Skip to content

Latest commit

 

History

History
34 lines (27 loc) · 1.87 KB

README.md

File metadata and controls

34 lines (27 loc) · 1.87 KB

WAF Checker (Cloudflare Worker Style)

This project helps you check how well your Web Application Firewall (WAF) protects your product against common web attacks. It is a web application implemented in a Cloudflare Worker style using TypeScript and provides a convenient web interface for WAF testing with a wide range of attack payloads.

Main Features

  • Web interface for entering the target URL and selecting HTTP methods (GET, POST, PUT, DELETE).
  • Flexible selection of attack categories (SQLi, XSS, Path Traversal, Command Injection, SSRF, NoSQLi, LFI, SSTI, XXE, HTTP Header, and more).
  • Each category uses its own set of payloads (in parameters, headers, or as file paths).
  • Automatic sending of requests with payloads for the selected categories and methods.
  • Color-coded results by status code:
    • 2xx/5xx — red (potential vulnerability)
    • 403 — green (WAF blocks)
    • other 4xx — orange (non-standard response)
  • Results are displayed in a table with details for each payload.
  • Easily extendable payload list (see app/src/payloads.ts).

How to Use

  1. Install wrangler https://developers.cloudflare.com/workers/wrangler/install-and-update/ (dependencies: node & npx)
  2. Run npx wrangler dev

Project Structure

  • app/src/api.ts — server logic: request handling, payload sending, /api/check API
  • app/src/payloads.ts — all attack categories and payloads
  • app/src/static/index.html — main web interface (Bootstrap, JS)
  • app/src/static/main.js — frontend logic and UI handlers
  • app/src/static/style.css — custom styling and theme support

Extending Payloads

To add or modify payloads, edit the app/src/payloads.ts file. You can add new categories, payloads, and check types (in parameters, headers, as file).

The project requires Node.js and can be deployed as a Cloudflare Worker or on any server supporting the Fetch API.