-2

I've been doing research on web application firewalls. But of course, finding the firewalls is the hardest part of this so far. Is there a simple way (like a list or something) to finding a website that is protected by a firewall?

I'm pretty sure this would contradict the reason they have a firewall, but it would still be useful.

Improve this question
3
  • What kind of firewall you mean? A simple packet filter which might add some protection with limiting access by denying access to blacklisted IP or by rate limiting or some web application firewall which tries to detect more advanced attacks like SQL injection? In other words: what kind of protection offered by the firewall you are looking for?
    – Steffen Ullrich
    Commented Dec 16, 2017 at 13:39
  • @SteffenUllrich Mostly firewalls that offer protection against malicious intents, such as (as you mentioned) SQLi payloads, XSS payloads, directory traversal payloads, etc.. It's been a pain to have to find a website containing a firewall to test on.
    – Gyzo
    Commented Dec 16, 2017 at 13:46
  • 2
    You want to find a live website that uses a WAF and you want to perform live testing on it??? Will you get permission to do so? How would you possibly test and get any useful results without getting access to the server and logs??
    – schroeder ♦
    Commented Dec 16, 2017 at 17:17

2 Answers 2

Reset to default
5

Yes, there are several ways of detecting if a WAF is running in a site.

Most of the solutions out there are based on triggering default alerts on WAFs by sending "malicious" payloads that are known to trigger certain connection resets or error pages on specific WAFs.

Take a look at the projects here:

I would personally recommend to take a look on how SQLmap makes fingerprinting of WAFs too:

Improve this answer
2
  • That's not what I was asking for, but thank you
    – Gyzo
    Commented Dec 16, 2017 at 14:09
  • 6
    @Gyzo why not? It appears to answer your question directly. If you tell us why it does not, then we can better understand what you want.
    – schroeder ♦
    Commented Dec 16, 2017 at 17:12
2

Send a head request to the website in which you are willing to find whether WAF is present or not, it's header will reveal it's secret.

Here is an example:

{'Server': 'cloudflare-nginx', 'Vary': 'User-Agent', 'CF-RAY': '3c2dd8c6XXX47f370c8-SIN', 'Set-Cookie': '__cfduid=d6d107c6a6c85a29e4b0161c22251f4b61511542011; expires=Sat, 24-Nov-18 16:46:51 GMT; path=/; domain=.xxxxx.com; HttpOnly', 'Content-Encoding': 'gzip', 'Connection': 'keep-alive', 'Date': 'Fri, 24 Nov 2017 16:46:51 GMT', 'Content-Type': 'text/html; charset=UTF-8', 'X-Powered-By': 'PHP/5.6.31'

Look at the Server, it says it is cloudflare.

I once gathered the names of firewall from the internet for my project which I guess might be useful.

https://github.com/VISWESWARAN1998/Siva/blob/master/firewall_names.txt

Here is how a head request is made using python in 3 lines of code

>>> import requests
>>> r = requests.head("Your website")
>>> r.headers

Note: The name of the firewall could present in other places like X-CDN rather than server for some websites. So test all parts of header against the firewall names.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .