Detecting web application firewalls (WAF)