[MUSIC PLAYING]
WAF detection with wafw00f.
What is a WAF?
A WAF is a Web Application Firewall.
And in this video, we're going to be taking a look at how
to detect web application firewalls with a tool called
wafw00f--
really cool name.
So as I said, we're going to be utilizing Kali Linux.
And, in this case, I'm going to be using my own Kali Linux
VM because, again, we're doing this on--
we're essentially going to be interacting with the website
on the internet.
So again, you can follow along, and we're
going to be utilizing the same sites that we've
been using so far.
So I'm just going to switch over to my Kali Linux VM.
All right, so I am back on my Kali Linux VM.
And as you can see, I'm currently on the wafw00f GitHub
repository.
I'll give you a little bit of a description as to what it does.
So you can see that wafw00f is the web application
firewall fingerprinting tool.
How does it work?
It essentially sends a normal HTTP request
and analyzes the response.
This will essentially identify a number of WAF solutions.
Now, the really cool thing about this tool
is I've used it in multiple penetration tests,
and it's really, really cool or very useful in identifying
or quickly identifying whether a website or web
application is being protected by a web application firewall.
And not just that-- it just doesn't tell you
that the site is being protected by a firewall or web
application firewall.
It tells you the actual web application firewall
that's protecting the site.
And you'll actually see this in action.
So you can view the list of web application firewalls
that can be detected by wafw00f.
So that can be done by typing in wafw00f and -l.
Now, I believe wafw00f comes prepackaged with Kali Linux.
Let's actually test that out.
So I'm just going to open up a terminal,
and let's see if we have it.
Yeah, there we are.
Looks like we have it.
So we can list out the list of firewalls
that wafw00f will detect.
So you can see you pretty much have all the proxies, all
the firewalls or web application firewalls, like Cloudflare.
We also have BlockDoS, Beluga, so on, and so forth.
We also have BitNinja-- very, very popular.
And, yeah, this will just give you
an idea as to what you're dealing with, right?
So whenever you're performing passive reconnaissance
on a website, you really want to know whether it's being
protected by a web application firewall
because, as you've seen with hackersploit.org
because it's going through Cloudflare,
you firstly cannot identify the IP address of the actual web
server that's hosting the website.
So identifying that a site is being protected by a web
application firewall will help you better strategize
what your next steps are.
So what we're going to do now is--
if we take a look at the instructions,
it's very easy to use.
We can just type in wafw00f and then hackersploit.org.
And let's see the output it provides here.
So it's going to start it up, and you
see we have the really cool dog icon or dog ASCII art here.
So you can see it's going to check the site,
and it tells us the site hackersploit.org
is behind Cloudflare.
Fantastic.
So we could have run this before,
but I wanted to actually highlight this particular tool
in its own video.
Well, let's try and see whether zonetransfer.me
is being protected by any web application firewall
because that's something that we really couldn't tell
from the whois lookup or the DNS lookup
or when we performed DNS reconnaissance
in the previous video.
So I'll type in wafw00f, and the domain is zonetransfer.me.
So I'll hit Enter, and let's see what happens,
or let's see whether this site is indeed
being protected by some form of a web application
firewall or proxy.
All right, so you can see that wafw00f tells us
that this site is not being protected by a web application
firewall.
Fantastic.
So that pretty much means that the IP address
we identified with DNSdumpster in the previous video
could possibly be the IP address of the server that's
actually hosting that website.
Now, let's try this on hackertube.net, which I own.
So I'm giving you the permission to do this, so hackertube.net.
You should see that this one is behind a web application
firewall.
And in this case, it tells us it's
behind LiteSpeed, which is interesting
because it's actually behind Sucuri, but there we are.
It's fairly simple to use, fairly simple to understand.
You can take a look at the usage instructions provided
on the GitHub repository.
As you can see, we don't really need
to install it because it comes prepackaged with Kali.
And all you need to do is just specify the actual website
itself.
So the correct way of specifying it
is by specifying the actual schema or protocol first.
And let's see whether that changes the output of wafw00f.
Indeed, it doesn't, and, of course, I'm
going to assume it doesn't do--
it'll not change the output for both the websites
that we tested earlier.
So that's pretty much how to use wafw00f.
You can take a look at the documentation.
It's really well documented.
And you can test multiple targets.
You can test for a single WAF instance,
or you can test for all possible WAF instances.
So let's try that right now.
So you can see that if we wanted to test for all possible WAF
instances, we can utilize the -a argument.
So let's try that against hackertube.net.
So I'll just type in -a there at the end of the argument
or at the end of the command.
So it still tells us-- there we are.
We actually get the information we were looking for.
So it tells us that it's behind LiteSpeed and/or the Sucuri
CloudProxy, which is very, very interesting.
So you can see that you actually need to tweak your checks.
So let's try and do that for zonetransfer.me just
to see if we missed anything.
So I'm just going to let this complete.
If it takes longer, then that means that there really
isn't a proxy or web application firewall intercepting
or filtering the traffic.
So again, there we are.
It looks like it is a--
there doesn't seem to be a WAF.
But right over here, you can see,
when we performed all the checks,
it tells that the site seems to be behind a WAF.
The only way to conclusively test this
would be within the active information-gathering phase,
where we can perform a port scan on the IP
address of the actual web server that we were able to identify.
But there we are.
That's how to use wafw00f, and that
is going to conclude the practical demonstration
side of this video.
All right, in the next video, we're
going to be taking a look at how to perform passive subdomain
enumeration.
So the objective here is to identify the subdomains tied
to a specific domain.
And we're going to be doing this by leveraging
publicly available resources and databases.
So again, this is still passive.
We're not performing a subdomain brute force.
We are going to be utilizing a tool called Sublist3r.
So I'll be seeing you in the next video.