-2

I've been doing research on web application firewalls. But of course, finding the firewalls is the hardest part of this so far. Is there a simple way (like a list or something) to finding a website that is protected by a firewall?

I'm pretty sure this would contradict the reason they have a firewall, but it would still be useful.

  • What kind of firewall you mean? A simple packet filter which might add some protection with limiting access by denying access to blacklisted IP or by rate limiting or some web application firewall which tries to detect more advanced attacks like SQL injection? In other words: what kind of protection offered by the firewall you are looking for? – Steffen Ullrich Dec 16 '17 at 13:39
  • @SteffenUllrich Mostly firewalls that offer protection against malicious intents, such as (as you mentioned) SQLi payloads, XSS payloads, directory traversal payloads, etc.. It's been a pain to have to find a website containing a firewall to test on. – Gyzo Dec 16 '17 at 13:46
  • 2
    You want to find a live website that uses a WAF and you want to perform live testing on it??? Will you get permission to do so? How would you possibly test and get any useful results without getting access to the server and logs?? – schroeder Dec 16 '17 at 17:17
5

Yes, there are several ways of detecting if a WAF is running in a site.

Most of the solutions out there are based on triggering default alerts on WAFs by sending "malicious" payloads that are known to trigger certain connection resets or error pages on specific WAFs.

Take a look at the projects here:

I would personally recommend to take a look on how SQLmap makes fingerprinting of WAFs too:

  • That's not what I was asking for, but thank you – Gyzo Dec 16 '17 at 14:09
  • 6
    @Gyzo why not? It appears to answer your question directly. If you tell us why it does not, then we can better understand what you want. – schroeder Dec 16 '17 at 17:12
2

Send a head request to the website in which you are willing to find whether WAF is present or not, it's header will reveal it's secret.

Here is an example:

{'Server': 'cloudflare-nginx', 'Vary': 'User-Agent', 'CF-RAY': '3c2dd8c6XXX47f370c8-SIN', 'Set-Cookie': '__cfduid=d6d107c6a6c85a29e4b0161c22251f4b61511542011; expires=Sat, 24-Nov-18 16:46:51 GMT; path=/; domain=.xxxxx.com; HttpOnly', 'Content-Encoding': 'gzip', 'Connection': 'keep-alive', 'Date': 'Fri, 24 Nov 2017 16:46:51 GMT', 'Content-Type': 'text/html; charset=UTF-8', 'X-Powered-By': 'PHP/5.6.31'

Look at the Server, it says it is cloudflare.

I once gathered the names of firewall from the internet for my project which I guess might be useful.

https://github.com/VISWESWARAN1998/Siva/blob/master/firewall_names.txt

Here is how a head request is made using python in 3 lines of code

>>> import requests
>>> r = requests.head("Your website")
>>> r.headers

Note: The name of the firewall could present in other places like X-CDN rather than server for some websites. So test all parts of header against the firewall names.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.