WAFtester

The most comprehensive Web Application Firewall testing platform for security professionals and enterprise teams. Detect, fingerprint, and assess WAF security posture with quantitative metrics.

Overview

WAFtester provides enterprise-grade WAF security assessment through a single, unified platform. Unlike fragmented toolchains that require manual correlation between detection, bypass, and reporting phases, WAFtester delivers end-to-end automated testing with statistical validation.

waf-tester auto -u https://target.com --smart

This command executes a complete security assessment: endpoint discovery, WAF vendor identification, optimal bypass technique selection, 2,800+ payload testing, and quantitative report generation.

The Problem WAFtester Solves

Modern security teams face three critical challenges when assessing WAF effectiveness:

Fragmented Tooling. Traditional assessments require chaining multiple tools (wafw00f, sqlmap, nuclei, custom scripts), manual correlation of results, and significant expertise to interpret findings.

No Quantitative Metrics. Most tools report binary pass/fail results. Security teams need statistical measures (False Positive Rate, F1 Score, MCC) to make informed decisions about WAF configuration and vendor selection.

WAF-Agnostic Testing. Generic payloads waste time against well-configured WAFs. Effective testing requires WAF-specific bypass techniques selected based on the detected vendor and configuration.

WAFtester addresses these challenges with an integrated platform that automates the entire assessment lifecycle.

Core Capabilities

WAF Detection and Fingerprinting

Identify WAF vendors with high confidence using 197 vendor signatures.

$ waf-tester vendor -u https://protected.example.com

WAF Detection Results
--------------------------------------------------------------------------
  Vendor         Cloudflare
  Confidence     98%
  Evidence       cf-ray header, __cfduid cookie, 1020 error page
  
Recommended tampers for Cloudflare:
  charunicodeencode, space2morecomment, randomcase

Detection covers major commercial and open-source WAFs including Cloudflare, AWS WAF, Akamai, Imperva, Azure WAF, F5, Fortinet, ModSecurity, Barracuda, Sucuri, Radware, Citrix ADC, Palo Alto, Sophos, and Wallarm.

Automated Bypass Discovery

Discover WAF bypass techniques using 70+ tamper scripts with automatic selection based on detected vendor.

$ waf-tester bypass -u https://target.com --smart --tamper-auto

Bypass Discovery
--------------------------------------------------------------------------
  Payload Variants Tested     2,847
  Blocked by WAF              2,728 (95.8%)
  Bypassed WAF                119 (4.2%)
  
Top Bypass Chains:
  1. charunicodeencode + space2morecomment    (42 bypasses)
  2. modsecurityversioned + randomcase        (31 bypasses)  
  3. between + equaltolike                    (19 bypasses)

The mutation engine combines 49 mutator functions with base payloads to generate comprehensive coverage across encoding, evasion, and injection location variations.

Enterprise Assessment with Statistical Metrics

Generate quantitative WAF assessments with industry-standard statistical measures.

$ waf-tester assess -u https://target.com -fp -o assessment.json

Enterprise WAF Assessment
--------------------------------------------------------------------------
  Metric                  Score
  ---------------------------------
  Detection Rate (TPR)    94.2%
  False Positive Rate     0.3%
  Precision               99.7%
  Recall                  94.2%
  F1 Score                0.969
  MCC                     0.942

Assessment includes testing against benign traffic corpora (Leipzig corpus integration) to measure false positive rates, enabling data-driven WAF configuration decisions.

Multi-Protocol Support

Native support for modern API protocols beyond HTTP.

# GraphQL introspection and injection testing
waf-tester scan -u https://api.example.com/graphql -types graphql

# gRPC reflection and message fuzzing  
waf-tester scan -u grpc://service:50051 -types grpc

# SOAP/WSDL enumeration and XXE testing
waf-tester scan -u https://api.example.com/service.wsdl -types soap

# WebSocket message injection
waf-tester scan -u wss://api.example.com/socket -types websocket

API Spec Scanning

Drive security scans from API specifications. WAFtester parses your spec, generates a targeted scan plan, and tests every endpoint with schema-aware attacks.

