# wallarm/gotestwaf

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

Repository: https://github.com/wallarm/gotestwaf
Canonical: https://ross.abutalabs.com/products/gotestwaf
Homepage: https://lab.wallarm.com/test-your-waf-before-hackers/
Language: Go
License: MIT
License Family: permissive
Topics: owasp, api-security, security, bugbounty, security-tools, waf, web-application-security, web-application-firewall, security-testing, graphql-security, grpc-security, rest-security
Last push: 2025-07-31T14:13:27+00:00

## Health v2 (maintenance only)
Score: 41/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 34, release rhythm 17, longevity 100
- inputs: {"age_days": 2409, "days_push": 398, "days_rel": 398, "gap_med": 141.0, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1799, forks 258 (observed 2026-08-28T04:05:37.869585+00:00)

## What it is
GoTestWAF is a Go-based tool that simulates OWASP and API attacks (SQL injection, XSS, etc.) across REST, GraphQL, gRPC, SOAP, and XMLRPC protocols to evaluate WAFs, IPS, API gateways, and API security proxies. It generates encoded malicious payloads placed in various parts of HTTP requests and produces evaluation reports on detection coverage.

## Use cases
- test how well my WAF detects OWASP attacks
- evaluate API security proxy detection coverage before deployment
- find bypasses in a web application firewall
- benchmark and compare different WAF solutions
- run regression tests against OWASP Core Rule Set
- generate a PDF report of WAF false negatives
- test GraphQL and gRPC security filtering

## When to choose
- you need to assess detection logic and bypass resistance of a WAF, IPS, or API gateway
- you want protocol-specific attack testing across REST, GraphQL, gRPC, SOAP, and XMLRPC
- you need an automated, repeatable security evaluation with reports

## When to avoid
- you need a full dynamic application security testing (DAST) scanner for your application itself
- you want continuous runtime protection rather than point-in-time testing
- you need a managed cloud service instead of a self-run tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, security, testing, http-client
- domain: security, penetration-testing, apis, web-development
- platform: windows, go, cli
- tags: waf-testing, api-security, owasp, attack-simulation, bypass-testing, security-evaluation, linux, macos, docker

## Member repositories
- wallarm/gotestwaf (main) score 41

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:37.869585+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:22:18.375972+00:00, confidence not recorded.
  - readme: https://github.com/wallarm/gotestwaf (fetched 2026-08-28T04:05:37.869585+00:00, sha e138eddd8578)
  - homepage: https://lab.wallarm.com/test-your-waf-before-hackers/ (fetched 2026-08-29T11:01:11.360485+00:00, sha c0461559e8ee)
- Data as of 2026-08-30T08:39:29.467469+00:00.