Cheat Sheet
Every command you need, organized by task. Copy, paste, scan. For full walkthroughs with output examples, see the Examples Guide on GitHub.
🚀 Quick Start
Get scanning in under 30 seconds. These commands work with zero configuration — just provide a target URL.
Full automated audit (just give me results)
$ waftester auto -u https://target.com Smart WAF-aware scan (adapts to detected WAF)
$ waftester auto -u https://target.com --smart Zero-install scan via npx
$ npx -y @waftester/cli scan -u https://target.com --smart Zero-install scan via Docker
$ docker run --rm qandil/waftester scan -u https://target.com --smart 🔍 WAF Detection
Identify the WAF vendor, CDN layer, and security headers before scanning. Knowing the WAF helps pick the right evasion techniques.
Identify WAF vendor (197+ signatures)
$ waftester vendor -u https://target.com Detect WAF + protocol info in one pass
$ waftester probe -u https://target.com Batch detection from a URL list
$ waftester vendor -l targets.txt -j 🎯 Vulnerability Scanning
Test your WAF against 2,800+ payloads across 50+ attack categories. Filter by type, authenticate, or proxy through Burp.
Scan for SQLi + XSS only
$ waftester scan -u https://target.com -types sqli,xss Scan multiple targets from file
$ waftester scan -l targets.txt --stream -format json Pipe targets from another tool
$ cat urls.txt | waftester scan -stdin --smart Scan with proxy (Burp, ZAP)
$ waftester scan -u https://target.com -x http://127.0.0.1:8080 Scan behind authentication
$ waftester scan -u https://target.com -H "Authorization: Bearer TOKEN" -b "session=abc123" 📡 API Spec Scanning
Point WAFtester at any API spec — OpenAPI, Swagger, Postman, HAR, AsyncAPI, gRPC, or GraphQL. One command auto-detects the format and scans every endpoint.
Scan OpenAPI / Swagger spec (auto-detected)
$ waftester scan --spec openapi.yaml -u https://api.example.com Scan from a remote spec URL
$ waftester scan --spec-url https://api.example.com/openapi.json Scan Postman Collection with environment
$ waftester scan --spec collection.postman_collection.json --env staging.postman_environment.json Postman with variable overrides
$ waftester scan --spec collection.postman_collection.json --env prod.postman_environment.json --var "api_key=test-key" Scan HAR recording from DevTools
$ waftester scan --spec recording.har -u https://api.example.com Scan AsyncAPI (WebSocket)
$ waftester scan --spec asyncapi.yaml -u wss://api.example.com/ws Scan specific endpoint group only
$ waftester scan --spec openapi.yaml -u https://api.example.com --group auth Dry-run: preview endpoints without scanning
$ waftester scan --spec openapi.yaml -u https://api.example.com --dry-run Deep intensity (more payloads per endpoint)
$ waftester scan --spec openapi.yaml -u https://api.example.com --intensity deep Test gRPC service via reflection
$ waftester grpc -u localhost:50051 --fuzz --category sqli Test SOAP/WSDL endpoint
$ waftester soap --wsdl https://example.com/service?wsdl --fuzz Discover GraphQL endpoints
$ waftester discover -u https://target.com --graphql 🎛️ Scan Control
Fine-grained control over which findings appear, what gets scanned, and how the scan behaves. Severity filters, scope patterns, and per-host rate limiting.
Only show critical and high findings
$ waftester scan -u https://target.com -msev critical,high Exclude low-severity noise
$ waftester scan -u https://target.com -fsev low,info Match specific categories in output
$ waftester scan -u https://target.com -mcat sqli,xss Exclude URL patterns (regex)
$ waftester scan -u https://target.com -ep "logout|signout|admin" Include only matching paths
$ waftester scan -u https://target.com -ip "/api/v2" Stop after first finding
$ waftester scan -u https://target.com -sof Per-host rate limiting
$ waftester scan -u https://target.com -rl 100 -rlph Retry with exponential backoff
$ waftester scan -u https://target.com -r 3 Respect robots.txt
$ waftester scan -u https://target.com -rr Full stealth: low rate + robots + stop on first
$ waftester scan -u https://target.com -rl 5 -rlph -rr -sof --tamper-profile=stealth -fsev info 🔓 WAF Bypass
Automatically discover evasion chains by combining 90+ tampers with mutators. Find the bypasses before attackers do. See the pentest guide for full workflows.
Find bypasses with auto tamper selection
$ waftester bypass -u https://target.com --smart --tamper-auto Full mutation matrix (2,080 variants per payload)
$ waftester mutate -u https://target.com -mode full -chain Stealth bypass (low rate, random UA)
$ waftester bypass -u https://target.com --smart-mode=stealth -rl 10 -ra Bypass with custom tamper profile
$ waftester bypass -u https://target.com --tamper-profile=aggressive List all available tamper scripts
$ waftester tampers -l 90+ scripts: unicode normalization, case toggling, comment insertion, encoding chains, and more.
