@waftester/cli 2.8.0

package/payloads/community/rate-limit/bypass-attempts.json

@@ -0,0 +1,326 @@
+[
+  {
+      "id": "RATE-BYPASS-001",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "192.168.1.100"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "xff-spoof",
+        "quick",
+        "high"
+    ],
+      "expected_block": false,
+      "severity_hint": "High",
+      "notes": "X-Forwarded-For spoofing to bypass rate limiting (should fail - realip validates source)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-002",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Real-IP": "10.0.0.1"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "real-ip-spoof",
+        "high"
+    ],
+      "expected_block": false,
+      "severity_hint": "High",
+      "notes": "X-Real-IP spoofing attempt (should fail - realip validates source)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-003",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "CF-Connecting-IP": "1.1.1.1"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "cf-ip-spoof",
+        "quick",
+        "high"
+    ],
+      "expected_block": false,
+      "severity_hint": "High",
+      "notes": "CF-Connecting-IP spoofing (should fail - realip validates source)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-004",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "1.1.1.1, 2.2.2.2, 3.3.3.3"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "xff-chain",
+        "high"
+    ],
+      "expected_block": false,
+      "severity_hint": "High",
+      "notes": "Multiple IPs in X-Forwarded-For (should use real IP)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-005",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "127.0.0.1"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "localhost-spoof",
+        "quick",
+        "high"
+    ],
+      "expected_block": false,
+      "severity_hint": "High",
+      "notes": "Localhost IP spoofing in X-Forwarded-For",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-006",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "Client-IP": "8.8.8.8"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "client-ip-header",
+        "medium"
+    ],
+      "expected_block": false,
+      "severity_hint": "Medium",
+      "notes": "Non-standard Client-IP header (should be ignored)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-007",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Originating-IP": "9.9.9.9"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "originating-ip",
+        "quick",
+        "medium"
+    ],
+      "expected_block": false,
+      "severity_hint": "Medium",
+      "notes": "X-Originating-IP header (should be ignored)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-008",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "True-Client-IP": "10.10.10.10"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "true-client-ip",
+        "medium"
+    ],
+      "expected_block": false,
+      "severity_hint": "Medium",
+      "notes": "True-Client-IP header (should be ignored)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-009",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": ""
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "empty-xff",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Empty X-Forwarded-For header (should use real connection IP)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-010",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "null"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "null-xff",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Literal 'null' in X-Forwarded-For",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-011",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "unknown"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "invalid-xff",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Invalid IP format in X-Forwarded-For",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-012",
+      "payload": "/login?cache_bust=1234567890",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "cache-bust",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Cache-busting query parameter (rate limit is IP-based, not URL-based)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-013",
+      "payload": "/LOGIN",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "case-manipulation",
+        "quick",
+        "medium"
+    ],
+      "expected_block": false,
+      "severity_hint": "Medium",
+      "notes": "Uppercase path (should match /login* pattern)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-014",
+      "payload": "/login/../login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "path-traversal",
+        "medium"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Path traversal to evade matcher (should be normalized and blocked by WAF)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-015",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128",
+        "X-Forwarded-For": "::1"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "ipv6-spoof",
+        "quick",
+        "medium"
+    ],
+      "expected_block": false,
+      "severity_hint": "Medium",
+      "notes": "IPv6 localhost spoofing in X-Forwarded-For",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-BYPASS-016",
+      "payload": "/login%00",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128"
+    },
+      "tags": [
+        "rate-limit",
+        "bypass",
+        "null-byte",
+        "high"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Null byte in path to evade matcher (should be blocked by WAF)",
+      "category": "RateLimit"
+  }
+]

package/payloads/community/rate-limit/zone-tests.json

@@ -0,0 +1,332 @@
+[
+  {
+      "id": "RATE-ZONE-001",
+      "payload": "/rest/workflows",
+      "tags": [
+        "rate-limit",
+        "zone-api",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'api' zone (1000 req/min limit on /rest/*)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-002",
+      "payload": "/api/assets",
+      "tags": [
+        "rate-limit",
+        "zone-api",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'api' zone (1000 req/min limit on /api/*)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-003",
+      "payload": "/login",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "128"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone (10 req/min limit - strict)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-004",
+      "payload": "/auth/signin",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "256"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "brute-force-protection",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /auth* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-005",
+      "payload": "/token",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "512"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /token* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-006",
+      "payload": "/api/assets/stream.mp4",
+      "headers": {
+        "Range": "bytes=0-1024"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-streaming",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'streaming' zone (1000 req/min for Range requests)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-007",
+      "payload": "/api/assets/upload",
+      "method": "POST",
+      "headers": {
+        "Content-Length": "10485760"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-uploads",
+        "large-file",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'uploads' zone (100 req/min for >1MB uploads)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-008",
+      "payload": "/icons/favicon.ico",
+      "tags": [
+        "rate-limit",
+        "zone-static-assets",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'static_assets' zone (10,000 req/min)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-009",
+      "payload": "/style.css",
+      "tags": [
+        "rate-limit",
+        "zone-static-assets",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'static_assets' zone for CSS files",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-010",
+      "payload": "/",
+      "tags": [
+        "rate-limit",
+        "zone-general",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'general' zone (360 req/min = 6 req/sec)",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-011",
+      "payload": "/password/reset",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "64"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "password-reset",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /password* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-012",
+      "payload": "/signup",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "200"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "registration",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /signup* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-013",
+      "payload": "/register",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "180"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "registration",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /register* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-014",
+      "payload": "/health",
+      "tags": [
+        "rate-limit",
+        "excluded",
+        "health-check",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Verify /health is excluded from rate limiting",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-015",
+      "payload": "/api/socket.io/",
+      "headers": {
+        "Connection": "Upgrade",
+        "Upgrade": "websocket"
+    },
+      "tags": [
+        "rate-limit",
+        "excluded",
+        "websocket",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Verify WebSocket connections excluded from rate limiting",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-016",
+      "payload": "/rest/executions",
+      "tags": [
+        "rate-limit",
+        "zone-api",
+        "n8n",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'api' zone for n8n executions endpoint",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-017",
+      "payload": "/api/search/metadata",
+      "tags": [
+        "rate-limit",
+        "zone-api",
+        "immich",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'api' zone for Immich search endpoint",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-018",
+      "payload": "/application/saml/",
+      "tags": [
+        "rate-limit",
+        "zone-general",
+        "authentik",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'general' zone for Authentik SAML paths",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-019",
+      "payload": "/signin",
+      "method": "POST",
+      "headers": {
+        "Content-Type": "application/json",
+        "Content-Length": "100"
+    },
+      "tags": [
+        "rate-limit",
+        "zone-auth-like",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'auth_like' zone on /signin* path",
+      "category": "RateLimit"
+  },
+  {
+      "id": "RATE-ZONE-020",
+      "payload": "/image.png",
+      "tags": [
+        "rate-limit",
+        "zone-static-assets",
+        "quick",
+        "low"
+    ],
+      "expected_block": false,
+      "severity_hint": "Low",
+      "notes": "Test 'static_assets' zone for PNG files",
+      "category": "RateLimit"
+  }
+]