internal/

Package client provides an *http.Client whose TLS handshake matches a persona's utls ClientHelloID.

Package detect identifies which WAF or bot-management vendor served an HTTP response, and at which layer the request was intercepted.

Package harimport reads HAR 1.2 files (Chrome/Firefox DevTools, Charles, Fiddler, mitmproxy) and converts a chosen request into a Captured persona JSON — a frozen snapshot of the User-Agent, headers, cookies, body, method.

Package hunt runs a baseline probe plus N axis-mutation probes against a target URL, then diffs the outcomes to identify which fingerprint axes (TLS version, ALPN, SNI, UA, cookies, headers, method) the WAF is using.

Package output renders probe results to a stream (stdout or a file) in either a human-readable pretty format or JSON.

Package persona defines client identities (TLS fingerprint + User-Agent) that wafprobe uses to issue requests against a target.

Package probe runs multiple TLS personas against a single target in parallel and classifies each response via the detect package.