WAF Checker is a lightweight tool for verifying Web Application Firewall (WAF) effectiveness
against common web attacks. It helps security professionals and developers identify gaps in WAF
rules.
🚀 Key Features
- Check Button (▶): Runs the selected payload tests against the target URL.
- Detect WAF (🛡️): Identifies the WAF vendor protecting the site.
- HTTP Tests (🔄): Checks for HTTP verb tampering and method handling issues.
- Batch Test (📋): Allows scanning multiple URLs in sequence.
🎯 Settings & Options
- HTTP Methods: Select which methods (GET, POST, etc.) to use for testing.
- Follow Redirects: Inspects responses even if the server redirects (3xx).
- Case Sensitive: Tests if WAF rules are case-sensitive (e.g., matching
'select' but missing 'SELECT').
- False Positive Test: Inverts the logic to check if legitimate traffic is
being blocked. (200 OK = Good, 403 Forbidden = Bad).
- WAF Bypass Payloads: Uses advanced techniques (obfuscation, encoding) to
try and evade detection.
- Auto-detect WAF: Attempts to identify the WAF before running tests to
tailor payloads.
Note: Always ensure you have permission to scan the target URL.