# 🛡️ WAF Stressor
WAF Stressor is a production-grade assessment engine designed for ethical security research, penetration testing, and bug bounty operations.
It provides advanced URL normalization fuzzing, payload mutation, and multi-signal WAF fingerprinting to identify bypass vectors and inconsistent filtering behaviors.
---
# 📘 Table of Contents
- [✨ Features]
- [📦 Installation]
- [🚀 Quick Start]
- [📖 Usage Examples]
- [🎛️ Command-Line Options]
- [📊 Understanding Output]
- [📁 Report Formats]
- [🎯 Use Cases]
- [🔬 Payload Files]
- [🛠️ Advanced Configuration]
- [📈 Performance Tips]
- [🔍 Result Analysis]
- [⚠️ Legal & Ethical Use]
- [📝 Contributing]
- [📄 License]
- [🔗 Links]
- [🙏 Acknowledgments]
---
# ✨ Features
- 🔍 **WAF Detection & Fingerprinting**
Detects 15+ major WAF vendors (Cloudflare, Akamai, AWS, Imperva, F5, ModSecurity, etc.)
- 🎯 **URL Normalization Testing**
15+ URL mangling techniques to detect bypass vectors
- 💣 **Payload Mutation Engine**
Encodings, obfuscation layers, variant generation
- 📊 **Advanced Metrics**
Includes UI, NF, MP, PP, CC, SC
- 🚨 **Automated Finding Generation**
Bypass identification, inconsistencies, normalization flaws
- 📁 **Multi-Format Reports**
JSON, Markdown, HTML, CSV, SARIF (CI/CD compatible)
- ⚡ **Rate Limiting & Backoff**
429-aware with exponential backoff
- 🔄 **Batch Scanning**
Multi-target support, error recovery, progress tracking
---
# 📦 Installation
## Requirements
- Python **3.8+**
- pip
## Quick Install
```bash
git clone https://github.com/theghostshinobi/waf-stressor.git
cd waf-stressorpip install httpx richpython run.py https://example.com --budget 50python run.py https://example.com \
--payload-file xss-payloads.txt \
--profile light \
--budget 50python run.py https://example.com \
--payload-file xss-payloads.txt \
--profile deep \
--budget 100 \
--rate 0.5 \
--no-verify-tlspython run.py https://target.com --profile light --budget 30python run.py https://target.com \
--payload-file xss-payloads.txt \
--profile deep \
--budget 200 \
--rate 1.0 \
--output-dir target_scanpython run.py https://cloudflare-protected.com \
--payload-file xss-payloads.txt \
--budget 50 \
--rate 0.5 \
--no-verify-tlspython waf-stressor-engine.py \
-t targets.txt \
-f xss-payloads.txt \
--budget 30 \
--rate 1.0 \
--format jsonpython cli.py \
-t targets.txt \
-f payloads.txt \
--profile deep \
--budget 100 \
--rate 0.5 \
--delay 10 \
--format md \
--verboseShow Single Target (run.py)
| Option | Description | Default |
|---|---|---|
--profile |
light / deep | light |
--budget |
Max requests | 50 |
--rate |
Requests/sec | 1.0 |
--payload-file |
Payload file | payloads.txt |
--output-dir |
Results dir | scan_results |
--no-verify-tls |
Disable TLS checks | False |
--timeout |
Request timeout | 30 |
--max-redirects |
Redirect limit | 5 |
| Option | Description | Default |
|---|---|---|
-t |
Targets file | Required |
-f |
Payload file | xss-payloads.txt |
-o |
Output dir | results |
-p |
Profile | light |
-b |
Budget | 50 |
-r |
Rate | 0.5 |
--format |
json, md, csv, sarif, html | json |
-v |
Verbose | False |
| Option | Description | Default |
|---|---|---|
-d |
Delay between targets | 10 |
--timeout |
Scan timeout | 300 |
--tls-verify |
Enable TLS verify | False |
--stop-on-error |
Halt on errors | False |
============================================================
✅ SCAN COMPLETE
Target: https://example.com
Profile: LIGHT
Total Requests: 48
Elapsed: 49.35s
Success Rate: 100%
WAF DETECTED: cloudflare
| Metric | Meaning |
|---|---|
| UI | Uniformity Index |
| NF | Normalization Factor |
| MP | Mutation Potency |
| PP | Payload Penetration |
| CC | Consistency Coefficient |
| SC | Status Code Variance |
- JSON — structured data
- Markdown — human readable
- HTML — color-coded UI
- CSV — quick parsing
- SARIF — GitHub/CI integration
python run.py https://target.hackerone.com/api \
--payload-file xss-payloads.txt \
--budget 100 \
--rate 0.3 \
--no-verify-tls \
--output-dir bounty_resultspython cli.py -t client-targets.txt -f payloads.txt --profile deep --budget 200 --format md --verboseFormat:
payload | category | description
Example:
<script>alert(1)</script> | xss_benign | Basic XSS test
' OR '1'='1 | sql_benign | SQL injection probe
../../../etc/passwd | path_traversal | Traversal test
Show Advanced Configuration
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtpython run.py https://target.com --rate 0.2 --budget 20 --delay 5config = TestConfig(
target_url="https://example.com",
custom_headers={
'User-Agent': 'Custom-Agent/1.0',
'X-Custom-Header': 'value'
}
)- Quick scans: budget 20–30
- Standard scans: 50–100
- Deep scans: 150–300
- Aggressive WAF → rate: 0.2–0.5
jq '.waf_fingerprint'
jq '.findings[]'
jq '(.metrics.blocked_requests / .metrics.total_requests * 100)'
jq '.results[] | select(.blocked==false)'Only test systems you own or have explicit authorization for. Unauthorized testing may be illegal.
Fork → Branch → PR (with full description).
MIT License.
- Repository https://github.com/theghostshinobi/waf-stressor
- Issues https://github.com/theghostshinobi/waf-stressor/issues
Built for security researchers, red teams, and bug bounty professionals. Happy hunting! 🎯