-1

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.

The HTML always looks like this:

<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /<SOME-LINK> on this server.</p>
<hr>

My question is, does anybody know what protection this is? I've read somewhere that it is ModSecurity, but I haven't been able to prove this (mostly because it doesn't say that). Any help would be greatly appreciated, thank you (also if there is a giant list of known WAF's and their HTML that I don't know about would someone be able to point me in the right direction).

Improve this question
2
  • have you googled "You don't have permission to access / on this server" ? There are a lot of responses ... and none of them WAF or IDSs ...
    – schroeder ♦
    Commented Nov 13, 2017 at 20:32
  • @schroeder yes I have, that's why I was confused because of how many responses there are
    – Gyzo
    Commented Nov 13, 2017 at 20:40

2 Answers 2

Reset to default
2

None of the above. It's a default Apache message for page security.

Source: https://github.com/apache/httpd/blob/29ddc70d4aa6847c46d8b8659ff0fbfd39308382/modules/http/http_protocol.c#L991

Improve this answer
1
  • Awh that makes sense as to why so many of them produce it, thank you that helps a lot!
    – Gyzo
    Commented Nov 13, 2017 at 20:41
0

That is not a WAF. As others said, it seems a default Apache message.

Anyway, to try to identify a WAF you can check a script called WafW00f. That's included on some pentesting linux distributions like Kali Linux or Parrot Security, or you can download it from Github on the link I already put above.

Improve this answer
1
  • Thank you, already have that, implementing one into a program I'm creating
    – Gyzo
    Commented Nov 13, 2017 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .