gotestwaf: test different web application firewalls (WAF) for detection logic and bypasses

Go Test WAF

An open-source Go project to test different web application firewalls (WAF) for detection logic and bypasses.

How it works

It is a 3-steps requests generation process that multiplies the number of payloads to encoders and placeholders. Let’s say you defined 2 payloads, 3 encoders (Base64, JSON, and URLencode), and 1 placeholder (HTTP GET variable). In this case, the tool will send 2x3x1 = 6 requests in a testcase.

Payload

The payload string you wanna send. Like <script>alert(111)</script> or something more sophisticated. There are no macroses like so far, but it’s in our TODO list. Since it’s a YAML string, use binary encoding if you wanna https://yaml.org/type/binary.html

Encoder

Data encoder the tool should apply to the payload. Base64, JSON unicode (\u0027 instead of ‘), etc.

Placeholder

A place inside HTTP request where encoded payload should be. Like URL parameter, URI, POST form parameter, or JSON POST body.

Install & Use

Copyright (c) 2020 Wallarm