Apply a specific tamper to payloads
$ waftester scan -u https://target.com --tamper unicode_normalization Chain multiple tampers
$ waftester scan -u https://target.com --tamper "base64_encode,url_encode,case_toggle" Use custom tamper scripts directory
$ waftester scan -u https://target.com --tamper-dir ./my-tampers Load tamper scripts from a custom directory alongside built-in ones.
📊 Assessment & Benchmarking
Measure WAF effectiveness with F1 scores, detection rates, and false positive analysis. Generate evidence for auditors and compliance.
Enterprise WAF assessment (F1, precision, MCC)
$ waftester assess -u https://target.com Assessment with false positive testing
$ waftester assess -u https://target.com -fp -corpus builtin,leipzig Compare WAF before/after rule changes
$ waftester assess -u https://target.com -o baseline.json && waftester assess -u https://target.com -o after.json Enforce a security policy (fail on violations)
$ waftester assess -u https://target.com --policy policy.yaml Define minimum detection rates per category. Exits non-zero on violations — use in CI gates.
OWASP Top 10 compliance mapping
$ waftester assess -u https://target.com --owasp Maps findings to OWASP Top 10 categories with coverage percentages.
Assessment with Nuclei template grading
$ waftester assess -u https://target.com -t templates/ --enrich Grades WAF using Nuclei templates with severity-weighted scoring.
🗺️ Discovery & Reconnaissance
Crawl, fuzz, and map your target before scanning. Discover endpoints, JavaScript secrets, cloud resources, and hidden paths.
Full discovery (crawl + JS + sitemap + Wayback)
$ waftester discover -u https://target.com Three-step intelligent scan
$ waftester discover -u https://target.com && waftester learn -discovery discovery.json && waftester run -plan testplan.json Content fuzzing (ffuf-compatible)
$ waftester fuzz -u https://target.com/FUZZ -w wordlist.txt -mc 200,301 JavaScript analysis for endpoints and secrets
$ waftester analyze -u https://target.com Cloud resource discovery
$ waftester cloud -d example.com 🌐 Headless Browser Testing
Test client-side protections, JavaScript-rendered content, and browser-based WAF challenges using a real headless browser.
Headless scan (renders JS before testing)
$ waftester headless -u https://target.com Launches a headless browser to handle SPAs, JS-rendered forms, and anti-bot challenges.
Event-driven crawl (click, scroll, interact)
$ waftester headless -u https://target.com --event-crawl Discovers endpoints by clicking buttons, filling forms, and triggering JS events.
Limit interactions per page
$ waftester headless -u https://target.com --event-crawl --max-clicks 50 Screenshot on findings
$ waftester headless -u https://target.com --screenshot Captures browser screenshots as visual evidence for each finding.
📄 Output Formats
16 output formats for every stakeholder. SARIF for GitHub, JUnit for Jenkins, HTML for auditors, JSON for APIs.
SARIF for GitHub Code Scanning
$ waftester scan -u https://target.com -o results.sarif Interactive HTML report with evidence
$ waftester scan -u https://target.com --smart -format html -ie -ir -o report.html GitLab SAST format
$ waftester scan -u https://target.com -o gl-sast.json JUnit XML for Jenkins/Azure DevOps
$ waftester scan -u https://target.com -o results.junit.xml CycloneDX VEX for supply chain
$ waftester scan -u https://target.com -o results.cdx.json Multiple outputs in one run
$ waftester scan -u https://target.com -o report.html -o results.sarif -o data.json ⚙️ CI/CD & Automation
Generate ready-to-use pipeline configs for GitHub Actions, GitLab CI, and Azure DevOps. WAF testing on every push.
Generate GitHub Actions pipeline
$ waftester cicd -p github-actions -u '${{ secrets.WAF_TARGET_URL }}' Generate GitLab CI config
$ waftester cicd -p gitlab-ci -u $WAF_TARGET_URL CI scan with streaming + exit code
$ waftester scan -u $TARGET --stream -format sarif -o results.sarif Slack notification on findings
$ waftester scan -u https://target.com --smart --slack-webhook $SLACK_URL 🤖 AI & MCP
Connect WAFtester to Claude, Copilot, Cursor, or n8n via MCP. AI agents get 27 security testing tools to use autonomously. See the autonomous workflows guide for all 7 guided prompts.
Start MCP server for AI agents (stdio)
$ npx -y @waftester/cli mcp --stdio Start MCP server over HTTP/SSE (for n8n)
$ waftester mcp --http :8080 VS Code / Cursor MCP config
{"mcpServers":{"waftester":{"command":"npx","args":["-y","@waftester/cli","mcp","--stdio"]}}} 📐 Spec Scanning Flags
Flags for API spec scanning. Control format, filtering, intensity, and dry-run mode.
Local spec file
$ --spec openapi.yaml Auto-detects OpenAPI 3.x, Swagger 2.0, Postman, HAR, AsyncAPI, gRPC, GraphQL.
Remote spec URL
$ --spec-url https://api.example.com/openapi.json Fetch and parse a spec from a URL. Supports JSON and YAML.
Postman environment
$ --env staging.postman_environment.json Resolve {{variables}} in Postman collections from an environment file.
Variable override
$ --var "api_key=test-key-123" Override individual variables. Takes precedence over environment file values.
