sech0us3/waf-checkerAutomated WAF assessment tool that detects firewall vendors, tests 19 attack categories with advanced evasion payloads, and provides color-coded bypass analysis via CLI, Cloudflare Worker, or Docker.
This project helps you check how well your Web Application Firewall (WAF) protects your product against common web attacks. It can be run as a Cloudflare Worker (with a built-in interactive Web UI) or as a standalone Node.js CLI tool.
All packages are thoroughly tested with automated unit, integration, property-based (fast-check fuzzing), network resilience, and reverse engineering suites (100% SSRF safety compliance, protocol evasion techniques, and report formatters):
| Package | Line Coverage | Statements | Functions | Test Suite |
|---|---|---|---|---|
@waf-checker/core | 93.0% 🟢 | 92.6% | 96.4% | 🟢 282 passing |
@waf-checker/cli | 93.5% 🟢 | 92.8% | 96.7% | 🟢 54 passing |
@waf-checker/worker | Passing 🟢 | — | — | 🟢 30 passing |
| Total Monorepo Suite | 93.2% | 92.7% | 96.6% | 🟢 366 tests passing |
--reverse)920xxx, 921xxx, 930xxx, 931xxx, 932xxx, 933xxx, 934xxx, 941xxx, 942xxx, 943xxx, 944xxx) with Paranoia Levels (PL1-PL4).Retry-After extraction.--patch / patch command)http.request.uri.query contains ... / matches ...) & cloudflare_ruleset Terraform HCL.ByteMatchStatement, RegexPatternSet, OrStatement) & aws_wafv2_rule_group Terraform HCL.request.path.matches(...), request.headers[...]), gcloud compute security-policies CLI commands, & Terraform google_compute_security_policy.az network front-door waf-policy CLI commands, & Terraform azurerm_cdn_frontdoor_firewall_policy.SecRule directives (SecLang) with @pm token collapsing. Supported via --patch modsecurity or --patch coraza.location ~* \.(ext)$ { return 403; }, location ~ /\.(git|svn), and map configuration blocks.path_end -i, path_beg -i, query -m sub -i, req.hdr()) with http-request deny deny_status 403.@waf_patch_*) with CEL expressions (expression {http.request.uri.query}.matches(...)) and respond 403.mod_rewrite rules (RewriteCond %{QUERY_STRING} / %{REQUEST_URI} / %{HTTP_USER_AGENT} + RewriteRule ^ - [F,L]) for httpd.conf, <VirtualHost>, or .htaccess. Supported via --patch apache.:path/headers via RE2 safe_regex with direct_response: 403 (or forward-and-tag in simulate mode) for a route_configuration virtual_host. Supported via --patch envoy.kind: Ingress YAML manifests with nginx.ingress.kubernetes.io/server-snippet annotations.SQL Injection, XSS, Command Injection, Path Traversal, SSRF, Local File Inclusion, Sensitive Files, Open Redirect, SSTI, XXE, NoSQL Injection, GraphQL Injection, JWT Attack (Header), JWT Attack (Param), Prototype Pollution (JSON Body), Prototype Pollution (URL/Param), LDAP Injection, XPath Injection, Spreadsheet Formula Injection, Log4Shell (JNDI), CRLF Injection, HTTP Parameter Pollution, User-Agent, IP Bypass, HTTP Request Smuggling, Web Cache Poisoning, UTF8/Unicode Bypass, WAF Inspection Limit Bypass (Padding).
X-HTTP-Method-Override, etc.).--compare / --fail-on-regression)--fail-on-regression) that fails only on worsening WAF posture, not on the full result list — ideal for catching managed-ruleset drift.The project is structured as an NPM Workspaces monorepo: