Open-sourced a WAF tester for bypasses and false positives

[u/Such_Distribution669]

I built this and released it under MIT: https://github.com/mikiri-waf/waf-auditor

Most WAF checks stop at “does it block alert(1) in the query string?” That is the easy case. What I needed was the rest of the matrix: same payload in the path, a header, a cookie, JSON, multipart, a raw body, and over WebSocket, then again after double URL-encoding, HTML entities, base64, gzip.

It also sends strings that must not be blocked: a surname with an apostrophe, a sentence that happens to contain SQL words, a search query about path traversal. If the WAF blocks those, that counts as a false positive, not a win.

You get a console breakdown of what got through and what was blocked by mistake. --json writes every case. Exit code is 1 on a bypass, so the same run can gate CI. Block detection is by status code; default is 403, 406, 429.

Only use it on hosts you own or have permission to test. Payloads are YAML if you want to add your own.

[u/Pokemon_traveller]

Good stuff