Learn Cyber Security

Automating WAF Fingerprinting with Burp,Nmap and wafw00f: Burp Suite is an integrated platform for performing security testing of web applications. It is a really powerful tool, if you have the knowledge to use it. One thing we can do with it, of course, is to fingerprint a WAF, and that’s what we are going to do right now. There is no installation needed, but you need to have Java installed in your PC (you can download JDK from here: http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html ). After the Java installa tion, head to the Portswiggers download section, and download the free plain .jar version of Burp suite (https://portswigger.net/burp/download.html ). As long as you have downloaded it, the first step is to set a Manual proxy configuration in your browser. For example in Firefox, you go to Settings-Advanced-Network-Connection Set- tings, you select the Manual proxy configuration and fill it in with 127.0.0.1 in the HTTP Pro

You can encounter many forms of WAF installations, such as server plugins, filters, or even customized WAFs for a certain application. Also, there are different types of WAFs that we can distinguish in the following three categories: 1.                                                                       Appliance-based Web application firewalls 2.                                                                       Cloud and hybrid Web application firewalls 3.                                                                       Code integrated Web application firewalls The first category, Appliance-based WAFs, has to do with physical WAFs that the server manager installs physically to the server. It is placed in front of each web infrastructure of the server, and has the great advantage to not have the need of connecting to a remote server for the WAF services. It is fast, reliable, and on your facilities, so you can deal with problems that it may face on your own