Wafme0w

wafw00f's fingerprints. Go speed. Pipeline-native.

172 WAF product identities, built on wafw00f's fingerprints.
A Go CLI and library for live HTTP and offline saved-response analysis.

Quick start · Moving from wafw00f · Benchmarks · Documentation

Open full-size split demo

Why wafmeow?

wafmeow is a wafw00f alternative for WAF detection in Go, built on the upstream project's fingerprint work. It brings fast WAF fingerprinting into concurrent, structured pipelines for teams that need to detect WAF at scale.

• 172 product identities in the catalogue. Fingerprints are ported from wafw00f, with upstream credit and licence notices. Probe behavior and evidence semantics differ; catalogue size does not prove equivalent detection on every target.
• Static Go release binaries. No Python, pip or virtualenv is required to scan or classify saved responses. Optional browser capture needs Chromium.
• JSONL, JSON and CSV output. Stream to jq, notification tools or a database, while keeping human diagnostics on stderr.
• Offline response analysis. Re-analyse native captures or supported httpx exports without sending another request.
• Request, redirect and connection budgets. Bound acquisition and apply explicit scope rules across redirects.
• An importable Go library. Use the same evidence classifier in your own application through the v3 API.

From discovery to JSONL

# Set AUTHORIZED_DOMAIN to a domain you own or are authorized to test.
set -o pipefail
subfinder -d "${AUTHORIZED_DOMAIN:?set an authorized domain}" -silent |
  httpx -silent |
  wafmeow --target-file - --fast --jsonl --silent

This pipeline uses --fast for a quick active scan of each discovered URL. For existing httpx response exports, use the offline import pipeline.

1. Build

Build with Go 1.26 or newer, using a security-patched toolchain. Release builds use Go 1.27.3.

git clone https://github.com/Lu1sDV/wafmeow.git
cd wafmeow
go build -o wafmeow ./cmd/wafmeow
./wafmeow --help

Source checkouts show Go module/VCS identity; published release binaries show their exact release tag in --version, the human banner and JSON result provenance. The release workflow embeds that tag automatically and checks it before packaging. Installed binaries do not change versions until replaced by an update.

For production, use a release that passes the release validation gates. The v1.0.0 downloads predate the security hardening in this source tree.

Prebuilt binaries, the Go module and Homebrew install are in Releases and installation:

go install github.com/Lu1sDV/wafmeow/v3/cmd/wafmeow@latest
brew install Lu1sDV/tap/wafmeow

The /v3 Go install command requires a published v3 release. Before that release, build from the source checkout above; Homebrew continues installing the latest published stable version.

2. Scan an authorized target

# Use your own local HTTP server on port 8080.
./wafmeow --target http://127.0.0.1:8080 --fast

This prints a human-readable result. Use --target / -t for a URL and repeat it for several URLs. Use --target-file PATH for a file of URL lines, or --target-file - for stdin. --input PATH and -I PATH remain equivalent spellings of --target-file PATH. Choose one input source; saved responses use --evidence for offline analysis.

Goal	Choose	Collection
Quick active fingerprinting	--fast	Normal, no-user-agent and combined probe
Broader active probing	--deep	Eight selected request types; also the default when no mode is given
Inspect normal responses only	--baseline	One normal request, without active probes
Reuse saved responses	--evidence FILE	Offline classification, without new requests

--baseline can find fingerprints already present in an ordinary response. Use it when you want normal HTTP inspection without active probes; it is not a setup step for --fast or --deep. The three live modes are mutually exclusive, and redirects and budgets affect actual request counts. See collection modes and payloads for the trade-offs.

ProjectDiscovery httpx pipelines

# Discover URLs, then send new wafmeow requests:
httpx -l authorized-hosts.txt -silent |
  ./wafmeow --target-file - --fast --jsonl --silent

# Classify exported responses without additional requests:
httpx -l authorized-hosts.txt -silent -json -irr -probe -rstr 1048576 -rsts 1048576 |
  ./wafmeow --evidence - --evidence-format httpx --jsonl --silent

The importer targets httpx v1.12.0. Exported bodies lack completeness proof: content matching stays unknown, while faithful status/header/cookie evidence can match. This is not equivalent to active acquisition or proof of WAF absence. Use set -o pipefail when upstream process failures must fail the shell pipeline. Encoding, limitations, limits and downstream recipes.

