I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.

The HTML always looks like this:

<title>403 Forbidden</title>
<p>You don't have permission to access /<SOME-LINK> on this server.</p>

My question is, does anybody know what protection this is? I've read somewhere that it is ModSecurity, but I haven't been able to prove this (mostly because it doesn't say that). Any help would be greatly appreciated, thank you (also if there is a giant list of known WAF's and their HTML that I don't know about would someone be able to point me in the right direction).

  • have you googled "You don't have permission to access / on this server" ? There are a lot of responses ... and none of them WAF or IDSs ... – schroeder Nov 13 '17 at 20:32
  • @schroeder yes I have, that's why I was confused because of how many responses there are – Gyzo Nov 13 '17 at 20:40

None of the above. It's a default Apache message for page security.

Source: https://github.com/apache/httpd/blob/29ddc70d4aa6847c46d8b8659ff0fbfd39308382/modules/http/http_protocol.c#L991

  • Awh that makes sense as to why so many of them produce it, thank you that helps a lot! – Gyzo Nov 13 '17 at 20:41

That is not a WAF. As others said, it seems a default Apache message.

Anyway, to try to identify a WAF you can check a script called WafW00f. That's included on some pentesting linux distributions like Kali Linux or Parrot Security, or you can download it from Github on the link I already put above.

  • Thank you, already have that, implementing one into a program I'm creating – Gyzo Nov 13 '17 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.