Waftester, developed by Waftester, is a professional security testing toolkit designed for Web Application Firewalls (WAFs). Built primarily with Go, it helps assess WAF security posture and effectiveness. Its distribution methods include npm/npx, Docker images, direct binary downloads, a GitHub Action, Homebrew tap, Scoop bucket, and an AUR package, making it accessible across various environments. Waftester includes a built-in Model Context Protocol (MCP) server for programmatic control by AI assistants and automation platforms.

What does Waftester connect to?

Waftester connects directly to Web Application Firewalls (WAFs) to evaluate their security posture and effectiveness against various attack vectors. Its primary function is WAF security assessment, providing detailed insights into protection capabilities. The tool incorporates a built-in Model Context Protocol (MCP) server. This server enables programmatic control, allowing for deep integration with AI assistants and diverse automation platforms. This design supports advanced testing scenarios where external systems orchestrate WAF interactions and analysis with precision.

Core features and tools

Waftester exposes 27 MCP tools designed for security testing. Key callable tools include detect_waf for fingerprinting WAF vendors and CDNs, discover to map attack surfaces, and learn for generating prioritized test plans. It also offers scan to fire attack payloads and measure detection and bypass rates, bypass to uncover WAF evasion techniques, and assess to generate a formal security grade. The get_task_status tool is available, aiding in CI/CD workflows.

Who is it for?

Waftester is for security professionals, enterprise teams, security engineers, penetration testers, DevSecOps teams, and API security teams. It supports individuals and groups focused on evaluating and enhancing the protection offered by Web Application Firewalls. The tool assists in identifying vulnerabilities and ensuring WAFs perform as expected against various threats. Skip this if your focus is not on Web Application Firewall security assessment.

How to get started

Access is granted through a standard OAuth authorization flow for remote connections. Remote deployments utilize Streamable HTTP and SSE transport protocols.

Use cases

• End-to-end automated WAF security assessment, including endpoint discovery, WAF vendor identification, bypass technique selection, payload testing, and quantitative reporting.
• AI-assisted interactive WAF security testing, where an AI agent orchestrates tests based on natural language requests.
• CI/CD quality gates to block deployments if WAF protection is insufficient based on scan results.

Waftester provides a specialized toolkit for WAF security assessment, integrating well with AI and automation platforms. Its Go-based architecture and multiple distribution methods make it adaptable for various deployment needs, from local development to CI/CD pipelines. The MCP server and its array of tools enable detailed analysis and reporting on WAF effectiveness.