WAF Security Tester v3.0

ℹ️ Privacy First: All tests run in your browser. Requests go directly to target URL.

⚡ Single Request

Test one payload with details

🚀 Bulk Test

Test multiple payloads

Target URL

HTTP Method

Parameter Name

Timeout (seconds)

Select Payload

📤 Request Configuration

Attack Payload

Testing payload...

Select Categories

", "

${escapeHtml(category)}

${items.length}

`; items.forEach(p => { html += `

${escapeHtml(p)}

`; }); html += `

`; } document.getElementById('payloadBrowser').innerHTML = html; } function toggleCategory(el) { el.nextElementSibling.classList.toggle('active'); } function selectPayload(payload) { document.getElementById('singlePayload').value = payload; } async function testSingleRequest() { const payload = document.getElementById('singlePayload').value; const targetUrl = document.getElementById('targetUrl').value; const method = document.getElementById('method').value; const parameter = document.getElementById('parameter').value; const timeout = parseInt(document.getElementById('timeout').value) * 1000; if (!payload || !targetUrl) { alert('Please enter target URL and select/enter a payload'); return; } document.getElementById('singleLoading').classList.add('active'); document.getElementById('singleResults').style.display = 'none'; try { const result = await sendRequest(targetUrl, method, parameter, payload, timeout); displayResults(result, targetUrl, method, parameter, payload); } catch (error) { alert('Error: ' + error.message); } finally { document.getElementById('singleLoading').classList.remove('active'); } } async function sendRequest(targetUrl, method, parameter, payload, timeout) { const startTime = performance.now(); try { let url = targetUrl; let options = { method, mode: 'cors', cache: 'no-cache' }; const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); options.signal = controller.signal; if (method === 'GET') { const sep = url.includes('?') ? '&' : '?'; url = `${url}${sep}${parameter}=${encodeURIComponent(payload)}`; } else { const formData = new URLSearchParams(); formData.append(parameter, payload); options.body = formData; options.headers = { 'Content-Type': 'application/x-www-form-urlencoded' }; } const response = await fetch(url, options); clearTimeout(timeoutId); const endTime = performance.now(); const responseTime = Math.round(endTime - startTime); const headers = {}; response.headers.forEach((value, key) => { headers[key] = value; }); let body = ''; try { body = await response.text(); } catch (e) { body = 'Unable to read response body'; } return { httpCode: response.status, headers, body, responseTime, blocked: [403, 406, 419, 429, 503].includes(response.status), url, error: null }; } catch (error) { const endTime = performance.now(); return { httpCode: 0, headers: {}, body: error.message, responseTime: Math.round(endTime - startTime), blocked: false, url: targetUrl, error: error.message }; } } function displayResults(result, targetUrl, method, parameter, payload) { document.getElementById('singleResults').style.display = 'block'; document.getElementById('requestDetails').innerHTML = `

                    ${method} 
                    ${escapeHtml(result.url)}

                    Parameter: ${escapeHtml(parameter)}

                    Payload: 
                    ${escapeHtml(payload)}

`; const statusClass = result.error ? 'error' : (result.blocked ? 'blocked' : 'allowed'); const statusText = result.error ? '⚠️ Error/CORS' : (result.blocked ? '🛡️ Blocked' : '✅ Allowed'); const statusColor = result.error ? 'var(--warning)' : (result.blocked ? 'var(--danger)' : 'var(--success)'); document.getElementById('responseStatus').innerHTML = `

${statusText}

`; document.getElementById('tab-overview').innerHTML = `

HTTP Status

${result.httpCode || 'N/A'}

Response Time

${result.responseTime}ms

WAF Status

${result.error ? 'Error' : (result.blocked ? 'Blocked' : 'Allowed')}

${result.error ? `

Note: ${escapeHtml(result.error)}. ${result.error.includes('CORS') || result.error.includes('Failed to fetch') ? 'This may be CORS restriction. Request was sent but browser blocked response.' : ''}

` : ''} `; const headerText = Object.entries(result.headers).map(([k, v]) => `${k}: ${v}`).join('\n') || 'No headers'; document.getElementById('tab-headers').innerHTML = `

${escapeHtml(headerText)}

`; const body = result.body || 'No response body'; const truncated = body.length > 5000 ? body.substring(0, 5000) + '\n\n... (truncated)' : body; document.getElementById('tab-body').innerHTML = `

${escapeHtml(truncated)}

`; } // Initialize document.addEventListener('DOMContentLoaded', function() { renderPayloadBrowser(); document.getElementById('testSingleBtn').addEventListener('click', testSingleRequest); // Event delegation for payload items document.addEventListener('click', function(e) { if (e.target.classList.contains('payload-item')) { const payload = e.target.getAttribute('data-payload'); selectPayload(payload); } }); document.querySelectorAll('.mode-tab').forEach(tab => { tab.addEventListener('click', function() { document.querySelectorAll('.mode-tab').forEach(t => t.classList.remove('active')); this.classList.add('active'); const mode = this.dataset.mode; document.querySelectorAll('.single-request-mode, .bulk-request-mode').forEach(m => { m.classList.remove('active'); }); if (mode === 'single') { document.querySelector('.single-request-mode').classList.add('active'); document.querySelector('.single-only').style.display = 'block'; } else { document.querySelector('.bulk-request-mode').classList.add('active'); document.querySelector('.single-only').style.display = 'none'; } }); }); document.querySelectorAll('.response-tab').forEach(tab => { tab.addEventListener('click', function() { document.querySelectorAll('.response-tab').forEach(t => t.classList.remove('active')); document.querySelectorAll('.response-content').forEach(c => c.classList.remove('active')); this.classList.add('active'); document.getElementById('tab-' + this.dataset.tab).classList.add('active'); }); }); });

🛡️ WAF Security Tester v3.0 100% Client-Side