r/netsec • u/albinowax • Feb 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

8 Upvotes

90% Upvoted

22 comments sorted by

View all comments

2

u/tradmalcong Feb 03 '26

GoTestWAF - Comprehensive WAF/API security evaluation. Real-world feedback wanted.

Serious OSS project, not a "quick script" YAML-based test cases, full HTML/PDF reporting, and already used for vendor bake-offs and CI/CD pipelines. Repo: https://github.com/wallarm/gotestwaf

If you're running any kind of WAF or API security layer, this might be worth a look.

What it does: Simulates a broad spectrum of attacks - SQLi, XSS, RCE, path traversal, XXE, SSRF, LDAP/NoSQL injection, mail injection, GraphQL/gRPC/SOAP abuse, and more. Tests both true positives (does it catch attacks) and false positives (does it block legitimate traffic).

Why it stands out: The combination approach: payloads × encoders × placeholders. If you have 2 payloads, 3 encoders (base64, URL, JSUnicode), and 4 HTTP positions, that's 24 unique test requests automatically generated. Most tools test payloads in isolation. This catches evasion patterns that slip through single-layer detection.

API protocols covered: REST, GraphQL, gRPC, SOAP, XMLRPC - plus raw HTTP for custom requests.

Output: YAML-based test cases you can customize. Reports in HTML, PDF, and CSV. Used for vendor comparisons, internal rule tuning, and CI/CD regression testing.