# Wafw00f

> Auth/lab ref: WAF detection tool. Fingerprints Web Application Firewalls by analyzing HTTP responses to crafted requests.

- Skill: `aeondave/wafw00f` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/wafw00f`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/wafw00f/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/wafw00f

---


# wafw00f

WAF fingerprinting via crafted HTTP probes. Use before content discovery, injection testing, or active scanning to know what protection is in place.

## Quick start

```bash
# Detect WAF on single target
wafw00f https://target.com

# Try all fingerprints (not just first match)
wafw00f -a https://target.com

# Multiple targets from file
wafw00f -i targets.txt

# Output formats
wafw00f https://target.com -o json -f output.json
wafw00f https://target.com -o csv -f output.csv

# Verbose (show probe details)
wafw00f -v https://target.com
```

## Output interpretation

```
[+] The site https://target.com is behind Cloudflare (Cloudflare Inc.) WAF.
[+] The site https://target.com is behind ModSecurity (SpiderLabs/Trustwave)
[-] No WAF detected by the generic detection
```

No detection does not mean no WAF — some WAFs are passive (log-only) or use custom signatures not in wafw00f's database.

## Integration in workflow

Run after initial HTTP fingerprinting and before:
- Content discovery / directory brute-force
- Active injection testing (SQLi, XSS)
- Nuclei scanning

Result informs bypass strategy — see `offensive-techniques/web-exploit-technique/references/waf-bypass.md`.