It could be that GoTestWAF’s availability pre-check for GraphQL and gRPC, when a target is behind a WAF, ends up incorrectly marking the endpoint as unavailable—even though it is actually reachable. In such cases, the GraphQL or gRPC test suites might be skipped entirely and not appear in the final report.
Two common scenarios may explain this behavior:
GraphQL — the pre-check sends a request like GET /graphql?query={__typename}, which might resemble an introspection probe. Some WAFs could interpret this as suspicious and block it, causing the tool to assume the endpoint is not available and skip GraphQL testing.
gRPC — the pre-check needs direct access to the gRPC port. If the WAF only proxies standard HTTP/HTTPS ports (80/443) or resets the connection, the availability check may fail even though the service itself is functional.
As a result, current workarounds might involve configuring WAF exceptions (which can be overly permissive or impractical) or excluding the protocol from the scan. A possible improvement would be to introduce optional flags that bypass the pre-check and assume availability, allowing the scan to proceed with actual payload testing while still relying on the WAF for inspection and enforcement.
It could be that GoTestWAF’s availability pre-check for GraphQL and gRPC, when a target is behind a WAF, ends up incorrectly marking the endpoint as unavailable—even though it is actually reachable. In such cases, the GraphQL or gRPC test suites might be skipped entirely and not appear in the final report.
Two common scenarios may explain this behavior:
GraphQL — the pre-check sends a request like GET /graphql?query={__typename}, which might resemble an introspection probe. Some WAFs could interpret this as suspicious and block it, causing the tool to assume the endpoint is not available and skip GraphQL testing.
gRPC — the pre-check needs direct access to the gRPC port. If the WAF only proxies standard HTTP/HTTPS ports (80/443) or resets the connection, the availability check may fail even though the service itself is functional.
As a result, current workarounds might involve configuring WAF exceptions (which can be overly permissive or impractical) or excluding the protocol from the scan. A possible improvement would be to introduce optional flags that bypass the pre-check and assume availability, allowing the scan to proceed with actual payload testing while still relying on the WAF for inspection and enforcement.