The Go library uses module github.com/Lu1sDV/wafmeow/v3. Result JSON uses schema 1; module and report versions are separate contracts.

3. Automate and save results

# targets.txt: one authorized URL per line.
./wafmeow --target-file targets.txt --fast --jsonl --output results.json --strict

--jsonl streams results on stdout; --output / -O writes an atomic report. Use .json, .jsonl, .ndjson, .csv or .txt to choose its format; extensionless filenames select TXT and unknown suffixes fail early. Human diagnostics go to stderr. --strict checks evidence quality: it exits 2 after publishing incomplete, failed or diagnosed results, not merely because a WAF matched. Configuration, input and output failures exit 1; cancellation exits 130. Reports contain results, not replayable response captures. Add --require-results to fail an empty input stream without replacing an existing report. For safe jq filters, missing arrays, partial streams, report formats and exit semantics, start with the JSONL pipeline guide. See also output contracts and rate and deadline tuning.

Benchmarks

The broader-probe mode was labeled full in these historical measurements; it is now --deep. The figures below were not rerun for the rename.

Median elapsed time for 600 live HTTP/HTTPS targets — 500 non-CDN plus 100 known-CDN targets sampled from Tranco top 10,000 — with three runs per configuration on a Hetzner Helsinki VPS (4 vCPU, 7.6 GiB RAM), completed 31 October 2026. Lower is better.

Target selection, full VPS specifications, methodology, historical runs and offline conformance checks.

Workers / processes	wafw00f 2.4.2	wafmeow fast	wafmeow deep	Speedup fast	Speedup deep
1	31m 38s	7m 49s	15m 50s	4.04×	2.00×
5	6m 53s	2m 18s	3m 10s	2.99×	2.17×
10	4m 47s	1m 16s	1m 35s	3.79×	3.03×
50	1m 59s	16.1s	26.6s	7.40×	4.49×
100	1m 52s	9.0s	21.9s	12.45×	5.12×

Detection compared at 100 workers/processes — targets out of 600, range across three runs.

Targets with…	wafw00f 2.4.2	wafmeow fast	wafmeow deep
Named WAF match	155–157	157–158	157–160
Generic WAF signal	121–126	118–120	145–146
Returned result	580–581	600	600
Complete evidence	Not reported	529–531	523–528

Named and generic signals can overlap; these counts are not an accuracy comparison. Detection semantics, transport checks and per-block accounting.

Reproducible offline comparison

Run the reproducible offline comparison against wafw00f 2.4.2 from a clean committed checkout. The runner records source and binary hashes, compiler and Python package versions, CPU details, the exact synthetic corpus, repeated blocks and a verified result manifest. Workers replay saved responses with network access isolated by bubblewrap.

The shipped synthetic-conformance fixture links cover 29 of 172 products; this checks conformance to fixture expectations. The live table measures end-to-end CLI elapsed time, while the offline comparison isolates saved-response classification. Keep each result attached to its workload and measured build.

Major caveats

• Scan only systems you own or are authorized to test. Both --deep (default) and --fast send active probes.
• A fingerprint match is evidence, not proof of WAF enforcement. No match is not proof of absence; incomplete is not negative.
• Optional Chromium capture is not an OS-enforced network or resource sandbox.

Documentation

Guide	Contents
CLI usage	Modes, headers, scope, byte limits and cancellation
JSONL pipelines	Parsing results, filtering matches, output formats, exit handling and recovery
Moving from wafw00f	Common flag mappings, changed semantics and pipeline migration
Browser capture	Chromium setup, screenshots and sanitized exports
Operations	Result semantics, safe report consumption, deployment and soak checks
Releases	Installation, Docker, validation, security scans and publication controls
Go library	Working example, ownership and streaming contracts
Architecture decisions	Design rationale, alternatives, experiments and decision status
Benchmarks	Measurement methodology, results and offline conformance checks
Contributing	Development setup, reviewed fingerprint fixtures and starter tasks
Security policy	Private vulnerability reporting and supported versions
Launch checklist	Evidence-backed messaging, publication and repository settings

MIT license · Fingerprints from wafw00f · Contributor @Fibonaccispiralz