WAF Detector

An NPM package for detecting Web Application Firewalls (WAFs) protecting a given URL, designed for security professionals, penetration testers, and developers.

DISCLAIMER: This tool is intended for legitimate security research, penetration testing, and educational purposes only. Always ensure you have explicit authorization before testing systems you don't own.

Features

• Detect 9+ common WAF solutions including Cloudflare, AWS WAF, Incapsula, and more
• Non-intrusive detection methods based on HTTP headers and response analysis
• Optional active testing with benign trigger payloads
• Confidence-based detection with detailed results
• Simple and flexible API with TypeScript support
• Multiple WAF vendor identification

Installation

npm install waf-detector

Basic Usage

const WafDetector = require('waf-detector');

// Create a detector with default options
const detector = new WafDetector();

// Detect WAF on a target website
async function detectWaf() {
  try {
    const result = await detector.detect('example.com');
    
    if (result.detected) {
      console.log(`WAF Detected: ${result.name}`);
      console.log(`Confidence: ${result.confidence}%`);
      console.log(`Matched patterns: ${result.matchedPatterns.join(', ')}`);
    } else {
      console.log('No WAF detected');
    }
  } catch (error) {
    console.error('Error during detection:', error.message);
  }
}

detectWaf();

Advanced Usage

const WafDetector = require('waf-detector');

// Create a detector with custom options
const detector = new WafDetector({
  timeout: 10000, // 10 seconds timeout
  verbose: true, // Enable verbose logging
  activeTesting: true, // Enable active testing with payloads
  headers: {
    // Custom headers for all requests
    'Accept-Language': 'en-US,en;q=0.9',
    'Cache-Control': 'no-cache'
  },
  userAgent: 'Mozilla/5.0 (compatible; WafDetector/1.0; +https://github.com/dhavalsindhav/waf-detector)'
});

// Detect WAFs on multiple targets
async function detectWafs(targets) {
  const results = [];
  
  for (const target of targets) {
    console.log(`Scanning ${target}...`);
    
    try {
      const result = await detector.detect(target);
      results.push({
        target,
        ...result
      });
    } catch (error) {
      console.error(`Error scanning ${target}:`, error.message);
    }
  }
  
  return results;
}

// List of targets to scan
const targets = [
  'cloudflare.com',
  'aws.amazon.com',
  'example.com',
  'github.com'
];

detectWafs(targets);

API Reference

new WafDetector([options])

Creates a new WAF detector instance.

Options

• timeout (number): Timeout for HTTP requests in milliseconds. Default: 5000
• headers (object): Custom headers to include in all requests. Default: {}
• verbose (boolean): Enable verbose logging. Default: false
• activeTesting (boolean): Enable active testing with WAF triggers. Default: false
• userAgent (string): Override the default User-Agent string.

detector.detect(targetUrl)

Detects WAF on a given target URL.

Parameters

• targetUrl (string): The URL to check for WAF protection. Protocol (http/https) is optional.

Returns

A Promise that resolves to a WafDetectionResult object:

• detected (boolean): Whether a WAF was detected
• name (string|null): Name of the detected WAF, if any
• confidence (number): Confidence level (0-100)
• details (object): Additional detection details
• matchedPatterns (string[]): Patterns that matched
• possibleWafs (array): List of possible WAFs with confidence scores
• rawResponse (object): Raw response data for further analysis

Supported WAFs

The library can detect the following WAF solutions:

• Cloudflare
• Sucuri CloudProxy
• Incapsula
• Akamai Kona Site Defender
• Amazon Web Services WAF (AWS WAF)
• ModSecurity
• Barracuda WAF
• F5 BIG-IP ASM
• Radware AppWall

More will be added in future updates.

Security Considerations

This tool uses primarily non-intrusive techniques for WAF detection to minimize impact on target systems. However, the active testing option will send benign but potentially suspicious payloads to the target. Use this option with caution and only on systems you have permission to test.

Contributing

Contributions are welcome! Feel free to submit issues or pull requests.

1. Fork the repository
2. Create your feature branch: git checkout -b feature/new-waf-signature
3. Commit your changes: git commit -am 'Add detection for XYZ WAF'
4. Push to the branch: git push origin feature/new-waf-signature
5. Submit a pull request

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgements

Thanks to all the security researchers and tools that have contributed to WAF detection techniques.