WAF Checker

WAF Checker © 2026

SQL Injection

XSS

Command Injection

Path Traversal

SSRF

Local File Inclusion

Sensitive Files

Open Redirect

SSTI

XXE

NoSQL Injection

GraphQL Injection

JWT Attack (Header)

JWT Attack (Param)

Prototype Pollution (JSON Body)

Prototype Pollution (URL/Param)

LDAP Injection

CRLF Injection

HTTP Parameter Pollution

User-Agent

IP Bypass

HTTP Request Smuggling

Web Cache Poisoning

UTF8/Unicode Bypass

WAF Inspection Limit Bypass (Padding)

Read my blog at yoursec.substack.com

⚠️

🛡️ WAF Detection Results

🕵️ WAF Reverse Engineering & CRS Matrix

📈 Test Analytics

Include analysis

Settings

HTTP Methods

GET POST PUT DELETE

🎯 Testing Options

Follow 3xx redirects

Case sensitive test

False Positive Test

⚡ Advanced Payloads

WAF Bypass Payloads

Enhanced Payloads

Encoding variations

🔌 Protocol Testing

Auto-detect WAF

HTTP Manipulation

Buffer Padding Evasion

Legit User-Agent bypass test

Padding Size:

📝 Custom Headers

📄 Request Body Template

Use {PAYLOAD} as a placeholder ❤️ Say Thanks

🔄 Batch Testing

URLs to Test (one per line, max 100):

Enter HTTP/HTTPS URLs, one per line. Invalid URLs will be ignored.

Max Concurrent Requests:

Delay Between Requests (ms):

Client-side delay to avoid overwhelming target servers

Use current test settings (methods, categories, advanced options)

Progress 0%

Current URL: -

Completed: 0 / 0

Estimated time remaining: -

Batch Results Summary

🛡️ WAF Virtual Patching Studio (Auto-Remediation)

🛡️ No bypasses detected! All tested attack vectors were successfully blocked by your WAF. No virtual patches are currently required.

Vectors:

Tier:

Action:

Format:

Scope to Endpoint Path

native

0 rules generated

About WAF Checker

WAF Checker is a lightweight tool for verifying Web Application Firewall (WAF) effectiveness against common web attacks. It helps security professionals and developers identify gaps in WAF rules.

🚀 Key Features

Check Button (▶): Runs the selected payload tests against the target URL.
Detect WAF (🛡️): Identifies the WAF vendor protecting the site.
HTTP Tests (🔄): Checks for HTTP verb tampering and method handling issues.
Batch Test (📋): Allows scanning multiple URLs in sequence.

🎯 Settings & Options

HTTP Methods: Select which methods (GET, POST, etc.) to use for testing.
Follow Redirects: Inspects responses even if the server redirects (3xx).
Case Sensitive: Tests if WAF rules are case-sensitive (e.g., matching 'select' but missing 'SELECT').
False Positive Test: Inverts the logic to check if legitimate traffic is being blocked. (200 OK = Good, 403 Forbidden = Bad).
WAF Bypass Payloads: Uses advanced techniques (obfuscation, encoding) to try and evade detection.
Auto-detect WAF: Attempts to identify the WAF before running tests to tailor payloads.

Note: Always ensure you have permission to scan the target URL.

⏰ Automated Daily WAF Monitoring & Alerts

Schedule regular daily security audits of your perimeter. Get notified by email (waf@secmy.app) whenever your WAF posture changes, bypasses are detected, or new vulnerabilities emerge.

Target URL

The endpoint or website to be audited once a day.

Alert Email Address

Where daily change reports and security alerts will be delivered.

🛡️

Ownership Confirmation (Anti-Abuse & Anti-Spam)

• Matching Domain: If your email domain matches the target website (e.g. alex@example.com for example.com), a 1-click confirmation link is sent directly to your inbox.
• External / Public Email: If using a public webmail (Gmail, etc.) or different domain, you will confirm via email and place a verification challenge token at /.well-known/secmy-check.txt.

🔐

Zero-Knowledge Email Privacy & Rate Limiting

All emails are encrypted at rest with AES-256-GCM using an isolated Cloudflare Secret key. Blind HMAC-SHA256 indexing is used for lookups. Scans run strictly once per day per target domain. Every email includes a standard 1-click unsubscribe link.

🛡️ Security Test Mode

Security Test checks if your WAF properly blocks malicious attack payloads. This helps verify your application is protected against common web attacks.

● 200 — WAF did not protect your application
● 403 — WAF protected your application