lightbulb-framework – Tools for auditing WAF

Web Applications Firewalls (WAFs) are fundamental building blocks of modern application security. For example, the PCI standard for organizations handling credit card transactions dictates that any application facing the internet should be either protected by a WAF or successfully pass a code review process.

Nevertheless, despite their popularity and importance, auditing web application firewalls remains a challenging and complex task. Finding attacks that bypass the firewall usually requires expert domain knowledge for a specific vulnerability class. Thus, penetration testers not armed with this knowledge are left with publicly available lists of attack strings, like the XSS Cheat Sheet, which are usually insufficient for thoroughly evaluating the security of a WAF product.

lightbulb-framework - Tools for auditing WAF

lightbulb-framework – Tools for auditing WAF

If you are planning to test web application firewall you can check lightbulb-framework. This framework consists of two main algorithms:

GOFA: An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query model.
Active learning algorithms permits the analysis of filter and sanitizer programs remotely, i.e. given only the ability to query the targeted program and observe the output.

SFADiff: A black-box differential testing algorithm based on Symbolic Finite Automata (SFA) learning
Finding differences between programs with similar functionality is an important security problem as such differences can be used for fingerprinting or creating evasion attacks against security software like Web Application Firewalls (WAFs) which are designed to detect malicious inputs to web applications.

The tool was presented in BlackHat 2016 and you can read  more and download it here: