diff --git a/WAF Bypass.md b/WAF Bypass.md
index 1ec1fd7..e5aa777 100644
--- a/WAF Bypass.md
+++ b/WAF Bypass.md
@@ -25,7 +25,7 @@ To identify WAFs, we need to (dummy) provoke it.
| ASP.NET Generic | • **Detectability:** Easy
• **Detection:** Response headers may contain `X-ASPNET-Version` header value.
**Blocked response page content may contain:**
•`This generic 403 error means that the authenticated user is not authorized to use the requested resource.`
•`Error Code 0x00000000<` keyword. |
| BIG-IP ASM | • **Detectability:** Moderate
• **Detection:**
Response headers may contain `BigIP` or `F5` keyword value.
Response header fields may contain `X-WA-Info` header.
Response headers might have jumbled `X-Cnection` field value. |
| Cloudflare | • **Detectability:** Easy
• **Detection:**
Response headers might have `cf-ray` field value.
`Server` header field has value `cloudflare`.
`Set-Cookie` response headers have `__cfuid=` cookie field.
Page content might have `Attention Required!` or `Cloudflare Ray ID:`.
Page content may contain `DDoS protection by Cloudflareas` text.
You may encounter `CLOUDFLARE_ERROR_500S_BOX` upon hitting invalid URLs. |
-| FortiWeb | • **Detectability:** Moderate
• **Detection:**
Response headers contain `FORTIWAFSID=` on malicious requests.
**Blocked response page contains:**
Reference to `.fgd_icon` image icon.
`Server Unavailable!` as heading.
`Server unavailable. Please visit later.` as text.|
+| FortiWeb | • **Detectability:** Moderate
• **Detection:**
Response headers contain `FORTIWAFSID=` on malicious requests.
Response headers contain cookei name `cookiesession1=`
**Blocked response page contains:**
Reference to `.fgd_icon` image icon.
`Server Unavailable!` as heading.
`Server unavailable. Please visit later.` as text.|