wallarm/gotestwaf

Health v2 · maintenance only

Adoption not part of the score

1799 stars · 258 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

GoTestWAF is a Go-based tool that simulates OWASP and API attacks (SQL injection, XSS, etc.) across REST, GraphQL, gRPC, SOAP, and XMLRPC protocols to evaluate WAFs, IPS, API gateways, and API security proxies. It generates encoded malicious payloads placed in various parts of HTTP requests and produces evaluation reports on detection coverage.

Use cases

• test how well my WAF detects OWASP attacks
• evaluate API security proxy detection coverage before deployment
• find bypasses in a web application firewall
• benchmark and compare different WAF solutions
• run regression tests against OWASP Core Rule Set
• generate a PDF report of WAF false negatives
• test GraphQL and gRPC security filtering

When to choose

• you need to assess detection logic and bypass resistance of a WAF, IPS, or API gateway
• you want protocol-specific attack testing across REST, GraphQL, gRPC, SOAP, and XMLRPC
• you need an automated, repeatable security evaluation with reports

When to avoid

• you need a full dynamic application security testing (DAST) scanner for your application itself
• you want continuous runtime protection rather than point-in-time testing
• you need a managed cloud service instead of a self-run tool

Facets

cli-tool · maturity active

penetration-testing security testing http-client security penetration-testing apis web-development windows go cli waf-testing api-security owasp attack-simulation bypass-testing security-evaluation linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wallarm/gotestwaf")