WafW00F is a powerful tool for detecting and identifying Web Application Firewalls (WAFs) on target websites. Essential for bug bounty hunters and red teamers, WafW00F helps you fingerprint WAF types before launching deeper attacks. This cheatsheet provides the most used commands, options, and practical tips for reconnaissance and evasion.
WafW00F Cheatsheet
The Web Application Firewall Detection Tool
Basic WafW00F Commands
Basic Detection
wafw00f https://example.com
Detect WAF protecting a single URL.
Multiple Targets
wafw00f https://site1.com https://site2.com
Check multiple URLs in one command.
Input from File
wafw00f -i targets.txt
Test multiple targets from a file (one URL per line).
Proxy Support
wafw00f --proxy http://127.0.0.1:8080 https://example.com
Route requests through a proxy.
Custom Port
wafw00f https://example.com:8443
Test a non-standard port.
Verbose Mode
wafw00f -v https://example.com
Show detailed detection process.
WAF Detection Techniques
Find Redirects
wafw00f --find-redirects https://example.com
Follow and analyze redirects during detection.
No Redirects
wafw00f --no-redirect https://example.com
Disable redirect following.
Force Detection
wafw00f --force https://example.com
Continue testing even if WAF is detected early.
Test All Methods
wafw00f --test-all https://example.com
Run all available detection methods.
Custom Headers
wafw00f -H "X-Forwarded-For: 1.2.3.4" https://example.com
Add custom HTTP headers to requests.
Random Agent
wafw00f --random-agent https://example.com
Use a random User-Agent for each request.
Output Formatting
JSON Output
wafw00f -o json https://example.com
Output results in JSON format.
CSV Output
wafw00f -o csv https://example.com
Generate CSV formatted output.
Text Output
wafw00f -o txt https://example.com
Plain text output format.
Save to File
wafw00f -o json -f results.json https://example.com
Save output to a file.
Quiet Mode
wafw00f -q https://example.com
Suppress normal output (only show WAF detection).
Verbose Output
wafw00f -vv https://example.com
Extra verbose output (debugging information).
Advanced Techniques
Custom Request Rate
wafw00f --request-delay 2 https://example.com
Add delay (in seconds) between requests.
Bypass Cache
wafw00f --no-cache https://example.com
Add random parameters to bypass caching.
Custom SSL Verification
wafw00f --verify-ssl=false https://example.com
Disable SSL certificate verification.
Custom Timeout
wafw00f --timeout 10 https://example.com
Set custom timeout (in seconds) for requests.
List Known WAFs
wafw00f --list
Display all WAFs that can be detected.
Update WAF Signatures
wafw00f --update
Update the WAF detection signatures.
Common Use Cases
Comprehensive Scan
wafw00f -v --find-redirects --test-all -o json -f results.json https://example.com
Full scan with all detection methods and JSON output.
Stealthy Scan
wafw00f --random-agent --request-delay 3 --no-cache https://example.com
Slower scan that’s harder to detect.
Batch Testing
wafw00f -i targets.txt -o csv -f results.csv
Test multiple sites and save CSV results.
