skills.rest
hoanghn61
hoanghn61COMMUNITY
Explore all skills by this author →
GitHub

cdn-waf-fingerprinter

Identify CDN, WAF, bot management, and DDoS services from HTTP, DNS, IP, and TLS signals.

Updated May 27, 2026
Search Tags:#cdn#waf#fingerprinting#http headers#dns cname#tls jarm#security attribution
One-click install
npx skills add https://github.com/hoanghn61/.agents --skill cdn-waf-fingerprinter
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cdn-waf-fingerprinter
Source: https://github.com/hoanghn61/.agents/tree/main/skills/techstack-identification/cdn_waf_fingerprinter
Command: npx skills add https://github.com/hoanghn61/.agents --skill cdn-waf-fingerprinter

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It removes the guesswork of determining which CDN, WAF, or bot/DDOS protection is protecting a target by inferring it from observable network and application signals.

Core Features & Use Cases

  • CDN fingerprinting: Detects common CDNs by matching HTTP headers/cookies, DNS CNAME patterns, and TLS fingerprint indicators.
  • WAF identification: Infers WAF products from security headers and characteristic cookies (e.g., Cloudflare WAF-style clearance tokens, Incapsula/Imperva cookies).
  • Security service attribution: Highlights related protection layers such as DDoS protection and bot management by correlating specialized header/cookie patterns.

Use case: When you have a domain or IP endpoint and need to understand its edge stack for incident response, threat modeling, or integration planning, this Skill produces an evidence-backed list of likely CDN/WAF/services.

Quick Start

Ask the AI to run cdn-waf-fingerprinter on the target’s Phase 2 signals (http_signals, dns_signals, ip_signals, tls_signals) and return the most likely CDN/WAF/DDOS/bot management findings with evidence.

Frequently Asked Questions about cdn-waf-fingerprinter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify which CDN or WAF is protecting a target domain?▼

WAF identification extracts characteristic security headers and cookies, such as Cloudflare clearance tokens or Incapsula cookies, to infer the specific WAF product. It correlates these patterns to accurately attribute the edge security layer.

Can I detect bot management and DDoS protection services from HTTP headers?▼

Yes, you can detect bot management and DDoS protection services by correlating specialized HTTP headers and cookie patterns. This security service attribution highlights related protection layers deployed alongside the primary CDN and WAF infrastructure.

What signals are needed to fingerprint edge security infrastructure?▼

Fingerprinting edge security infrastructure requires extracting evidence from HTTP headers, DNS CNAME records, IP ranges, and TLS JARM hashes. These observable signals provide the necessary data to rank likely CDN, WAF, and bot management technologies.

How does TLS JARM fingerprinting help with security attribution?▼

CDN and WAF fingerprinting is used for incident response triage, threat modeling, and integration planning when you must attribute edge security infrastructure without direct access. It produces evidence-backed findings of likely security technologies.

Does WAF fingerprinting work without direct access to the target server?▼

Yes, WAF fingerprinting works without direct access by inferring the WAF product from observable network and application signals. It analyzes external HTTP headers, cookies, and DNS CNAME patterns rather than requiring internal server access.

Related Skills

Explore More Data & Analytics Skills→
xalgordxalgord
846

subdomain-takeover

Detect and validate subdomain takeover via dangling DNS records and unclaimed cloud resources.

Community
Advanced
marquesfelipmarquesfelip

ddos-mitigation

Implement multi-layer DDoS defense for web services and APIs.

Community
Advanced
hoanghn61hoanghn61

cloud-infra-detector

Detect cloud providers from IP, DNS, HTTP, TLS, and IaC signals.

Community
Intermediate
microsoftmicrosoft
242

azure-kusto

Run KQL queries and analyze data in Azure Data Explorer.

Official
Advanced