waf-detect

Detects Web Application Firewall presence and identifies product via wafw00f or curl.

21|1|Updated Apr 12, 2026

Search Tags:#security #waf #pentest #fingerprinting #recon #wafw00f

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill waf-detect-woohyun212

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: waf-detect
Source: https://github.com/woohyun212/security-skill/tree/main/waf-detect
Command: npx skills add https://github.com/woohyun212/security-skill --skill waf-detect-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects whether a Web Application Firewall (WAF) is present in front of a target URL and identifies the specific product, enabling accurate threat modeling and bypass planning.

Core Features & Use Cases

WAF detection with wafw00f and manual fingerprinting to identify Cloudflare, AWS WAF, Akamai, F5 BIG-IP, and others.
Flexible workflow supporting automated checks and manual fallback when tooling is unavailable.
Use Case: Before attempting bypass research or assessing site security, determine if a WAF exists to tailor the approach.

Quick Start

Ask your AI to run waf-detect on a target URL to determine if a WAF is present and identify its product.

Frequently Asked Questions about waf-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect if a Web Application Firewall is protecting a target URL?▼

To detect a Web Application Firewall, you can use automated tools like wafw00f or manual curl fingerprinting against the target URL. This process identifies specific WAF products such as Cloudflare, AWS WAF, or Akamai by analyzing response behaviors.

What is WAF fingerprinting and when do I need it for penetration testing?▼

WAF fingerprinting is the process of identifying the specific Web Application Firewall product in front of a target. You need it during reconnaissance and penetration testing to verify WAF presence, enabling accurate threat modeling and targeted bypass planning.

Do I need Python and wafw00f installed to identify a WAF?▼

You need Python 3 with wafw00f installed via pip for automated WAF detection. However, a manual fallback using curl is supported for fingerprinting if the automated tooling is unavailable, provided you have network access to the target URL.

Can I use manual curl requests to check for WAFs like F5 BIG-IP?▼

Yes, you can use manual curl requests to check for WAFs like F5 BIG-IP. The detection workflow supports a manual fingerprinting fallback, allowing you to identify WAF products by sending specific HTTP requests and analyzing the responses.

What is the best way to identify Cloudflare or AWS WAF during a bug bounty engagement?▼

The best way to identify WAFs like Cloudflare or AWS WAF during a bug bounty engagement is running an automated wafw00f check against the target URL. This quickly verifies WAF presence and type, allowing you to tailor your security assessment approach.

What are the limitations of using wafw00f for WAF detection?▼

A limitation of using wafw00f for WAF detection is its dependency on Python 3 and network access to the target URL. If the tool is unavailable or network access is restricted, you must rely on manual curl fingerprinting to identify the WAF product.