wafrift · open source · MIT
Your WAF has bypasses. Find them before an attacker does.
A WAF ruleset you have never attacked is a comfort blanket. wafrift is a WAF evasion testing toolkit written in Rust: it mutates real attack payloads through grammar rules and encoding layers, runs evolutionary search over what gets through your ruleset, and reports the exact bypasses that worked so you can close them.
Use it
git clone https://github.com/santhreal/wafrift && cd wafrift && cargo build --releasewafrift is for testing infrastructure you own or are authorized to assess. Point it at your own WAF, never at someone else's.
How it finds bypasses
- Grammar-driven payloads. Attacks are defined as composable TOML grammars (SQL injection, XSS, SSRF, path traversal, and your own), built on AttackStr. You get structured mutation instead of random noise.
- Encoding mutation. 15+ encoding strategies: URL, double-URL, hex, unicode, base64, HTML entities, comment injection, case swapping, and dialect-specific transforms that parsers disagree on.
- Dialect-specific bypasses. A payload that slips past ModSecurity's CRS dies on Cloudflare, and vice versa. wafrift carries presets for ModSecurity, Cloudflare, and AWS WAF, and targets the parser quirks of each.
- Evolutionary search. Bypasses that partially work get bred: mutation operators recombine what survived, generation over generation, instead of restarting from scratch.
- Per-WAF gene bank. Working bypasses persist per target WAF, so the next engagement starts from everything that has ever worked against that stack.
What a run tells you
The output is not a payload count. It is the list of concrete request variants that reached your application past the WAF, grouped by attack class, with the mutation chain that produced each one. That is the diff between "we have a WAF" and "we know what our WAF stops". Feed the survivors back into your ruleset, then re-run to confirm the bypass is dead.
Get it
github.com/santhreal/wafrift - source, grammar definitions, and preset packs. Rust, single binary.