# Scan from OpenAPI spec
waf-tester scan --spec openapi.yaml -u https://api.example.com

# Postman collection with environment variables
waf-tester auto --spec collection.json --env staging.json -u https://api.example.com

# HAR recording from browser DevTools
waf-tester scan --spec recording.har -u https://api.example.com

# Dry-run to preview scan plan
waf-tester scan --spec openapi.yaml -u https://api.example.com --dry-run

# Compare against baseline for regression detection
waf-tester compare baseline.json current.json

Supported formats: OpenAPI 3.x, Swagger 2.0, Postman Collection v2.x, HAR 1.2, GraphQL (introspection), gRPC (reflection), AsyncAPI 2.x.

See docs/API-SPEC-SCANNING.md for the full reference.

Comparison with Existing Tools

Workflow Consolidation

Feature Comparison

Installation

npm / npx (Recommended)

Zero-dependency install — downloads the correct platform binary automatically.

# Run directly (no install needed)
npx -y @waftester/cli scan -u https://target.com

# Or install globally
npm install -g @waftester/cli
waf-tester version

Works on macOS, Linux, and Windows (x64 and arm64). Requires Node.js >= 16.

Docker

Multi-architecture images (linux/amd64, linux/arm64) are published to GHCR and Docker Hub.

# Pull the latest image
docker pull ghcr.io/waftester/waftester:latest

# Run the MCP server on port 8080
docker run -p 8080:8080 ghcr.io/waftester/waftester

# Run a scan directly
docker run --rm ghcr.io/waftester/waftester scan -u https://example.com

# Docker Compose (local build)
docker compose up --build

Available image tags:

The image runs as non-root on a read-only distroless base (~5 MB). See docs/INSTALLATION.md for Docker Compose, Kubernetes, and environment variable configuration.

Package Managers

# macOS / Linux
brew tap waftester/tap
brew install waftester

# Windows
scoop bucket add waftester https://github.com/waftester/scoop-waftester
scoop install waftester

# Arch Linux (AUR)
yay -S waftester-bin

Binary Releases

Download pre-built binaries from the releases page.

For detailed installation instructions, see docs/INSTALLATION.md.

Usage

Automated Assessment

The auto command provides complete automated assessment including discovery, analysis, testing, and reporting.

# Full automated assessment with WAF-aware optimization
waf-tester auto -u https://example.com --smart

# With automatic tamper selection based on detected WAF
waf-tester auto -u https://example.com --smart --tamper-auto

# Service-specific presets for CMS and framework detection
waf-tester auto -u https://example.com -service wordpress

Targeted Scanning

The scan command provides focused vulnerability testing across 50+ attack categories.

# SQL injection and XSS testing
waf-tester scan -u https://target.com -types sqli,xss

# All attack categories
waf-tester scan -u https://target.com -types all

# With WAF-aware tamper selection
waf-tester scan -u https://target.com --smart --tamper-auto

# With custom payload and template directories
waf-tester scan -u https://target.com --payloads ./custom-payloads --template-dir ./my-templates

# With service preset for platform-specific testing
waf-tester auto -u https://sso.example.com -service authentik

WAF Intelligence

The tampers command provides vendor-specific bypass recommendations and automated discovery.

# Show tampers ranked by effectiveness for specific WAF
waf-tester tampers --for-waf=cloudflare

# Auto-discover which tampers bypass a live WAF
waf-tester tampers --discover --target https://target.com

# Load custom .tengo script tampers
waf-tester scan -u https://target.com --tamper-dir=./my-tampers

Output Formats and Integrations

WAFtester supports multiple output formats for integration with security workflows and CI/CD pipelines.

