Firewalls and intrusion prevention systems are built to block attackers, but they leave behind detectable signs. This lecture focuses on identifying Web Application Firewalls (WAFs) and Intrusion Prevention Systems (IPS) using both manual probing and automated scans. You'll learn how to:

• Detect WAF presence using response patterns and behavior

• Use Nmap and NSE scripts to identify known WAF signatures

• Analyze discrepancies in HTTP status codes and timing

• Understand common evasion techniques and why detection matters for penetration testing

• Avoid false positives and distinguish between WAFs, IPS, and generic proxies