wafrift · open source · MIT
Test your WAF ruleset for bypasses.
A web application firewall (WAF) sits in front of your application and blocks requests that look like attacks. wafrift tests a ruleset against real attack payloads: it mutates them through grammar rules and encoding layers, runs evolutionary search over what gets through, and reports the exact bypasses that worked so you can close them.
Use it
cargo install wafrift-cligit clone https://github.com/santhreal/wafrift && cd wafrift && cargo build --releasewafrift is for testing infrastructure you own or are authorized to assess. Point it at your own WAF, never at someone else's.
How it finds bypasses
- Grammar-driven payloads. Attacks are defined as composable TOML grammars (SQL injection, XSS, SSRF, path traversal, and your own), built on AttackStr. You get structured mutation instead of random noise.
- Encoding mutation. More than 15 encoding strategies: URL, double-URL, hex, unicode, base64, HTML entities, comment injection, case swapping, and dialect-specific transforms that different HTTP parsers disagree on.
- Dialect-specific bypasses. A payload that slips past ModSecurity's CRS dies on Cloudflare, and vice versa. wafrift carries presets for ModSecurity, Cloudflare, and AWS WAF, and targets the parser quirks of each.
- Evolutionary search. Bypasses that partially work get bred: mutation operators recombine what survived, generation over generation, instead of restarting from scratch.
- Per-WAF gene bank. Working bypasses persist per target WAF, so the next engagement starts from everything that has ever worked against that stack.
What a run tells you
The output is not a payload count. It is the list of concrete request variants that reached your application past the WAF, grouped by attack class, with the mutation chain that produced each one. Feed the survivors back into your ruleset, then re-run to confirm the bypass is dead.
Get it
github.com/santhreal/wafrift - source, grammar definitions, and preset packs. Rust, single binary.