Detecting web application firewalls