Web servers are often protected by packet filtering systems that drop or redirect suspected malicious packets. Web penetration testers benefit from knowing that there is a traffic filtering system between them and the target application. If that is the case, they can try more rare or stealthy techniques to try to bypass the Web Application Firewall (WAF) or Intrusion Prevention System (IPS).
This recipe demonstrates how to use Nmap to detect packet filtering systems, such as a WAF or an IPS in front of a web application.
- To detect WAF or IPS use the following command:
$ nmap -p80 --script http-waf-detect,http-waf-fingerprint <target>- The script
http-waf-detectwill let you know if a packet filtering system was detected:
PORT STATE SERVICE 80/tcp open http |_http-waf-detect: IDS/IPS/WAF detected
- The script
http-waf-fingerprintwill return the product name if identified:
PORT STATE SERVICE REASON
80/tcp open http ...