{"id":42993740,"url":"https://github.com/jreisinger/waf-tester","last_synced_at":"2026-01-31T03:11:31.696Z","repository":{"id":36963666,"uuid":"233541437","full_name":"jreisinger/waf-tester","owner":"jreisinger","description":"Test Web Application Firewalls (WAFs)","archived":false,"fork":false,"pushed_at":"2025-04-16T13:17:44.000Z","size":389,"stargazers_count":5,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-16T19:48:08.948Z","etag":null,"topics":["cli","ftw","security","testing","tool","waf"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jreisinger.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-01-13T07:57:08.000Z","updated_at":"2025-04-16T13:17:42.000Z","dependencies_parsed_at":"2024-02-14T13:43:17.012Z","dependency_job_id":"4cc46082-8984-4fe9-9ea2-95848584efe2","html_url":"https://github.com/jreisinger/waf-tester","commit_stats":{"total_commits":310,"total_committers":3,"mean_commits":"103.33333333333333","dds":0.08387096774193548,"last_synced_commit":"9251d24db1fe0cb13d5f3100b412d53454729d33"},"previous_names":[],"tags_count":67,"template":false,"template_full_name":null,"purl":"pkg:github/jreisinger/waf-tester","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jreisinger%2Fwaf-tester","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jreisinger%2Fwaf-tester/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jreisinger%2Fwaf-tester/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jreisinger%2Fwaf-tester/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jreisinger","download_url":"https://codeload.github.com/jreisinger/waf-tester/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jreisinger%2Fwaf-tester/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28928051,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-31T02:59:34.861Z","status":"ssl_error","status_checked_at":"2026-01-31T02:59:05.369Z","response_time":128,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","ftw","security","testing","tool","waf"],"created_at":"2026-01-31T03:11:31.638Z","updated_at":"2026-01-31T03:11:31.690Z","avatar_url":"https://github.com/jreisinger.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## About\n\nwaf-tester runs tests against a URL protected by a Web Application Firewall (WAF). The tests are HTTP requests defined in YAML format based on [FTW format](https://github.com/CRS-support/ftw/blob/master/docs/YAMLFormat.md). Use '-template' to see how they look like.\n\nThe tests are evaluated by comparing the HTTP response status or WAF logs against the expected values defined in tests. If both 'status' and 'log_contains' are defined in a test only status is evaluated. If '-logs' is not used tests containing only 'log_contains' are skipped.\n\n## Installation\n\n`make install`\n\n## Sample usage\n\nRun some WAF tests against localhost:\n\n```\n# Generate tests and run them against localhost.\nwaf-tester -template \u003e tests.yaml\nwaf-tester -verbose\n\n# Run tests from waf_tests folder and evaluate also logs (NOTE: -logs is kind of experimental).\nwaf-tester -tests waf_tests/ -logs /tmp/var/log/modsec_audit.log\n```\n\nConsider using [waf-runner](https://github.com/jreisinger/waf-runner) to run a WAF on localhost.\n\n## Development\n\n```\nvim main.go\nmake build      # see dist folder\nmake install    # install into ~/go/bin\n```\n\nCheck test coverage:\n\n```\ngo test -coverprofile cover.out ./...\ngo tool cover -html=cover.out\n```\n\nIf the code is slow [profile](https://blog.golang.org/pprof) it.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjreisinger%2Fwaf-tester","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjreisinger%2Fwaf-tester","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjreisinger%2Fwaf-tester/lists"}