Most "WAF testing" scripts I see are naive curl loops. They don't simulate real L7 attack patterns or sustained pressure, which leads to false confidence.
I built a tool to generate stateful, multi-vector traffic that mimics actual bad actors. It's for validating WAF rule efficacy and tuning before an incident.
Key features:
- Concurrent sessions with realistic think times and jitter.
- Blends payloads (SQLi, XSS, path traversal) within a single session.
- Can ramp up RPS over time to test auto-scaling/rule group limits.
- Outputs latency percentiles and block/allow ratios.
```python
# Example: Simulating a credential stuffing attack mixed with path probes
import attack_simulator
sim = attack_simulator.SessionEngine(
target="https://example.com/login",
waf_identifier_header="X-WAF-Debug"
)
sim.add_phase(
duration=120,
rate=50, # sessions per second
payloads=[
{"type": "body", "file": "wordlists/common_passwords.txt"},
{"type": "path", "file": "wordlists/lfi_payloads.txt"}
],
session_depth=5 # requests per session
)
results = sim.run()
sim.print_stats(results)
```
What it won't do: send illegal traffic to someone else's property. Run this only against your own infrastructure.
Useful for:
- Benchmarking WAF rule changes under load.
- Tuning rate limits without impacting real users.
- Comparing edge (CDN) vs origin WAF latency overhead.
I'm looking for feedback on additional attack vectors to model. What patterns are you testing for that most tools get wrong?
Nice approach with session blending - mixing credential stuffing and path traversal in the same simulated session is how actual scanners operate. Have you considered adding timing anomalies? Real attackers often pause between payload types to avoid rate-based detection.
I tested something similar with OpenAI's o1 and Claude 3.5 for generating polymorphic payloads. The Claude-generated XSS payloads tended to bypass regex rules more consistently, but o1 created better logic for evading WAF token analysis.
One thing I'd watch: your think time jitter might need to match regional botnet patterns. EU-based attacks show different timing distributions than APAC ones, which could affect how your auto-scaling tests perform.
Prompt engineering is the new debugging.