{"id":13774062,"url":"https://github.com/microsoft/wafbench","last_synced_at":"2025-08-22T07:38:26.445Z","repository":{"id":52426680,"uuid":"138645963","full_name":"microsoft/WAFBench","owner":"microsoft","description":"WAFBench (wb) is a tool to measure the performance of WAF(Web Application Firewall) . It's based on latest code of ab (ApacheBench), and adds support for real trace replaying, framework of testing waf (FTW), and some other features.","archived":false,"fork":false,"pushed_at":"2022-09-08T15:16:47.000Z","size":1919,"stargazers_count":112,"open_issues_count":1,"forks_count":26,"subscribers_count":18,"default_branch":"master","last_synced_at":"2025-08-17T20:05:43.789Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://github.com/microsoft/waflab","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/microsoft.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null}},"created_at":"2018-06-25T20:23:14.000Z","updated_at":"2025-06-29T18:42:33.000Z","dependencies_parsed_at":"2023-01-18T01:15:56.772Z","dependency_job_id":null,"html_url":"https://github.com/microsoft/WAFBench","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/microsoft/WAFBench","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FWAFBench","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FWAFBench/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FWAFBench/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FWAFBench/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/microsoft","download_url":"https://codeload.github.com/microsoft/WAFBench/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FWAFBench/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271605867,"owners_count":24788968,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-22T02:00:08.480Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:23.322Z","updated_at":"2025-08-22T07:38:26.419Z","avatar_url":"https://github.com/microsoft.png","language":"C","funding_links":[],"categories":["\u003ca id=\"58b6684347a223e01d4d76d9ca185a88\"\u003e\u003c/a\u003eReplay\u0026\u0026重播","Awesome Tools"],"sub_categories":["Testing:"],"readme":"# WAF Bench (WB) Tool Suits\n[![Build Status](https://travis-ci.org/microsoft/WAFBench.svg?branch=master)](https://travis-ci.org/Microsoft/WAFBench)\n```text\n\n/\\ \\  _ \\ \\   /\\  __ \\   /\\  ___\\    /\\  == \\   /\\  ___\\   /\\ \"-.\\ \\   /\\  ___\\   /\\ \\_\\ \\\n\\ \\ \\/ \".\\ \\  \\ \\  __ \\  \\ \\  __\\    \\ \\  __\u003c   \\ \\  __\\   \\ \\ \\-.  \\  \\ \\ \\____  \\ \\  __ \\  \n \\ \\__/\".~\\_\\  \\ \\_\\ \\_\\  \\ \\_\\       \\ \\_____\\  \\ \\_____\\  \\ \\_\\\\\"\\_\\  \\ \\_____\\  \\ \\_\\ \\_\\\n  \\/_/   \\/_/   \\/_/\\/_/   \\/_/        \\/_____/   \\/_____/   \\/_/ \\/_/   \\/_____/   \\/_/\\/_/\n\n```\n\nWAF (Web Application Firewall) Bench tool suits is designed to verify the correctness and measure the performance of WAF.\n\n## Motivation\n\n### Real Traffic Performance Testing\n\nThe WAF's performance fluctuates greatly as the input traffic varies. The existing tool, i.e. `ab`, can test the performance under only one kind of customized request, which can not reproduce the real traffic scenario. In addition, `ab` can only customize some fields of the request, which is inconvenient for testing.\n\nIn order to get the performance experienced by the real customer and further improve WAF's efficiency, we build `wb`, an ab-like tool, which could send multiple and fully-customized packets in one invoking. Besides, WAF Bench tool suits accepts YAML-based input, which can customize your packet and reproduce multiple different packets easily.\n\n### Automatic WAF Correctness Testing\n\nAutomatic WAF correctness testing can relieve developers from the heavy and tedious verifying works. There are two important factors for conducting a WAF correctness testing: the testing framework and test cases.\n\nFor the testing framework, we provide a `FTW-Compatible Tool` which leverages `wb` as its underlying tool. Its performance is better than FTW.\n\nFor test cases, we provide several generators for different purposes:\n\n- Generate YAML files from the real traffic logs.\n- Generate YAML files from the WAF rule set.\n\nCurrently, they are still in development.\n\n## Feature\n\n![Feature](./Architecture.png)\n\n### WAF Bench\n\nWAF Bench (wb) is the ab-like tool for conducting performance testing.\n\n* M0 - Send/Receive HTTP\u0026HTTPS requests/responses\n* M0 - Report performance statistics\n* M0 - Set the limit of testing time or total request number in testing\n* M0 - Support customized packets input\n* M0 - Provide debug mode with 4 level\n* M0 - Support automatically adding sequence number in URL\n* M0 - Support request rate limit\n* M2 - Support docker app\n\n### Python-based WAF Bench\n\nPython WAF Bench (pywb) is an enhanced tools of wb.\n\n* M1 - Compatible with wb\n* M1 - Send multiple file and directories in once executing.\n* M1 - Infer Content-Type from the file extension automatically\n* M2 - ~~Support pip install~~\n* M2 - Support docker app\n\n### FTW-compatible Tool\n\n* M2 - Generate traffic form YAML file (in the format of FTW framework)\n* M2 - Generate comparison condition file from YAML files\n* M2 - Support *status*, *log_contains*, *no_log_contains*, *expect_error* directives as FTW framework\n* M2 - Can search the compare result by test title and give out very detailed results (raw YAML, raw request, raw response, compare result)\n* M2 - Support docker app\n\n### Auto-Test Generator\n\n* M3 - Automatically generate requests by ModSecurity rule set for testing the coverage of WAF\n\n## Usage\n\n### **Install by Dockerfile (*Recommended*)**\n\nUsing WAFBench at Docker environment is the easiest and recommended method.