ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.

My simple Swiss Army knife for http/https troubleshooting and profiling.

Padrino is a full-stack ruby framework built upon Sinatra.

🔥 Everything awesome about web-application firewalls (WAF).

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

🔥Open source RASP solution

Detect and bypass web application firewalls and protection systems

Collection of quality safety articles

python3写的综合扫描工具，主要用来存活验证，敏感文件探测(目录扫描/js泄露接口/html注释泄露)，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，POC扫描，SQL注入，绕过CDN，查询旁站等功能，主要用来甲方自测或乙方授权测试，请勿用来搞破坏。

High-performance WAF built on the OpenResty stack

Code-Audit-Challenges

ModSecurity v3 Nginx Connector

Web interface for managing Haproxy, Nginx and Keepalived servers

JXWAF(锦衣盾)是一款开源web应用防火墙

Janusec Application Gateway, Provides Fast and Secure Application Delivery. JANUSEC应用网关，提供快速、安全的应用交付。

Blazy is a modern login bruteforcer which also tests for CSRF, Clickjacking, Cloudflare and WAF .

有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file

TeaWeb-可视化的Web代理服务。DEMO: http://teaos.cn:7777

🚦Web Application Firewall or API Gateway(应用防火墙/API网关)

Web security protection system based on openresty

Web Application Firewall (WAF) package for Laravel

Win Application Framework (WAF) is a lightweight Framework that helps you to create well structured XAML Applications.

A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques

A collection of bash shell scripts for automating various tasks with Amazon Web Services using the AWS CLI and jq.

🔥 A curated list of awesome links related to application security related to the environments with NGINX or Kubernetes Ingres Controller (based on NGINX)

一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能

Maryam : Open-source Intelligence(OSINT) Framework

CloudBunny is a tool to capture the real IP of the server that uses a WAF as a proxy or protection. In this tool we used three search engines to search domain information: Shodan, Censys and Zoomeye.

Blind WAF identification tool