F5 WAF Tester

Question

Hi, anyone has experience on using F5 WAF Tester for testing the WAF policy to see whether it is working fine or not?

Source: https://clouddocs.f5.com/training/community/waf/html/waf2023/module3/lab2.html

I am concerning that it would impact the whole WAF or other applications that have WAF policies deployed.

nikoolayy1 · Answer

Can't you make a test server with a test app like juice shop or Damn Vulnerable Web Application (DVWA) and attach the same WAF policy under it ?
&nbsp;
Also if you allow internet access to the app you can use the F5 XC Heystack to do a test with a full report after the scan:
&nbsp;
&nbsp;F5 Adds Automated Penetration Testing to Strengthen Multicloud Application Security Capabilities | F5
&nbsp;
Introducing F5 Distributed Cloud Web App Scanning (youtube.com)

Forum Discussion

F5 WAF Tester

Recent Discussions

Glucovate Blood Sugar Support Review (2024-2025): Pros, Cons, and Potential Side Effects

F5 Hotfix

Bypass "Bad unescape" in Body POST (ASM, POST, JSON)

URL redirect

Bypass the character for Evasion technique Detected violation

Related Content

F5 WAF query

WAF Learning speed

F5 WAF Tester fails to execute. (ValueError: No JSON object could be decoded)

Black list file types in WAF -ASM

Can I extend the time of advanced WAF security events shown