\n- **Docker** is necessary for build and usage.\n\n``` bash\n# Install Docker\ncurl -fsSL get.docker.com -o get-docker.sh\nsudo sh get-docker.sh\n# Clone this repository\ngit clone https://github.com/microsoft/WAFBench.git\n# Build WAFBench\ndocker build -t wafbench WAFBench\n```\n\n- Commands\n\nIf you install WAFBench by Dockerfile, [wb](wb), [pywb](pywb), [ftw_compatible_tool](ftw_compatible_tool) has been install in image wafbench. You can use them just as a local application by below commands:\n\n``` bash\ndocker run -ti --rm wafbench wb\ndocker run -ti --rm wafbench pywb\ndocker run -ti --rm wafbench ftw_compatible_tool\n```\n\nThe detail usage can be found at their corresponding sections.\n\n- Example\n\nThe black box regression test with crs-v3.1 (please replace hostname and port to the service under test)\n\n``` bash\ndocker run -ti --rm -v `pwd`:/data --rm wafbench ftw_compatible_tool -d /data/regression.db -x \"load util/regression-test/crs-v3.1/black-box/ | gen | start hostname:port| report | exit\"\n```\n\nThe result file is regression.db with sqlite3 format, you can open it by [DB Browser for SQLite](https://sqlitebrowser.org/).\n\n\n### **Install at native machine**\n\n#### Prerequisites\n\nSome software or libraries may be necessary for further build / usage. All of them are listed below:\n\n- **C Compiler** with good C11 support (tested with gcc 4.8)\n- **C++ Compiler** with good C++11 support (tested with g++ 4.8)\n- **pthread** library (tested with glibc 2.17, which includes pthread)\n- **GNU Make** (tested with GNU Make 3.82)\n- **libev** library (tested with libev 4.0.0)\n- **CMake** 2.8 or higher (tested with CMake 2.8)\n- **Boost** libraries (tested with 1.53.0)\n- **Python** 2 (tested with 2.7.5)\n- **pip** python package management tool (tested with 8.1.2)\n- **ftw** python module (tested with ftw 1.1.4)\n- **wget** library (tested with wget-1.14-15.e17_4.1)\n- **expat** library (tested with expat-devel-2.1.0-10.e17_3)\n- **openssl** library (tested with openssl-devel-1.0.2k-12.e17)\n\nThe WB tool suites are developed and tested under CentOS 7 (Linux version 3.10, AMD 64 architecture) in a 32 core (Intel Xeon E5 @ 2.30GHz) Server.\n\n**Note**: If you don't aim to conduct complex WAF testing tasks there is a *cheat sheet* below summarizing common testing instructions ranging from install to usage, by which you can focus on your goal; The *Advance Usage* section just gives you more detailed information of WB if considering it as a black box cannot satisfy your demand.\n\n#### Cheat Sheet\n\nThis tutorial is based on CentOS 7 (Linux version 3.10, AMD 64 architecture). WB also can work on other Linux distribution since there is no dependencies on CentOS.\n\n#### Install Dependencies\n\n##### On CentOS:\n\nBefore installing dependencies using yum in CentOS, we recommend you to enable the EPEL repo to find some packages listed below (`yum --enablerepo=extras install epel-release`).\n\nHowever you can find these packages in your own source using 'yum search ...'\n\n```bash\nsudo yum install gcc gcc-c++ make                # Install build-essential\nsudo yum install libev-devel.x86_64              # Install development headers for libev\nsudo yum install cmake                           # Install CMake\nsudo yum install boost-devel.x86_64              # Install boost libraries\nsudo yum install python2                         # Install python2\nsudo yum install python2-pip.noarch              # Install python2 pip\nsudo pip install ftw                             # Install ftw module\nsudo yum install wget.x86_64                     # Install wget\nsudo yum install expat-devel                     # Install expat\nsudo yum install openssl-devel                   # Install openssl\n```\n\nor just type\n\n```bash\nsudo yum install gcc gcc-c++ make libev-devel.x86_64 cmake boost-devel.x86_64 python2 python2-pip.noarch wget.x86_64 expat-devel openssl-devel\nsudo pip install ftw\n```\n\n#### Download WB tools suits\n\nJust clone this repo to your machines.\n\n```bash\ngit clone git@github.com:Microsoft/WAFBench.git\n```\n\n#### Install wb\n\nPlease refer to [wb Readme](./wb/README.md)\n\n```bash\ncd wb\nmake\nmake install\n```\n\n#### Conduct Performance Test / AB-like Test\n\nAssuming that the server is at 10.0.1.1:18081 running we can:\n\n```bash\n./pywb/main.py -t 10 -c 20  10.0.1.1:18081\n```\n\nOr send requests from a file such as *requests.dat*:\n\n```bash\n./pywb/main.py -t 10 -c 25 -F ./example/packets/test-2-packets.yaml 10.0.1.1:18081\n```\n\n* More information about **[pywb](./pywb/)**, please refer to [pywb Readme](./pywb/README.md)\n* About the format of request file, please refer to [wb Readme](./wb/README.md)\n\n### Advance Usage\n\nSince the components are independent to each other, the detailed build, install and use tutorials are maintained in their own folder. You can access them at:\n\n* [wb](./wb/README.md)\n* [pywb](./pywb/README.md)\n* [ftw_compatible_tool](./ftw_compatible_tool/README.md)\n\n## Attributions\n\nWB uses the following libraries.\n\n```text\nFramework for Testing WAFs (FTW!)\n\nhttps://github.com/fastly/ftw\n\nCopyright 2016 Fastly\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n\n## Changelog\n\nFor changelog, you may refer to [CHANGELOG.md](CHANGELOG.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmicrosoft%2Fwafbench","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmicrosoft%2Fwafbench","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmicrosoft%2Fwafbench/lists"}