WAFW00F

Web应用防火墙指纹识别工具。
— 来自 Enable Security

它是如何工作的？

为了实现其魔法，WAFW00F 会执行以下操作：

• 发送一个 正常 的 HTTP 请求并分析响应；这能识别出许多 WAF 解决方案。
• 如果未成功，它会发送一些（可能恶意的）HTTP 请求，并用简单的逻辑推断出是哪种 WAF。
• 如果仍不成功，它会分析之前返回的响应，并使用另一种简单算法猜测是否有 WAF 或安全解决方案在主动响应我们的攻击。

有关更多详细信息，请查看我们主仓库中的源代码。

它能检测到什么？

WAFW00F 可以检测多种防火墙，列表如下：

$ wafw00f -l


                  ?              ,.   (   .      )        .      "
          __        ??          ("     )  )'     ,'        )  . (`     '`
    (___()'`;   ???          .; )  ' (( (" )    ;(,     ((  (  ;)  "  )")
    /,___ /`                 _"., ,._'_.,)_(..,( . )_  _' )_') (. _..( ' )
    \\   \\                 |____|____|____|____|____|____|____|____|____|

                                ~ WAFW00F : v2.4.2 ~
                  ~ Sniffing Web Application Firewalls since 2009 ~

[+] 可测试以下 WAF：

  WAF 名称                        制造商
  --------                        ------------

  360PanYun                        360 Technologies
  360WangZhanBao                   360 Technologies
  ACE XML Gateway                  Cisco
  ASP.NET Generic                  Microsoft
  ASPA Firewall                    ASPA Engineering Co.
  AWS Elastic Load Balancer        Amazon
  AireeCDN                         Airee
  Airlock                          Phion/Ergon
  Alert Logic                      Alert Logic
  AliYunDun                        Alibaba Cloud Computing
  AnYu                             AnYu Technologies
  Anquanbao                        Anquanbao
  Anubis                           Techaro
  AppWall                          Radware
  Approach                         Approach
  Armor Defense                    Armor
  ArvanCloud                       ArvanCloud
  Astra                            Czar Securities
  Azion Edge Firewall              Azion
  Azure Application Gateway        Microsoft
  Azure Front Door                 Microsoft
  BIG-IP AP Manager                F5 Networks
  BIG-IP AppSec Manager            F5 Networks
  BIG-IP Local Traffic Manager     F5 Networks
  Barikode                         Ethic Ninja
  Barracuda                        Barracuda Networks
  Baffin Bay                       Mastercard
  Bekchy                           Faydata Technologies Inc.
  Beluga CDN                       Beluga
  BinarySec                        BinarySec
  BitNinja                         BitNinja
  BlockDoS                         BlockDoS
  Bluedon                          Bluedon IST
  BulletProof Security Pro         AITpro Security
  CacheFly CDN                     CacheFly
  CacheWall                        Varnish
  CdnNS Application Gateway        CdnNs/WdidcNet
  ChinaCache Load Balancer         ChinaCache
  Chuang Yu Shield                 Yunaq
  Cloud Protector                  Rohde & Schwarz CyberSecurity
  Cloudbric                        Penta Security
  Cloudflare                       Cloudflare Inc.
  Cloudfloor                       Cloudfloor DNS
  Cloudfront                       Amazon
  Comodo cWatch                    Comodo CyberSecurity
  CrawlProtect                     Jean-Denis Brun
  DDoS-GUARD                       DDOS-GUARD CORP.
  DOSarrest                        DOSarrest Internet Security
  DataPower                        IBM
  DenyALL                          Rohde & Schwarz CyberSecurity
  Distil                           Distil Networks
  DotDefender                      Applicure Technologies
  DynamicWeb Injection Check       DynamicWeb
  Edgecast                         Verizon Digital Media
  Eisoo Cloud Firewall             Eisoo
  Envoy                            EnvoyProxy
  Expression Engine                EllisLab
  Fastly                           Fastly CDN
  FirePass                         F5 Networks
  FortiGate                        Fortinet
  FortiGuard                       Fortinet
  FortiWeb                         Fortinet
  GoDaddy Website Protection       GoDaddy
  Google Cloud App Armor           Google Cloud
  Greywizard                       Grey Wizard
  Huawei Cloud Firewall            Huawei
  HyperGuard                       Art of Defense
  ISA Server                       Microsoft
  Imunify360                       CloudLinux
  Incapsula                        Imperva Inc.
  IndusGuard                       Indusface
  Instart DX                       Instart Logic
  Janusec Application Gateway      Janusec
  Jiasule                          Jiasule
  KS-WAF                           KnownSec
  Kemp LoadMaster                  Progress Software
  KeyCDN                           KeyCDN
  Kona SiteDefender                Akamai
  LimeLight CDN                    LimeLight
  Link11 WAAP                      Link11
  LiteSpeed                        LiteSpeed Technologies
  Malcare                          Inactiv
  MaxCDN                           MaxCDN
  Mission Control Shield           Mission Control
  ModSecurity                      SpiderLabs
  NAXSI                            NBS Systems
  NSFocus                          NSFocus Global Inc.
  Nemesida                         PentestIt
  NetContinuum                     Barracuda Networks
  NetScaler AppFirewall            Citrix Systems
  NevisProxy                       AdNovum
  Newdefend                        NewDefend
  NexusGuard Firewall              NexusGuard
  NinjaFirewall                    NinTechNet
  NullDDoS Protection              NullDDoS
  OnMessage Shield                 BlackBaud
  Open-Resty Lua Nginx             FLOSS
  Oracle Cloud                     Oracle
  PT Application Firewall          Positive Technologies
  Palo Alto Next Gen Firewall      Palo Alto Networks
  PentaWAF                         Global Network Services
  PerimeterX                       PerimeterX
  PowerCDN                         PowerCDN
  Profense                         ArmorLogic
  Puhui                            Puhui
  Qcloud                           Tencent Cloud
  Qiniu                            Qiniu CDN
  Qrator                           Qrator
  RSFirewall                       RSJoomla!
  RayWAF                           WebRay Solutions
  Reblaze                          Reblaze
  Reflected Networks               Reflected Networks
  RequestValidationMode            Microsoft
  SEnginx                          Neusoft
  Sabre Firewall                   Sabre
  Safe3 Web Firewall               Safe3
  Safedog                          SafeDog
  Safeline                         Chaitin Tech.
  Scutum                           Secure Sky Technology Inc.
  SecKing                          SecKing
  SecuPress WP Security            SecuPress
  Secure Entry                     United Security Providers
  SecureSphere                     Imperva Inc.
  ServerDefender VP                Port80 Software
  Shadow Daemon                    Zecure
  Shield Security                  One Dollar Plugin
  SiteGround                       SiteGround
  SiteGuard                        EG Secure Solutions Inc.
  Sitelock                         TrueShield
  SonicWall                        Dell
  Squarespace                      Squarespace