When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site?

What techniques can I use to narrow down and figure out what tool is being used?

  • 1
    Depends on the skill of the attacker since he can easily hide some info. Some easy fingerprinting based on user-agent string might be possible. What type of vulnerabilities is it scanning for? Path traversal, sqli, xss, ... what tools do all the types of scanning? In what order is it scanning for these issues? – Silver Jan 31 '17 at 19:55
  • its throwing alerts for 'illegal resource', the attacker is trying to access files for a wordpress site when the site is running a different technology stack – pzirkind Jan 31 '17 at 19:59
  • 1
    Might be WPScan – Silver Jan 31 '17 at 20:13
  • Or a dirbuster with a wordpress dictionairy. What is the IP of the attacker? Is it a known IP? – Silver Jan 31 '17 at 20:14
  • 1
    There are far too many tools, both widely distributed and privately developed, to be able to answer anything conclusively. It depends on what the tool does. – schroeder Jan 31 '17 at 21:58

One reasonable starting point might be checking what the User-Agent is for the requests you are concerned about. I would expect it to be forged, but it may be forged in a way that is still identifiable.

You could also consider profiling a few likely culprits (I would expect at least some tools to have a predictable sequence of attacks), by running them against a test instance of your WAF, and collecting the logs and alerts.

I am not completely sure, though, that you want to be worrying about which script is doing what, so much as what the actual attacks are (and which ones are relevant to you). Although I can totally see how that would be an interesting thing to know.


There is no way to know. You can make an educated guess by searching for the attack vector or looking at the user agent header to see if it contains anything of value. Even then, it means nothing because it can all be altered by the attacker.

  • Welcome to Information Security SE. I guess OP is asking about what data from the traffic/requests can be used to make educated guesses. Many tools do have distinctive behavior. – Jedi Feb 1 '17 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.