Skip to content
WAFtester

WAFtester

Test your WAF like an attacker would.

waf-tester scan

$ waf-tester scan -u https://app.example.com --smart

[INFO] Target: https://app.example.com

[INFO] WAF Detected: Cloudflare (98% confidence)

[INFO] Auto-selecting tampers: charunicodeencode, randomcase

[INFO] Testing 2,847 payloads across 12 attack categories...

 

████████████████████████████████ 100% | 2847/2847

 

[RESULTS]

Bypasses found: 119/2847 (4.2%)

Detection rate: 95.8%

False positives: 2 (0.3%)

F1 Score: 0.969

Get Started View on GitHub
33
Commands
197
WAF Signatures
2,800+
Payloads
70+
Tampers
50+
Attack Categories
16
Output Formats

Why WAFtester?

Not a generic scanner with WAF checks bolted on. Purpose-built from the ground up.

🛡️

WAF-Aware

Purpose-built for WAF testing. Detects 197 WAF vendors, auto-selects bypass techniques per vendor.

📊

Quantitative

Real metrics: Detection Rate, False Positive Rate, F1 Score, MCC. Data-driven decisions, not guesswork.

⚡

Fast & Concurrent

Go-compiled binary. Concurrent scanner with sub-second startup. No runtime dependencies.

🔄

CI/CD Native

SARIF, SonarQube, GitLab SAST output. GitHub Action included. Streaming results for real-time feedback.

See It in Action

Five modes. One binary. Each designed for a specific WAF testing workflow.

waf-tester scan

$ waf-tester scan -u https://target.com --smart

[INFO] WAF Detected: Cloudflare (98%)

[INFO] Testing 2,847 payloads...

████████████████████ 100%

→ 119 bypasses found (4.2%)

→ F1 Score: 0.969

Who Is This For?

Built for security professionals who need more than "blocked/not blocked."

Pentesters

Discover WAF bypasses during engagements. Automated tamper selection means less manual work.

  • Auto tamper selection
  • Bypass chains
  • Evasion matrix

Security Engineers

Benchmark WAF rule quality with real metrics. Know your detection rate before attackers do.

  • F1/MCC scoring
  • False positive tracking
  • Regression testing

DevSecOps Teams

Integrate WAF testing into CI/CD. SARIF output feeds directly into GitHub Code Scanning.

  • SARIF output
  • GitHub Action
  • Pipeline-native

SOC / Blue Teams

Validate WAF rules against real attack patterns. Generate evidence for compliance reporting.

  • Detection benchmarks
  • Compliance reports
  • Evidence export

How It Compares

WAFtester is the only tool purpose-built for WAF security testing with quantitative scoring.

Feature WAFtester Nuclei SQLMap Nikto OWASP ZAP
WAF Detection ✓ — — — ✓
WAF Bypass Automation ✓ — ✓ — —
Quantitative Scoring (F1/MCC) ✓ — — — —
Multiple Output Formats (16+) ✓ ✓ — — ✓
CI/CD Integration ✓ ✓ — — ✓
Tamper/Evasion Library (70+) ✓ — ✓ — —
AI/MCP Integration ✓ — — — —
Single Binary (No Dependencies) ✓ ✓ — — —

Works with Your Stack

16 output formats. 5 CI/CD platforms. Native AI integration. Every protocol you need.

Output Formats

SARIF SonarQube GitLab SAST JSON HTML Report Markdown CSV JUnit XML

CI/CD Platforms

GitHub Actions GitLab CI Azure DevOps Jenkins CircleCI

AI / MCP Platforms

Claude Desktop VS Code / Copilot Cursor n8n Langflow

Protocols

HTTP/HTTPS GraphQL gRPC WebSocket SOAP

Install in Seconds

One command. No configuration. No runtime dependencies.

npm

$ npx -y @waftester/cli version

See all installation options →

AI-Native Security Testing

The first WAF testing tool with a built-in MCP server. Connect to Claude, Copilot, or any MCP-compatible platform.

Configuration

mcp-config.json 
{
  "mcpServers": {
    "waf-tester": {
      "command": "npx",
      "args": ["-y", "@waftester/cli", "mcp"]
    }
  }
}

In Action

"Scan example.com for SQL injection bypasses and give me a report"

AI Response

I'll run a targeted scan focusing on SQL injection categories with automatic tamper selection based on the detected WAF...

→ 23 SQLi bypasses found across 4 tamper chains

Works with

Claude Desktop VS Code Cursor n8n Langflow

Built by Security Engineers

WAFtester is open source and community-driven. Join hundreds of security professionals who trust it for WAF validation.

⭐
350+
GitHub Stars
👥
50+
Contributors
📦
1,200+
Downloads/Week
🔓
100%
Open Source Core
Star on GitHub

Frequently Asked Questions

Is WAFtester free?

The core CLI is available under BSL 1.1. Community payloads are MIT-licensed. Pro and Enterprise tiers unlock additional features.

Installation options
Is it safe to run against production?

WAFtester sends HTTP requests with known payloads. It does NOT exploit vulnerabilities — it tests whether your WAF blocks them. Use rate limiting (--rate) and run against staging first.

See rate limiting & advanced options
Which WAFs does it detect?

197 WAF signatures including Cloudflare, AWS WAF, Akamai, Imperva, F5, Azure Front Door, Fastly, Sucuri, and many more. Run `waf-tester vendor -u <target>` to check.

Core commands reference
How is it different from sqlmap/nuclei/Burp?

WAFtester is purpose-built for WAF testing. sqlmap is an exploitation tool, nuclei is a vulnerability scanner, Burp is a general web proxy. WAFtester uniquely combines WAF detection, bypass discovery, and statistical measurement in one tool.

Quick start guide
Can I use it in CI/CD?

Yes. Native GitHub Action, SARIF output for GitHub Advanced Security, SonarQube and GitLab SAST formats. Streaming output for real-time results in pipelines.

CI/CD integration guide
Does it support custom payloads?

Yes. Drop JSON/YAML payload files in the payloads directory or use the --payloads flag. Community payloads repo accepts contributions under MIT license.

Full examples guide

Ready to Test Your WAF?

One command to install. One command to scan. Real results in seconds.

$ npx -y @waftester/cli scan -u https://your-app.com --smart
Get Started View on GitHub