⚠️ Overview

WhatWaf is an open-source Python-based web application firewall (WAF) detection and bypass tool created by Ekultek (also known as the developer of the Fsociety toolkit). Originally released on GitHub in 2016, the project has been maintained by a small group of security researchers and has garnered over 2,000 stars. The tool's primary purpose is to identify which WAF solution a target website employs and then attempt to evade its protections using a variety of payload encoding and obfuscation techniques.

🔧 Technical Capabilities

WhatWaf operates by sending a series of malicious HTTP requests to a target, then analyzing the response headers, status codes, and blocked content to fingerprint over 50 different WAF products, including ModSecurity, Cloudflare, Akamai, AWS WAF, and Barracuda. Once the WAF is identified, the tool applies attack-specific bypass methods such as case permutation, comment injection, null-byte insertion, and Unicode normalization to SQL injection, XSS, and path traversal payloads. It also supports multi-threading for faster scanning and allows users to supply custom payloads via command-line arguments. The tool integrates with proxychains and Tor for anonymity, and can output results in JSON or plaintext formats for integration into larger penetration testing workflows.

📜 History & Notable Incidents

WhatWaf gained notoriety when it was used in several high-profile bug bounty reports, notably against large e-commerce platforms where the tool successfully bypassed ModSecurity and Cloudflare protections on publicly reported validation endpoints. No specific CVEs are assigned to WhatWaf itself, but it has been referenced in multiple security advisories as an example of how automated WAF bypass tools can circumvent common rule sets. The tool's GitHub repository has been repeatedly forked and used by red team operators in simulated attack environments.

🔍 Detection Indicators

The default User-Agent for WhatWaf is "WhatWaf/1.0" or a random string from its built-in list, but many deployments use a customized agent such as "Mozilla/5.0 (compatible; WhatWaf/2.0)". Behavioral fingerprints include a rapid succession of requests to the same endpoint with incremental payload variations, unusually high numbers of 403/406 responses followed by a shift in encoding methods, and the presence of classical WAF bypass signatures like "union%20select" with URL-encoded comment tags in the request body.

☠️ Risk & Impact

If WhatWaf successfully bypasses a WAF, the attacker can proceed to exploit web application vulnerabilities such as SQL injection, cross-site scripting, or directory traversal, leading to data exfiltration, session hijacking, or server compromise. The tool poses a direct threat to any web application relying solely on signature-based WAF rules without additional defense layers like rate limiting or behavior analysis.

🛡️ Mitigation

WhatWaf is blocked immediately upon detection because its sole purpose is to circumvent perimeter defenses. Security teams should configure WAF rules to flag and drop requests containing typical WhatWaf User-Agent strings, unusually rapid payload variation patterns, or suspicious encoding that matches known bypass techniques documented in the tool's GitHub repository (https://github.com/Ekultek/WhatWaf).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.