Supported Formats

Enterprise Integrations

Real-time Alerting

# Slack notifications
waf-tester scan -u $TARGET --slack-webhook=$WEBHOOK_URL

# Microsoft Teams notifications  
waf-tester scan -u $TARGET --teams-webhook=$WEBHOOK_URL

# PagerDuty escalation
waf-tester scan -u $TARGET --pagerduty-key=$ROUTING_KEY

# Jira ticket creation
waf-tester scan -u $TARGET --jira-url=$JIRA_URL --jira-project=SEC --jira-email=$EMAIL --jira-token=$TOKEN

# GitHub Issues integration
waf-tester scan -u $TARGET --github-issues-token=$TOKEN --github-issues-owner=myorg --github-issues-repo=security-issues

# Azure DevOps work item creation
waf-tester scan -u $TARGET --ado-org=myorg --ado-project=SecurityTests --ado-pat=$ADO_PAT

# OpenTelemetry tracing
waf-tester scan -u $TARGET --otel-endpoint=$OTEL_ENDPOINT

CI/CD Integration

GitHub Actions (Recommended)

- uses: waftester/waftester-action@v1
  with:
    target: https://app.example.com

Results appear in Security → Code scanning. See WAFtester Action for all options.

Alternative: CLI in GitHub Actions

- name: WAF Security Assessment
  run: |
    waf-tester scan -u ${{ env.TARGET_URL }} \
      -format sarif -o results.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Pipeline Quality Gates

# Fail pipeline on critical findings
waf-tester scan -u $TARGET -json | \
  jq -e '[.vulnerabilities[] | select(.severity=="Critical")] | length == 0'

# Extract metrics for dashboards
waf-tester assess -u $TARGET -json | \
  jq '{tpr: .metrics.detection_rate, fpr: .metrics.false_positive_rate, f1: .metrics.f1_score}'

For additional CI/CD examples (GitLab, Azure DevOps, Jenkins, CircleCI, Tekton), see docs/EXAMPLES.md.

MCP Server — AI Agent Integration

WAFtester includes a built-in Model Context Protocol (MCP) server that enables AI assistants (Claude, GPT, Copilot) and automation platforms (n8n, Langflow) to control WAFtester programmatically.

Why MCP?

Instead of parsing CLI output or building custom integrations, AI agents interact with WAFtester through a structured protocol with typed tool schemas, progress notifications, and domain-knowledge resources. The server guides agents through optimal tool selection and workflow orchestration.

Transports

The HTTP transport exposes:

• /mcp — Streamable HTTP (2025-03-26 spec)
• /sse — Legacy SSE for n8n and older MCP clients
• /health — Readiness probe for container orchestrators

All endpoints include CORS headers for browser-based clients.

Quick Start

# Stdio mode (for Claude Desktop, VS Code, Cursor)
waf-tester mcp

# HTTP mode (for n8n, Docker, remote access)
waf-tester mcp --http :8080

# Docker
docker run -p 8080:8080 ghcr.io/waftester/waftester mcp --http :8080

Claude Desktop Configuration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "waf-tester": {
      "command": "npx",
      "args": ["-y", "@waftester/cli", "mcp"]
    }
  }
}

Alternatively, if installed via binary download:

{
  "mcpServers": {
    "waf-tester": {
      "command": "waf-tester",
      "args": ["mcp"]
    }
  }
}

n8n Integration

1. Add an MCP Client node in n8n
2. Set transport to SSE Endpoint
3. Enter the URL: http://your-server:8080/sse
4. Connect to an AI Agent node
5. WAFtester tools appear automatically for the agent to use

Three ready-to-import workflow templates are available in n8n-templates/:

Available Tools

Async tools return a task_id immediately. Poll with get_task_status to retrieve results. This prevents timeout errors with n8n and other MCP clients.

Domain Knowledge Resources

AI agents can read these resources for context without making network requests:

For complete MCP examples, see docs/EXAMPLES.md.

Command Reference

For the complete flag reference with every option, see docs/COMMANDS.md.

Key Options

Platform Statistics

Documentation

License

Core: Business Source License 1.1 - Converts to Apache 2.0 on January 31, 2030

Community Payloads: MIT