Scan specific group
$ --group auth Only scan endpoints tagged with this group (from spec tags or folders).
Skip a group
$ --skip-group deprecated Exclude endpoints in this group from the scan.
Path filter (glob)
$ --path "/api/v2/*" Only scan paths matching this glob pattern. Supports * and ** wildcards.
Scan intensity
$ --intensity quick|standard|deep Controls payloads per endpoint. Quick: top 5, standard: 20, deep: all.
Preview without scanning
$ --dry-run Show the scan plan (endpoints, attacks, estimated requests) without sending traffic.
Skip confirmation prompt
$ -y Auto-confirm the scan plan. Required for non-interactive / CI usage.
Per-endpoint config file
$ --scan-config .waftester-spec.yaml Fine-tune auth, headers, and skip rules per endpoint path.
🏁 Essential Flags
Common flags that work across all commands. Combine them freely — target, auth, proxy, output, concurrency.
Target URL
$ -u https://target.com Single target. Required for most commands unless using -l or --stdin.
URL list file
$ -l targets.txt One URL per line. Scans all targets with shared settings.
Read from stdin
$ --stdin Pipe URLs from other tools. Pairs well with grep, subfinder, httpx.
Concurrency
$ -c 20 Parallel workers. Default 25. Lower for rate-limited targets.
Rate limit (req/s)
$ -rl 50 Cap requests per second. Default 150. Use 10-20 for production.
Skip TLS verification
$ -k Ignore certificate errors. Needed for self-signed certs or proxies.
HTTP/SOCKS5 proxy
$ -x http://127.0.0.1:8080 Route traffic through a proxy. Supports HTTP, HTTPS, SOCKS4, SOCKS5.
Custom header
$ -H "X-Custom: value" Add or override HTTP headers. Repeat -H for multiple headers.
Send cookies
$ -b "session=abc123" Attach cookies to every request. Use for authenticated scanning.
Random User-Agent
$ -ra Rotate through a pool of real browser User-Agent strings per request.
Realistic browser headers
$ -R Add Accept, Accept-Language, and other headers that mimic real browsers.
JSON output
$ -j Machine-readable output. Shortcut for -format json.
Output to file
$ -o results.json Write results to a file instead of stdout. Works with any format.
Verbose
$ -v Show detailed request/response info. Useful for debugging blocked payloads.
Silent (no progress)
$ -s Suppress progress bars and banners. Only output results.
🧠 Smart Modes
Smart mode adapts scanning to the detected WAF. Choose a profile based on your time budget and coverage needs.
Quick validation
$ --smart-mode=quick Fast sweep with top payloads only. Good for smoke tests and CI gates.
Standard (default)
$ --smart-mode=standard Balanced coverage and speed. Tests all categories with WAF-tuned payloads.
Maximum coverage
$ --smart-mode=full Every payload, every mutator, every category. Slow but thorough.
Bypass-focused
$ --smart-mode=bypass Prioritizes evasion chains and mutation combos over broad coverage.
Stealth (production-safe)
$ --smart-mode=stealth Low rate, randomized timing, realistic headers. Safe for live production.
🔄 Coming From Another Tool?
Familiar with sqlmap, Nuclei, ffuf, or Nikto? Here is how to do the same thing in WAFtester.
sqlmap: sqlmap -u "url?id=1" --dbs
$ waftester scan -u https://target.com -types sqli --smart WAFtester tests the WAF, not the database.
Nuclei: nuclei -u url -t cves/
$ waftester template -u https://target.com -t templates/ Uses Nuclei-compatible YAML templates.
ffuf: ffuf -u url/FUZZ -w wordlist.txt
$ waftester fuzz -u https://target.com/FUZZ -w wordlist.txt -mc 200,301 Same FUZZ keyword and filter syntax.
Nikto: nikto -h url
$ waftester probe -u https://target.com Probe covers headers, TLS, WAF, and tech detection.
📦 Service Presets
Auto-configure attack categories, paths, and payloads for known frameworks. Append to any scan or auto command.
WordPress
$ --preset wordpress Tests wp-admin, wp-login, xmlrpc.php, REST API, and plugin paths.
Drupal
$ --preset drupal Targets Drupalgeddon paths, node endpoints, and admin routes.
Next.js
$ --preset nextjs Tests _next/data, API routes, middleware bypass, and SSR injection.
Flask
$ --preset flask Targets Jinja2 SSTI, debug console, and Werkzeug endpoints.
Django
$ --preset django Tests admin panel, debug pages, ORM injection, and CSRF handling.
Rails
$ --preset rails Targets Active Record injection, ERB SSTI, and asset pipeline.
Laravel
$ --preset laravel Tests Blade SSTI, debug mode, Eloquent injection, and telescope.
Spring
$ --preset spring Targets Spring4Shell, actuator endpoints, SpEL injection, and Boot paths.
🏷️ All Scan Types
Use with -types flag. Combine with commas: -types sqli,xss,ssrf
49 scan types available. Run waftester scan --list-types for the full list.
Ready to Try It?
Every command on this page works with zero configuration.