vamp-waf-bypass

WAF evasion tester — 15 bypass techniques for authorized security testing.
VampSecure Labs Security Research Division — pure Python, zero external dependencies.

⚠️ FOR AUTHORIZED SECURITY TESTING ONLY. Only use against systems you own or have explicit written permission to test.

Features

• 15 bypass checks (WAF-001–015) covering SQLi, XSS, path traversal, method override, IP spoofing, Log4Shell, rate limiting and more
• Zero external dependencies — uses only Python standard library (urllib, re, json…)
• Pure check functions for unit testing without network calls
• JSON + HTML reports for automated pipelines and human review
• WAF fingerprinting — detects Cloudflare, Incapsula, Sucuri, AWS WAF, Akamai, ModSecurity and more
• Exit codes CI-compatible: 2 = CRITICAL bypass, 1 = HIGH/MEDIUM, 0 = WAF blocking all

Checks

Installation

pip install vamp-waf-bypass

Or with Homebrew:

brew tap vampsecure-labs/labs
brew install vamp-waf-bypass

Usage

# Basic scan
vamp-waf-bypass https://target.example.com

# Specify injection parameter
vamp-waf-bypass https://target.example.com --param search

# JSON report
vamp-waf-bypass https://target.example.com --json report.json

# HTML report
vamp-waf-bypass https://target.example.com --html report.html

# Filter by severity
vamp-waf-bypass https://target.example.com --severity critical high

# With case metadata
vamp-waf-bypass https://target.example.com --case CASO-2026-001 --analyst "Equipo Red"

# Quiet mode (exit code only, for CI)
vamp-waf-bypass https://target.example.com --quiet

Exit codes

License

AGPL-3.0-only — see LICENSE.