How do I install the Wafw00f skill?

Run npx skillmds@latest add aeondave/wafw00f in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Wafw00f skill do?

Auth/lab ref: WAF detection tool. Fingerprints Web Application Firewalls by analyzing HTTP responses to crafted requests. It is listed under Coding & Dev Tools on SkillMD.

Is Wafw00f safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wafw00f?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wafw00f free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Wafw00f?

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wafw00f by aeondave — Agent Skill

Name: Wafw00f
Author: AeonDave

File contents

wafw00f

WAF fingerprinting via crafted HTTP probes. Use before content discovery, injection testing, or active scanning to know what protection is in place.

Quick start

# Detect WAF on single target
wafw00f https://target.com

# Try all fingerprints (not just first match)
wafw00f -a https://target.com

# Multiple targets from file
wafw00f -i targets.txt

# Output formats
wafw00f https://target.com -o json -f output.json
wafw00f https://target.com -o csv -f output.csv

# Verbose (show probe details)
wafw00f -v https://target.com

Output interpretation

[+] The site https://target.com is behind Cloudflare (Cloudflare Inc.) WAF.
[+] The site https://target.com is behind ModSecurity (SpiderLabs/Trustwave)
[-] No WAF detected by the generic detection

No detection does not mean no WAF — some WAFs are passive (log-only) or use custom signatures not in wafw00f's database.

Integration in workflow

Run after initial HTTP fingerprinting and before:

Content discovery / directory brute-force
Active injection testing (SQLi, XSS)
Nuclei scanning

Result informs bypass strategy — see offensive-techniques/web-exploit-technique/references/waf-bypass.md.

Frequently asked questions

Wafw00f