🛡️ High-performance WAF & CDN detection tool. Identify protection layers (Cloudflare, Akamai, AWS, Fastly, and more), run effectiveness and enforcement tests with evasion payloads, and generate posture reports. Built in Rust 🦀.
CLI tool for detecting, testing, and profiling Web Application Firewalls (WAFs) and Content Delivery Networks (CDNs).
Important: Only test systems you own or have explicit authorization to test.
For AI coding agents: See AGENTS.md for skill mapping and workflow pointers. Use agent-skills/waf-assess/WORKFLOW.md for full assessments; use agent-skills/validate-build/WORKFLOW.md before merge.
| Mode | What it tests | Flag |
|---|---|---|
| Detection | Identifies which WAF/CDN protects a target | waf-detect <url> |
| Smoke Test | Sends known attack payloads, measures block rates | --smoke-test <url> |
| Enforcement Test | Sends categorized attack probes, measures block/challenge/allow | --va <url> |
| Behavioral Analysis | Paired probes testing WAF sophistication across 5 channels | --va2 <url> --va2-run |
| Posture Report | Unified grade (A-F) combining all test results | --posture <url> |
| HTML Report | Renders saved JSON results into a shareable static report | report <file.json> |
cargo build --release
./target/release/waf-detect scan example.com
# Full hardening scan + HTML report
./target/release/waf-detect hardening https://example.com --output /tmp/example-hardening.json
./target/release/waf-detect report /tmp/example-hardening.json --output /tmp/example-hardening.html
| Mode | Command |
|---|---|
| Detection | waf-detect scan <url> or waf-detect <url> |
| Hardening | waf-detect hardening <url> --output file.json |
| Smoke test | waf-detect --smoke-test <url> |
| Enforcement | waf-detect va <url> |
| Behavioral | waf-detect va2 <url> --run |
| Posture | waf-detect --posture <url> |
| Effectiveness | waf-detect --effectiveness <url> |
| Origin probe | waf-detect origin-probe <url> --json |
| HTML report | waf-detect report <file.json> -o <file.html> |
Identifies WAF/CDN via headers, body, DNS, TLS, and timing. 12 providers: CloudFlare, AWS, Akamai, Fastly, Vercel, Azure, F5, Imperva, ModSecurity, Sucuri, Radware, FortiWeb.
waf-detect scan example.com --json
waf-detect scan @urls.txt --ndjson
Sends known attack payloads and measures what the WAF blocks, challenges, or allows through. Active smoke testing only runs against registered owned targets.
./target/release/waf-detect --smoke-test example.com
# Aggressive mode (more payloads)
./target/release/waf-detect --smoke-test example.com --aggressive
# Export results
./target/release/waf-detect --smoke-test example.com -o results.json
Attack categories tested: SQL injection (basic + advanced), XSS (basic + advanced), command injection, path traversal, SSTI, SSRF, Log4Shell, file upload, scanner detection, GraphQL injection, HTTP request smuggling, prototype pollution, WebSocket injection, enumeration.
Result classifications:
BLOCKED — WAF blocked the request (typically 403)CHALLENGE — Bot protection triggered (JS challenge, CAPTCHA)ALLOWED — Request passed through to the originERROR — Non-blocking failure (404, 500, timeout)Sends categorized attack probes and measures block/challenge/allow rates with confidence scoring. Requires registered target scope.
# Register owned targets once
./target/release/waf-detect --scope init example.com
# Run enforcement test
./target/release/waf-detect --va https://example.com
# With JSON output
./target/release/waf-detect --va https://example.com --va-json
# Save report
./target/release/waf-detect --va https://example.com --va-output report.json
Options:
--va-tier 1|2|3 — Safety tier (1 = safest)--va-budget N — Max requests per run (default: 120)--va-timeout SECONDS — Per-request timeout (default: 15)--va-delay MS — Delay between requests (default: 750)--va-variants N — Variants per payload template (default: 4)--va-replay — Export replay plan as JSON--va-replay-csv — Export replay plan as CSVTests WAF sophistication by sending paired probes — one benign, one malicious — across 5 HTTP channels. Measures whether the WAF treats them differently.
# Dry run (shows plan without executing)
./target/release/waf-detect --va2 https://example.com
# Run behavioral analysis
./target/release/waf-detect --va2 https://example.com --va2-run
# Full 5-phase analysis
./target/release/waf-detect --va2 https://example.com --va2-run \
--va2-phases baseline,protocol-variance,state-escalation,behavioral-pressure,challenge-interaction
# Save results
./target/release/waf-detect --va2 https://example.com --va2-run --va2-output results.json
What it measures:
| Signal | What it tests |
|---|---|
| Encoding Defense | Does the WAF normalize encoded paths before matching? |
| Session Tracking | Does the WAF track session state and escalate on repeat abuse? |
| Bot Challenge | Does the WAF issue CAPTCHA or JS challenges? |
| Rate Limiting | Does the WAF throttle rapid requests? |
| Attack Recognition | Does the WAF distinguish attack probes from benign requests? |
Channels tested: Path, Query, Header, Body, Method. Channels with 0% attack detection are flagged as unprotected.
Options:
--va2-phases LIST — Phases to run (comma-separated)--va2-seed N — Deterministic seed for reproducible results (default: 1337)--va2-budget N — Request budget (default: 60)--va2-json — Print plan/report as JSONGenerates a unified security grade (A-F) and risk score (0-100) combining detection confidence, enforcement results, and behavioral analysis.
# Detection only
./target/release/waf-detect --posture example.com
# Include behavioral analysis
./target/release/waf-detect --posture example.com --posture-va2
# Include enforcement testing (VA1) -- distinguishes "WAF present but not
# enforcing" (monitor/log-only mode) from "no WAF at all"
./target/release/waf-detect --posture example.com --posture-va1
# JSON output
./target/release/waf-detect --posture example.com --posture-va2 --posture-json
Grade scale:
Render a saved JSON scan artifact into a static HTML report that is easy to review locally and share with other engineers.
# Render a saved hardening report
./target/release/waf-detect hardening https://example.com --output /tmp/example-hardening.json
./target/release/waf-detect report /tmp/example-hardening.json
# Render a saved posture report
./target/release/waf-detect --posture https://example.com --posture-va2 --posture-json > /tmp/example-posture.json
./target/release/waf-detect report /tmp/example-posture.json --output /tmp/example-posture.html
The generated HTML is static and self-contained, so it can be attached to tickets, shared in chat, or opened locally without rerunning the scan.
Smoke test, payload analysis, enforcement, behavioral analysis, and effectiveness testing require registered owned targets.
# Check target scope
./target/release/waf-detect --scope
# Initialize target scope
./target/release/waf-detect --scope init example.com api.example.com
# Add authorized target
./target/release/waf-detect --scope add-target admin.example.com
# Remove target
./target/release/waf-detect --scope remove-target api.example.com
# Clear target scope
./target/release/waf-detect --scope clear