, if present.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
wafw00f
Usage examples
wafw00f https://target.tld
Detect the WAF protecting a site.
wafw00f -a https://target.tld
Report every matching WAF signature.
Advantages
- Know the WAF before attacking
- Supports many vendors
- Quick single-command check
Disadvantages
- Probing can trigger the WAF
- False negatives on custom WAFs
- Detection only — no bypass
Tags
#web#waf
Official docs: wafw00f ↗
Related commands
Frequently asked questions
What is wafw00f used for?
wafw00f sends crafted requests and analyses responses to identify which WAF (if any) protects a site.
What is an example wafw00f command?
A common example is: wafw00f https://example.com — Probes the site and reports the detected WAF vendor, if present.
Is wafw00f part of Kali Linux?
Yes. wafw00f ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install wafw00f.
What category of security tool is wafw00f?
wafw00f is a Information Gathering tool with a low-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.