Wafme0w

wafw00f's fingerprints. Go speed. Pipeline-native.

172 WAF product identities, built on wafw00f's fingerprints.
A Go CLI and library for live HTTP and offline saved-response analysis.

Quick start · Moving from wafw00f · Benchmarks · Documentation

Open full-size split demo

Why wafmeow?

wafmeow is a wafw00f alternative for WAF detection in Go, built on the upstream project's fingerprint work. It brings fast WAF fingerprinting into concurrent, structured pipelines for teams that need to detect WAF at scale.

• 172 product identities in the catalogue. Fingerprints are ported from wafw00f, with upstream credit and licence notices. Probe behavior and evidence semantics differ; catalogue size does not prove equivalent detection on every target.
• Static Go release binaries. No Python, pip or virtualenv is required to scan or classify saved responses. Optional browser capture needs Chromium.
• JSONL, JSON and CSV output. Stream to jq, notification tools or a database, while keeping human diagnostics on stderr.
• Offline response analysis. Re-analyse native captures or supported httpx exports without sending another request.
• Request, redirect and connection budgets. Bound acquisition and apply explicit scope rules across redirects.
• An importable Go library. Use the same evidence classifier in your own application through the v3 API.

From discovery to JSONL

# Set AUTHORIZED_DOMAIN to a domain you own or are authorized to test.
set -o pipefail
subfinder -d "${AUTHORIZED_DOMAIN:?set an authorized domain}" -silent |
  httpx -silent |
  wafmeow --target-file - --fast --jsonl --silent

This pipeline uses --fast for a quick active scan of each discovered URL. For existing httpx response exports, use the offline import pipeline.

1. Build

Build with Go 1.26 or newer, using a security-patched toolchain. Release builds use Go 1.27.3.

git clone https://github.com/Lu1sDV/wafmeow.git
cd wafmeow
go build -o wafmeow ./cmd/wafmeow
./wafmeow --help

For production, use a release that passes the release validation gates. The v1.0.0 downloads predate the security hardening in this source tree.

Prebuilt binaries, the Go module and Homebrew install are in Releases and installation:

go install github.com/Lu1sDV/wafmeow/v3/cmd/wafmeow@latest
brew install Lu1sDV/tap/wafmeow

The /v3 Go install command requires a published v3 release. Before that release, build from the source checkout above; Homebrew continues installing the latest published stable version.

2. Scan an authorized target

# Use your own local HTTP server on port 8080.
./wafmeow --target http://127.0.0.1:8080 --fast

This prints a human-readable result. Use --target / -t for a URL and repeat it for several URLs. Use --target-file PATH for a file of URL lines, or --target-file - for stdin. --input PATH and -I PATH remain equivalent spellings of --target-file PATH. Choose one input source; saved responses use --evidence for offline analysis.

Goal	Choose	Collection
Quick active fingerprinting	--fast	Normal, no-user-agent and combined probe
Broader active probing	--deep	Eight selected request types; also the default when no mode is given
Inspect normal responses only	--baseline	One normal request, without active probes
Reuse saved responses	--evidence FILE	Offline classification, without new requests

--baseline can find fingerprints already present in an ordinary response. Use it when you want normal HTTP inspection without active probes; it is not a setup step for --fast or --deep. The three live modes are mutually exclusive, and redirects and budgets affect actual request counts. See collection modes and payloads for the trade-offs.

ProjectDiscovery httpx pipelines

# Discover URLs, then send new wafmeow requests:
httpx -l authorized-hosts.txt -silent |
  ./wafmeow --target-file - --fast --jsonl --silent

# Classify exported responses without additional requests:
httpx -l authorized-hosts.txt -silent -json -irr -probe -rstr 1048576 -rsts 1048576 |
  ./wafmeow --evidence - --evidence-format httpx --jsonl --silent