![](/assets/headers/header-logo.png)

![](https://img.shields.io/badge/Tools%20%26%20Resources%20Available-30-757575?style=for-the-badge)

## Defensive Security

### Firewall Hardware

* [Netgate](https://shop.netgate.com/) - Open-source company that provides high-performance and affordable appliance and software-based firewall, VPN, and routing solutions.
* [UniFi](https://www.ui.com/) - Full-Stack Networking. Home to Enterprise grade equipment. 
* [Untangle](https://www.untangle.com/untangle-ng-firewall/appliances/) - Network Security Framework provides cloud-managed security and connectivity. 

### Firewall Software

* [ClearOS](https://github.com/pfsense/pfsense) - Designed for use in small and medium enterprises as a network gateway. 
* [Endian](https://sourceforge.net/projects/efw/) - A turn-key linux security distribution that makes your system a full featured security appliance. 
* [ipfire](https://github.com/ipfire/ipfire-2.x) - The Open Source Firewall. ![last-commit](https://img.shields.io/github/last-commit/ipfire/ipfire-2.x?style=flat)
* [OPNsense](https://github.com/opnsense/core) - Main repository for OPNsense core. See [https://opnsense.org/](https://opnsense.org/) for more details and prebuilt images. ![last-commit](https://img.shields.io/github/last-commit/opnsense/core?style=flat)
* [pfSense](https://github.com/pfsense/pfsense) - Main repository for pfSense. Based on FreeBSD using the pf firewall. ![last-commit](https://img.shields.io/github/last-commit/pfsense/pfsense?style=flat)
* [Shorewall](https://shorewall.org/) - Shorewall is a gateway/firewall configuration tool for GNU/Linux. 
* [Sophos XG](https://www.sophos.com/en-us/products/free-tools/sophos-xg-firewall-home-edition.aspx) - Features full protection for your home network, including anti-malware, web security and URL filtering, application control, IPS, traffic shaping, VPN, reporting and monitoring, and much more. 
* [VyOS](https://github.com/vyos/vyos-build) - Open source router and firewall platform. ![last-commit](https://img.shields.io/github/last-commit/vyos/vyos-build?style=flat)

### Web Application Firewalls (WAF)

* [Lua Resty WAF](https://github.com/p0pr0ck5/lua-resty-waf) - High-performance WAF built on the OpenResty stack. ![last-commit](https://img.shields.io/github/last-commit/p0pr0ck5/lua-resty-waf?style=flat)
* [ModSecurity](https://github.com/SpiderLabs/ModSecurity) - Open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. ![last-commit](https://img.shields.io/github/last-commit/SpiderLabs/ModSecurity?style=flat)
* [Naxsi](https://github.com/nbs-system/naxsi) - Open-source, high performance, low rules maintenance WAF for NGINX. ![last-commit](https://img.shields.io/github/last-commit/nbs-system/naxsi?style=flat)
* [Predator](https://github.com/s0md3v/Predator) - Anti-Automation System. ![last-commit](https://img.shields.io/github/last-commit/s0md3v/Predator?style=flat)
* [Shadow Daemon](https://github.com/zecure/shadowd) - The Shadow Daemon web application firewall server. ![last-commit](https://img.shields.io/github/last-commit/zecure/shadowd?style=flat)
* [Vulture](https://www.vultureproject.org/) - An open-source WAF. 

---

## Offensive Security

* [Awesome WAF - Known Bypasses](https://github.com/0xInfection/Awesome-WAF#known-bypasses) - Known WAF bypasses 
* [Abuse SSL Bypass](https://github.com/LandGrey/abuse-ssl-bypass-waf) - Bypassing WAF by abusing SSL/TLS Ciphers. ![last-commit](https://img.shields.io/github/last-commit/LandGrey/abuse-ssl-bypass-waf?style=flat)
* [FTW](https://github.com/coreruleset/ftw) - Framework for Testing WAFs (FTW!). ![last-commit](https://img.shields.io/github/last-commit/coreruleset/ftw?style=flat)
* [gotestwaf](https://github.com/wallarm/gotestwaf) - Test different WAF for detection logic and bypasses. ![last-commit](https://img.shields.io/github/last-commit/wallarm/gotestwaf?style=flat)
* [hakoriginfinder](https://github.com/hakluke/hakoriginfinder) - Tool for discovering the origin host behind a reverse proxy. ![last-commit](https://img.shields.io/github/last-commit/hakluke/hakoriginfinder?style=flat)
* [IdentYwaf](https://github.com/stamparm/identywaf) - Blind WAF identification tool. ![last-commit](https://img.shields.io/github/last-commit/stamparm/identywaf?style=flat)
* [Lightbulb Framework](https://github.com/lightbulb-framework/lightbulb-framework) - Tools for auditing WAFS. ![last-commit](https://img.shields.io/github/last-commit/lightbulb-framework/lightbulb-framework?style=flat)
* [WAF Bench](https://github.com/microsoft/wafbench) - Tool to measure the performance of WAF. ![last-commit](https://img.shields.io/github/last-commit/microsoft/wafbench?style=flat)
* [WAF Bypass](https://github.com/vincentcox/bypass-firewalls-by-DNS-history) - This script will search for DNS A history records and check if the server replies for that domain. ![last-commit](https://img.shields.io/github/last-commit/vincentcox/bypass-firewalls-by-DNS-history?style=flat)
* [WAF Ninja](https://github.com/khalilbijjou/wafninja) - Tool which contains two functions to attack Web Application Firewalls. ![last-commit](https://img.shields.io/github/last-commit/khalilbijjou/wafninja?style=flat)
* [WAF Tester](https://github.com/Raz0r/waftester) - WAF Testing Tool. ![last-commit](https://img.shields.io/github/last-commit/Raz0r/waftester?style=flat)
* [wafw00f](https://github.com/EnableSecurity/wafw00f) - Allows one to identify and fingerprint WAF products protecting a website. ![last-commit](https://img.shields.io/github/last-commit/EnableSecurity/wafw00f?style=flat)
* [WhatWaf](https://github.com/Ekultek/WhatWaf) - Detect and bypass web application firewalls and protection systems ![last-commit](https://img.shields.io/github/last-commit/Ekultek/WhatWaf?style=flat)