{"id":33224147,"url":"https://github.com/coreruleset/ftw","last_synced_at":"2026-02-04T06:13:15.473Z","repository":{"id":42661327,"uuid":"93791495","full_name":"coreruleset/ftw","owner":"coreruleset","description":"Framework for Testing WAFs (FTW!)","archived":false,"fork":false,"pushed_at":"2024-05-14T18:04:59.000Z","size":435,"stargazers_count":134,"open_issues_count":8,"forks_count":36,"subscribers_count":19,"default_branch":"main","last_synced_at":"2025-11-27T17:58:34.705Z","etag":null,"topics":["modsecurity","owasp","security-tools","waf"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coreruleset.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-06-08T21:00:49.000Z","updated_at":"2025-11-22T11:02:01.000Z","dependencies_parsed_at":"2024-06-18T22:42:51.603Z","dependency_job_id":"79fc45c7-f700-4a02-9e9a-abd583abb9ae","html_url":"https://github.com/coreruleset/ftw","commit_stats":{"total_commits":339,"total_committers":19,"mean_commits":"17.842105263157894","dds":0.7699115044247787,"last_synced_commit":"10a82e622860ea8ee115039e1e18906ccbf92379"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/coreruleset/ftw","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fftw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fftw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fftw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fftw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coreruleset","download_url":"https://codeload.github.com/coreruleset/ftw/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fftw/sbom","scorecard":{"id":304853,"data":{"date":"2025-08-11","repo":{"name":"github.com/coreruleset/ftw","commit":"10a82e622860ea8ee115039e1e18906ccbf92379"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.8,"checks":[{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/publish.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/ftw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/ftw/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/ftw/publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/ftw/publish.yml/main?enable=pin","Warn: pipCommand not pinned by hash: .github/workflows/ci.yml:23","Warn: pipCommand not pinned by hash: .github/workflows/ci.yml:28","Warn: pipCommand not pinned by hash: .github/workflows/ci.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:20","Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:21","Info:   0 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   5 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T21:47:00.431Z","repository_id":42661327,"created_at":"2025-08-17T21:47:00.431Z","updated_at":"2025-08-17T21:47:00.431Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29072850,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-04T03:31:03.593Z","status":"ssl_error","status_checked_at":"2026-02-04T03:29:50.742Z","response_time":62,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["modsecurity","owasp","security-tools","waf"],"created_at":"2025-11-16T16:00:36.685Z","updated_at":"2026-02-04T06:13:15.467Z","avatar_url":"https://github.com/coreruleset.png","language":"Python","readme":"## Framework for Testing WAFs (FTW)\n![Build Status](https://github.com/coreruleset/ftw/workflows/ci/badge.svg?branch=master)\n[![PyPI version](https://badge.fury.io/py/ftw.svg)](https://badge.fury.io/py/ftw)\n\n##### Purpose\nThis project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules. Users can verify the execution of the rule after the tests are issued to make sure the expected response is received from an attack\n\nGoals / Use cases include:\n\n* Find regressions in WAF deployments by using continuous integration and issuing repeatable attacks to a WAF\n* Provide a testing framework for new rules into ModSecurity, if a rule is submitted it MUST have corresponding positive \u0026 negative tests\n* Evaluate WAFs against a common, agreeable baseline ruleset (OWASP)\n* Test and verify custom rules for WAFs that are not part of the core rule set\n\nFor our 1.0 release announcement, check out the [OWASP CRS Blog](https://coreruleset.org/20170810/testing-wafs-ftw-version-1-0-released/)\n\n## Installation\n* `git clone https://github.com/coreruleset/ftw.git`\n* `cd ftw`\n* `virtualenv env \u0026\u0026 source ./env/bin/activate` \n* `pip install -r requirements.txt`\n* `py.test -s -v test/test_default.py --ruledir=test/yaml`\n\n## Writing your first tests\nThe core of FTW is it's extensible `yaml` based tests. This section lists a few resources on how they are formatted, how to write them and how you can use them.\n \nOWASP CRS wrote a great [blog post](https://coreruleset.org/20170915/writing-ftw-test-cases-for-owasp-crs/) describing how FTW tests are written and executed. \n\n[YAMLFormat.md](https://github.com/coreruleset/ftw/blob/master/docs/YAMLFormat.md) is ground truth of all `yaml` fields that are currently understood by FTW.\n\nAfter reading these two resources, you should be able to get started in writing tests. You will most likely be checking against status code responses, or web request responses using the `log_contains` directive. For integrating FTW to test regexes within your WAF logs, refer to [ExtendingFTW.md](https://github.com/coreruleset/ftw/blob/master/docs/ExtendingFTW.md)\n\n## Provisioning Apache+Modsecurity+OWASP CRS\nIf you require an environment for testing WAF rules, there has been one created with Apache, Modsecurity and version 3.0.0 of the OWASP core ruleset. This can be deployed by:\n\n* Checking out the repository: ``git clone https://github.com/fastly/waf_testbed.git``\n* Typing ```vagrant up```\n","funding_links":[],"categories":["Awesome Tools"],"sub_categories":["Testing:"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoreruleset%2Fftw","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoreruleset%2Fftw","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoreruleset%2Fftw/lists"}