waf-mul

Fuzzes web targets past WAFs and rotates your Mullvad relay when you get blocked. Built for bug bounty work and authorized pentesting.

What it does

Two problems get you blocked during testing: your payload trips a signature rule, or your IP trips a rate limit. waf-mul attacks both.

On the payload side it mutates every input several ways before sending: random casing, URL encoding, double encoding, tab and newline injection between letters, SQL comment splitting. On the network side it watches every response. Get a 403, a 429, or a block page from Cloudflare, Akamai, Imperva or Sucuri, and it switches to a fresh source address before continuing: either the next proxy in your list, or the next Mullvad location through the mullvad CLI.

It also checks whether your payload actually came back in the response. A hit that reflects is worth reporting. A plain 200 usually is not. Reflected hits get their own marker so you can skim results fast.

Redirects are followed manually and checked against a scope allowlist at every hop, so a target that bounces you to some out-of-scope host gets refused instead of leaking requests where they should not go.

Features

• Relay rotation on block via the Mullvad CLI, with exit IP verification after every switch
• SOCKS5 and HTTP proxy pool mode as an alternative transport, one client per proxy
• Payload mutations: raw, random case, URL encode, double encode, tab/newline injection, comment split
• WAF fingerprinting for Cloudflare, Akamai, Imperva, Sucuri, challenge pages and 429s
• Reflection detection with percent-decoding, so encoded reflections still get caught
• Scope enforcement on redirects, subdomain-aware
• Jittered request delays
• Fully async, single binary, no runtime dependencies

Requirements

• The Mullvad VPN app with an active subscription (only if you want relay rotation; proxy mode works without it)
• Rust 1.70 or newer to build
• Written permission to test the target. Bug bounty scope counts. Guessing does not.

Build

git clone https://github.com/IL-0cy/waf-mul.git
cd waf-mul
cargo build --release

Usage

Connect Mullvad first if you plan to rotate relays:

mullvad connect

Basic run:

./target/release/waf-mul \
  --url https://target.example.com/search \
  --param q \
  --payloads payloads.txt

Rotate through specific cities when blocked:

./target/release/waf-mul \
  --url https://target.example.com/search \
  --param q \
  --payloads payloads.txt \
  --locations us:nyc,de:ber,se:got,nl \
  --mode sequential

Proxy pool instead of the system tunnel:

./target/release/waf-mul \
  --url https://target.example.com/search \
  --param q \
  --payloads payloads.txt \
  --proxies-file proxies.txt

Keep redirects in scope and add jitter:

./target/release/waf-mul \
  --url https://target.example.com/search \
  --param q \
  --payloads payloads.txt \
  --scope target.example.com,cdn.target.example.com \
  --jitter-ms 800

Rotation priority is proxies first, then Mullvad locations, then a plain reconnect.

Reading output

Marker	Meaning
[R] REFLECTED [200]	Payload survived the WAF and came back in the page. Report these.
[+] HIT [200]	Clean response, payload not reflected. Usually noise.
[-] blocked (...)	Block detected, signature named in parens. Rotation follows.
[!] out-of-scope redirect refused	Target tried to bounce you off-scope. Request was not sent.

Testing

Unit tests:

cargo test

There is also a fake WAF server for local runs, so you can test without touching any real target. It blocks script tags like a decode-once filter would, returns 429s, reflects clean input, and throws in an out-of-scope redirect endpoint.

python tests/test_server.py &
./target/release/waf-mul --url http://127.0.0.1:8899/search --param q --payloads payloads.txt

Try the double-encoded variants against it. They slip past its filter, which is exactly the kind of thing you want to see before it happens on a real engagement.

Docs

• Usage and CLI reference
• Architecture

Releases

Tag a version and GitHub Actions builds binaries for Linux x86_64, macOS Intel and ARM, and Windows:

git tag v0.2.0 && git push origin v0.2.0

Legal

Use this only against targets you are authorized to test: your own systems, bug bounty programs in scope, contracted engagements. Everything else is illegal and gets people real prison time. Not my problem if you misuse it.

License

MIT