WAF Checker

This project helps you check how well your Web Application Firewall (WAF) protects your product against common web attacks. It can be run as a Cloudflare Worker (with a built-in interactive Web UI) or as a standalone Node.js CLI tool.

🧪 Test Coverage & Status

All packages are thoroughly tested with automated unit, integration, property-based (fast-check fuzzing), network resilience, and reverse engineering suites (100% SSRF safety compliance, protocol evasion techniques, and report formatters):

Package	Line Coverage	Statements	Functions	Test Suite
@waf-checker/core	93.0% 🟢	92.6%	96.4%	🟢 282 passing
@waf-checker/cli	93.5% 🟢	92.8%	96.7%	🟢 54 passing
@waf-checker/worker	Passing 🟢	—	—	🟢 30 passing
Total Monorepo Suite	93.2%	92.7%	96.6%	🟢 366 tests passing

Features

Core Testing

• Enter a target URL, pick HTTP methods (GET, POST, etc.), and attack categories.
• Sends requests with attack payloads (in parameters, headers, or as file paths).
• Color-coded terminal and web results: 🟢 403/BLOCKED = blocked, 🔴 2xx/5xx = potential bypass, 🟠 3xx = redirect.
• Results displayed in a filterable table with details for each payload.

🕵️ WAF Reverse Engineering & CRS Matrix (--reverse)

• OWASP Core Rule Set (CRS v3/v4) Mapping: Audits active vs disabled rule IDs (920xxx, 921xxx, 930xxx, 931xxx, 932xxx, 933xxx, 934xxx, 941xxx, 942xxx, 943xxx, 944xxx) with Paranoia Levels (PL1-PL4).
• Inspection Body Limit Detection: Binary search probing (8KB – 128KB, precision ~1KB) to identify buffer truncation boundaries.
• Anomaly Scoring Mode Detection: Probes collaborative scoring mode vs strict regex blocking mode and identifies score thresholds.
• Safe Rate Limit Probing: Safe ramp-up up to 30 req/s with immediate early termination upon HTTP 429 and Retry-After extraction.

🛡️ WAF Virtual Patching & Auto-Remediation (--patch / patch command)

• Instant Mitigation: Automatically transforms detected WAF bypasses (HTTP 200) into ready-to-deploy firewall rules, reverse proxy configurations, and Infrastructure-as-Code (Terraform HCL / Cloud CLI).
• Supported Platforms (11 Dialects):
  • Cloudflare WAF: Wirefilter expressions (http.request.uri.query contains ... / matches ...) & cloudflare_ruleset Terraform HCL.
  • AWS WAF v2: Native JSON Rule Statements (ByteMatchStatement, RegexPatternSet, OrStatement) & aws_wafv2_rule_group Terraform HCL.
  • Google Cloud Armor: CEL expressions (request.path.matches(...), request.headers[...]), gcloud compute security-policies CLI commands, & Terraform google_compute_security_policy.
  • Azure WAF (Front Door & App Gateway): Custom Rule JSON definitions, az network front-door waf-policy CLI commands, & Terraform azurerm_cdn_frontdoor_firewall_policy.
  • ModSecurity & OWASP Coraza: OWASP CRS-compatible SecRule directives (SecLang) with @pm token collapsing. Supported via --patch modsecurity or --patch coraza.
  • NGINX: Native location ~* \.(ext)$ { return 403; }, location ~ /\.(git|svn), and map configuration blocks.
  • HAProxy: High-performance native ACLs (path_end -i, path_beg -i, query -m sub -i, req.hdr()) with http-request deny deny_status 403.
  • Caddy Server: Idiomatic Caddyfile named matchers (@waf_patch_*) with CEL expressions (expression {http.request.uri.query}.matches(...)) and respond 403.
  • Apache HTTP Server: mod_rewrite rules (RewriteCond %{QUERY_STRING} / %{REQUEST_URI} / %{HTTP_USER_AGENT} + RewriteRule ^ - [F,L]) for httpd.conf, <VirtualHost>, or .htaccess. Supported via --patch apache.
  • Envoy Proxy: Route entries matching :path/headers via RE2 safe_regex with direct_response: 403 (or forward-and-tag in simulate mode) for a route_configuration virtual_host. Supported via --patch envoy.
  • Kubernetes Ingress (K8s): Production-ready kind: Ingress YAML manifests with nginx.ingress.kubernetes.io/server-snippet annotations.
• Dual-Tier Defense:
  • Strict Hotfix: Exact token signatures with 0% false positive risk for immediate zero-day incident response.
  • Heuristic Pattern: Generalized regular expressions covering the entire vulnerability class structure.
• Web UI Remediation Studio: Interactive dashboard modal with live previews across all vendors, 1-click clipboard copy, format toggles, and file export.

Attack Categories (28 total)

SQL Injection, XSS, Command Injection, Path Traversal, SSRF, Local File Inclusion, Sensitive Files, Open Redirect, SSTI, XXE, NoSQL Injection, GraphQL Injection, JWT Attack (Header), JWT Attack (Param), Prototype Pollution (JSON Body), Prototype Pollution (URL/Param), LDAP Injection, XPath Injection, Spreadsheet Formula Injection, Log4Shell (JNDI), CRLF Injection, HTTP Parameter Pollution, User-Agent, IP Bypass, HTTP Request Smuggling, Web Cache Poisoning, UTF8/Unicode Bypass, WAF Inspection Limit Bypass (Padding).

WAF Detection

• Auto-detect WAF type before testing (Cloudflare, AWS WAF, OWASP Coraza, BunkerWeb, ModSecurity, Akamai, Imperva, F5 BIG-IP, etc.).
• Suggests specific bypass techniques based on detected WAF.
• Can auto-switch to WAF-specific advanced payloads.

Advanced Payloads & Encoding

• WAF Bypass Payloads — double encoding, unicode, mixed case, comment injection, polyglot payloads.
• Enhanced Payloads — modern evasion techniques.
• Encoding Variations — URL, Unicode, HTML Entity, Hex, Octal, Base64 encoding with automatic combinations.
• WAF-specific bypasses for Cloudflare, AWS WAF, ModSecurity.

HTTP Protocol Manipulation

• HTTP Verb Tampering — test uncommon HTTP methods.
• Parameter Pollution — duplicate and split parameters across query/body.
• Content-Type Confusion — alternate content types to bypass rules.
• Request Smuggling headers.
• Host Header Injection variations.
• HTTP Method Override via headers (X-HTTP-Method-Override, etc.).

Batch Testing

• Test multiple URLs at once.
• Configurable concurrency and delay between requests.
• Real-time progress tracking.

🔀 Regression Diffing (--compare / --fail-on-regression)

• Diff a scan against a previously saved JSON report to surface new bypasses (previously blocked, now not), newly blocked payloads, and added/removed tests.
• CI gate (--fail-on-regression) that fails only on worsening WAF posture, not on the full result list — ideal for catching managed-ruleset drift.

---

Project Structure

The project is structured as an NPM Workspaces monorepo: