web-waf-detection
Web Application Firewall fingerprinting — Cloudflare, AWS WAF, Akamai, Imperva, etc.
67
81%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
WAF Detection & Fingerprinting
Identify any front-end shield (Cloudflare, AWS WAF, Akamai, Imperva, etc.) so exploit can choose appropriate evasion (encoding, payload obfuscation, alternate transport). A multi-proxy/CDN stack is also the recognition signal for HTTP request smuggling — note this for handoff.
Tooling
# wafw00f
wafw00f https://<target>
# Manual detection via response patterns
curl -s "https://<target>/?id=1' OR '1'='1" -I | grep -iE '(server|x-cdn|cf-ray|x-sucuri|x-aws)'Known WAF Indicators
| WAF | Signal |
|---|---|
| Cloudflare | CF-RAY header, __cfduid cookie |
| AWS WAF | x-amzn-requestid header |
| Akamai | AkamaiGHost server header |
| Imperva | X-CDN header, incap_ses cookie |
| Sucuri | X-Sucuri-ID header |
| F5 BIG-IP | BIGipServer cookie |
Multi-Proxy / Smuggling Signal
If the response chain shows TWO different Server: strings on subsequent requests, or a CDN front in front of an origin server with different framing, note this in the handoff under "Frontend stack" — it is the recognition signal for HTTP request smuggling routing in exploit.
- Repository
- PurpleAILAB/Decepticon
- Commit
31e1c8e
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.