wafw00f's fingerprints. Go speed. Pipeline-native.

172 WAF product identities, built on wafw00f's fingerprints. A Go CLI and library for live HTTP and offline saved-response analysis.

Quick start · Moving from wafw00f · Benchmarks · Documentation

wafmeow is a wafw00f alternative for WAF detection in Go, built on the upstream project's fingerprint work. It brings fast WAF fingerprinting into concurrent, structured pipelines for teams that need to detect WAF at scale.

Set AUTHORIZED_DOMAIN to a domain you own or are authorized to test.

set -o pipefail subfinder -d "${AUTHORIZED_DOMAIN:?set an authorized domain}" -silent | httpx -silent | wafmeow --target-file - --fast --jsonl --silent

This pipeline uses --fast for a quick active scan of each discovered URL. For existing httpx response exports, use the offline import pipeline.

Build with Go 1.26 or newer, using a security-patched toolchain. Release builds use Go 1.27.3.

git clone https://github.com/Lu1sDV/wafmeow.git cd wafmeow go build -o wafmeow ./cmd/wafmeow ./wafmeow --help

Source checkouts show Go module/VCS identity; published release binaries show their exact release tag in --version, the human banner and JSON result provenance. The release workflow embeds that tag automatically and checks it before packaging. Installed binaries do not change versions until replaced by an update.

For production, use a release that passes the release validation gates. The v1.0.0 downloads predate the security hardening in this source tree.

Prebuilt binaries, the Go module and Homebrew install are in Releases and installation:

go install github.com/Lu1sDV/wafmeow/v3/cmd/wafmeow@latest brew install Lu1sDV/tap/wafmeow

The /v3 Go install command requires a published v3 release. Before that release, build from the source checkout above; Homebrew continues installing the latest published stable version.

Use your own local HTTP server on port 8080.

./wafmeow --target http://127.0.0.1:8080 --fast

This prints a human-readable result. Use --target / -t for a URL and repeat it for several URLs. Use --target-file PATH for a file of URL lines, or --target-file - for stdin. --input PATH and -I PATH remain equivalent spellings of --target-file PATH. Choose one input source; saved responses use --evidence for offline analysis.

--baseline can find fingerprints already present in an ordinary response. Use it when you want normal HTTP inspection without active probes; it is not a setup step for --fast or --deep. The three live modes are mutually exclusive, and redirects and budgets affect actual request counts. See collection modes and payloads for the trade-offs.

Discover URLs, then send new wafmeow requests:

httpx -l authorized-hosts.txt -silent | ./wafmeow --target-file - --fast --jsonl --silent

Classify exported responses without additional requests:

httpx -l authorized-hosts.txt -silent -json -irr -probe -rstr 1048576 -rsts 1048576 | ./wafmeow --evidence - --evidence-format httpx --jsonl --silent

The importer targets httpx v1.12.0. Exported bodies lack completeness proof: content matching stays unknown, while faithful status/header/cookie evidence can match. This is not equivalent to active acquisition or proof of WAF absence. Use set -o pipefail when upstream process failures must fail the shell pipeline. Encoding, limitations, limits and downstream recipes.

The Go library uses module github.com/Lu1sDV/wafmeow/v3. Result JSON uses schema 1; module and report versions are separate contracts.

targets.txt: one authorized URL per line.

./wafmeow --target-file targets.txt --fast --jsonl --output results.json --strict

--jsonl streams results on stdout; --output / -O writes an atomic report. Use .json, .jsonl, .csv or .txt to choose its format; other filenames produce TXT. Human diagnostics go to stderr. --strict checks evidence quality: it exits 2 after publishing incomplete, failed or diagnosed results, not merely because a WAF matched. Configuration, input and output failures exit 1; cancellation exits 130. Reports contain results, not replayable response captures. See output contracts and rate and deadline tuning.

The broader-probe mode was labeled full in these historical measurements; it is now --deep. The figures below were not rerun for the rename.

Median elapsed time for 600 live HTTP/HTTPS targets — 500 non-CDN plus 100 known-CDN targets sampled from Tranco top 10,000 — with three runs per configuration on a Hetzner Helsinki VPS (4 vCPU, 7.6 GiB RAM), completed 31 October 2026. Lower is better.

Target selection, full VPS specifications, methodology, historical runs and offline conformance checks.

Detection compared at 100 workers/processes — targets out of 600, range across three runs.

Named and generic signals can overlap; these counts are not an accuracy comparison. Detection semantics, transport checks and per-block accounting.

Run the reproducible offline comparison against wafw00f 2.4.2 from a clean committed checkout. The runner records source and binary hashes, compiler and Python package versions, CPU details, the exact synthetic corpus, repeated blocks and a verified result manifest. Workers replay saved responses with network access isolated by bubblewrap.

The shipped synthetic-conformance fixture links cover 29 of 172 products; this checks conformance to fixture expectations. The live table measures end-to-end CLI elapsed time, while the offline comparison isolates saved-response classification. Keep each result attached to its workload and measured build.

Scan only systems you own or are authorized to test. Both --deep (default) and --fast send active probes.

A fingerprint match is evidence, not proof of WAF enforcement. No match is not proof of absence; incomplete is not negative.

Optional Chromium capture is not an OS-enforced network or resource sandbox.

Documentation

Guide Contents

CLI usage Modes, headers, scope, byte limits and cancellation

Moving from wafw00f Common flag mappings, changed semantics and pipeline migration

Browser capture Chromium setup, screenshots and sanitized exports

Operations Result semantics, safe report consumption, deployment and soak checks

Releases Installation, Docker, validation, security scans and publication controls

Go library Working example, ownership and streaming contracts

Architecture decisions Design rationale, alternatives, experiments and decision status

Benchmarks Measurement methodology, results and offline conformance checks

Contributing Development setup, reviewed fingerprint fixtures and starter tasks

Security policy Private vulnerability reporting and supported versions

Launch checklist Evidence-backed messaging, publication and repository settings

MIT license · Fingerprints from wafw00f · Contributor @Fibonaccispiralz