WAF Fingerprinting & Detection Guide — 100+ WAF Identifikasi via Response Headers, Cookies, Block Pages

Ringkasan

WAF fingerprinting adalah proses mengidentifikasi jenis dan vendor WAF yang melindungi target. Informasi ini penting untuk memilih teknik bypass yang tepat. Fingerprint bisa didapat dari response headers, cookies, block page content, response codes, dan side-channel timing. Referensi ini mencakup 100+ WAF signatures dari Awesome-WAF + wafw00f plugin database (173 WAF).

Cross-link: waf-evasion-techniques-encyclopedia → waf-reverse-proxy-deepdive → ctf-tool-arsenal-universal → sql-comment-injection-waf-bypass

---

Daftar Isi

• 1. Metodologi Fingerprinting
• 2. Detection via Headers
• 3. Detection via Block Page
• 4. Detection via Response Codes
• 5. Detection via Cookies
• 6. Side-Channel Timing
• 7. Tool
• 8. Referensi Cepat 50+ WAF

---

1. Metodologi Fingerprinting

3-Step Detection

# Step 1: Normal request — catat response baseline
curl -I http://target.com
 
# Step 2: Provoke WAF — kirim payload mencurigakan
curl -I -d "<script>alert(1)</script>" http://target.com
 
# Step 3: Bandingkan response — cari perbedaan headers/body/status

Indikator WAF

Indikator	Contoh	WAF
Custom header	cf-ray, server: cloudflare	Cloudflare
Custom cookie	__cfuid, visid_incap, incap_ses	Cloudflare, Imperva
Block code	406, 493, 999	NAXSI, 360, WebKnight
Block page text	”ModSecurity Action”	ModSecurity
Server header	Yunjiasu-nginx, BigIP	Baidu, F5

---

2. Detection via Headers

Server Header

Server Value	WAF
cloudflare	Cloudflare
Yunjiasu	Baidu Yunjiasu CDN
BigIP / F5	F5 BIG-IP ASM
Mod_Security	ModSecurity
NASX / naxsi	NAXSI
Sucuri / Cloudproxy	Sucuri
ZScaler	ZScaler
NSFocus	NSFocus

Response Headers

Header	WAF
cf-ray: ...	Cloudflare
X-Sucuri-ID: ...	Sucuri
X-iinfo: ...	Imperva Incapsula
X-WA-Info: ...	F5 BIG-IP
X-Powered-By-360WZB: ...	360 WAF
X-dotDefender-denied	DotDefender
X-SL-CompState	Radware AppWall
X-BinarySec-Via	BinarySec
X-DIS-Request-ID	DoSArrest

---

3. Detection via Block Page

Unique Block Page Signatures

Cloudflare:
  "Attention Required! | Cloudflare"
  "DDoS protection by Cloudflare"
 
Imperva Incapsula:
  "Powered By Incapsula"
  "_Incapsula_Resource"
 
ModSecurity:
  "This error was generated by Mod_Security"
  "mod_security rules triggered"
 
Sucuri:
  "Access Denied - Sucuri Website Firewall"
  "cloudproxy@sucuri.net"
 
AWS WAF / CloudFront:
  "Generated by cloudfront (CloudFront)"
  "Request ID: ..."
 
Barracuda:
  "You have been blocked"
  "barra_counter_session"
 
F5 BIG-IP:
  "The requested URL was rejected"
  "Please consult with your administrator"

---

4. Detection via Response Codes

Response Code	WAF
403 Forbidden	Generic (most WAFs)
406 Not Acceptable	OpenResty Lua WAF, NAXSI
493	360 WAF
999 No Hacking	WebKnight
405 Method Not Allowed	Tencent Cloud WAF, Anquanbao
503 Service Unavailable	SecuPress, generic blocking
444 Connection Close	Nginx + custom WAF

---

5. Detection via Cookies

__cfuid=...         → Cloudflare
incap_ses_*=...     → Imperva Incapsula
visid_incap_*=...   → Imperva Incapsula
barra_counter=...   → Barracuda
TS*_*=...           → Citrix NetScaler
AL-SESS=...         → Airlock
ns_af=...           → Citrix NetScaler AppFirewall
PLBSID=...          → Profense
rbzid=...           → Reblaze

---

6. Side-Channel Timing

# Timing attack untuk fingerprint
# Cek perbedaan latency antara request normal vs malicious
# WAF cenderung nambah latency 5-50ms untuk malicious requests
 
time curl -s -o /dev/null http://target.com
# Normal: 50ms
 
time curl -s -o /dev/null -d "' OR 1=1 --" http://target.com
# Blocked by WAF: 80ms (WAF processing)

---

7. Tool: wafw00f

# Install
git clone --depth 1 https://github.com/EnableSecurity/wafw00f.git
cd wafw00f && python setup.py install
 
# Usage
wafw00f http://target.com
# Output: Cloudflare, AWS, ModSecurity, etc.
 
# Scan multiple
wafw00f http://target1.com http://target2.com -a

Lokasi: /mnt/data_d/Projects/Reference/wafw00f/ (173 plugin deteksi)

---

8. Referensi Cepat 50+ WAF

Nama WAF	Header	Cookie	Block Code	Block Page Signature
Cloudflare	cf-ray, server: cloudflare	__cfuid	403	”Attention Required!”
Imperva	X-iinfo	incap_ses, visid_incap	403	”Powered By Incapsula”
ModSecurity	server: Mod_Security	—	403	”ModSecurity Action”
F5 BIG-IP	X-WA-Info	—	403	”request was rejected”
AWS WAF	x-amz-rid	—	403	”Generated by cloudfront”
Sucuri	X-Sucuri-ID	—	403	”Access Denied - Sucuri”
Barracuda	—	barra_counter	403	”You have been blocked”
NAXSI	server: naxsi	—	406	”Blocked By NAXSI”
360 WAF	X-Powered-By-360WZB	WZWS-Ray	493	”wangshan.360.cn”
WebKnight	server: WebKnight	—	999	”WebKnight Application Firewall”

Sumber: Awesome-WAF fingerprint section + wafw00f plugins (173 WAF)

Cross-link vault:

• waf-evasion-techniques-encyclopedia — evasion setelah fingerprint
• waf-reverse-proxy-deepdive — arsitektur WAF
• ctf-tool-arsenal-universal — tools
• sql-comment-injection-waf-bypass — case study
• hierarchy-waf-reverse-proxy — ontology