Why I Built Fray —
And Why I'm Giving It Away

TL;DR

We built Fray — an open-source offensive security toolkit with 5,500+ curated attack payloads, automatic fingerprinting for 25 WAF vendors, and native integration with Claude Code and ChatGPT. It's free, it has zero dependencies, and you can run it in 10 seconds.

We're open-sourcing it because the attackers already have these payloads. The defenders are the ones who don't. This levels the playing field.

The Problem Nobody Talks About

Here's a dirty secret in web application security: most companies have no idea if their WAF actually works.

They pay $5,000–$50,000/year for a Web Application Firewall — Cloudflare, AWS WAF, Akamai, Imperva — slap it in front of their app, and assume they're protected. They run a quick scan with a commercial tool, see a green checkmark, and move on.

But what happens when a real attacker shows up?

I've spent years in security consulting, and the pattern is always the same:

1. Company deploys WAF with default rules
2. Company assumes they're safe
3. Attacker bypasses WAF in 15 minutes using a $0 payload from a GitHub repo
4. Company gets breached
5. Repeat

The few testing tools that exist are either outdated (last updated 2019), fragmented (scattered across 50 repos), expensive (commercial tools costing more than the WAF), or unusable (raw text files with no tooling). Fray fixes all four.

What's Actually Inside: The Nitty Gritty

Fray isn't just a dump of random payload strings scraped from the internet. Every payload is categorized by attack vector, mapped to OWASP frameworks, tagged with CVEs where applicable, tested against real WAFs, and documented with descriptions explaining what it does and why it matters.

5,500+ Payloads Across 22 Categories

Deep Dive: Why XSS Gets 779 Payloads

XSS is the most common web vulnerability (OWASP A03:2021) and WAF bypass techniques evolve constantly. Our collection isn't 779 variations of <script>alert(1)</script>. It includes:

• Event handler abuse — <img src=x onerror=alert(1)> and 200+ variations targeting every HTML element
• Encoding bypasses — double URL encoding, Unicode normalization, HTML entities, mixed case, hex encoding
• DOM-based XSS — payloads targeting client-side frameworks (React, Angular, Vue)
• Mutation XSS (mXSS) — payloads exploiting browser HTML parser differences
• 2025–2026 techniques — template literals, CSS injection vectors, SVG abuse, WebSocket-based delivery

Every payload is designed to answer one question: does your WAF block this, or does it slip through?

LLM Security: The New Frontier

This is the category I'm most excited about. As organizations deploy LLMs in production, prompt injection is the new XSS. Our 300+ AI security payloads include:

• Direct prompt injection (DPI) — overriding system prompts through user input
• Indirect prompt injection — embedding instructions in data the LLM processes (RAG poisoning)
• Jailbreak techniques — DAN, role-playing, encoding tricks, multi-turn escalation
• Data exfiltration — extracting training data or system prompts through crafted queries
• Tool/function calling abuse — manipulating LLM tool use for unauthorized actions

138 Modern Bypass Techniques (2025–2026)

This section alone is worth the clone. These are bypass techniques discovered in the last 18 months that most WAF rule sets haven't caught up to:

• Chunked transfer encoding abuse
• HTTP/2 header smuggling
• Unicode normalization bypasses
• Polyglot payloads (valid in multiple contexts simultaneously)
• Browser-specific parsing quirks
• Content-Type confusion attacks

WAF Detection: 25 Vendors Fingerprinted

Before you test payloads, you need to know what you're up against. Fray's WAF detector identifies 25 vendors by analyzing HTTP response headers, cookies, error pages, server signatures, and response timing patterns.

Each detection includes a confidence score (0–100%) based on how many signatures matched. High confidence (70–100%) means multiple indicators confirmed. Low confidence means we found hints but can't be certain.

100% OWASP Coverage — All Four Frameworks

Most tools cover parts of OWASP Top 10. Fray covers all four major OWASP frameworks with 100% category completeness:

This means if you're doing a security assessment and need payloads for any OWASP category — web, mobile, AI, or API — Fray has you covered. No more stitching together payloads from five different repos.

Why AI-Native Matters

This is what separates Fray from SecLists, PayloadsAllTheThings, and every other payload collection.

Fray was designed from day one to work with AI assistants. Every payload is categorized, tagged, and documented in structured JSON — not dumped as raw text. This means AI assistants can understand the data and make intelligent decisions.

With Claude Code (in your IDE)

With ChatGPT

The key insight: AI assistants are only as good as the data they work with. A structured, documented payload database turns ChatGPT from a generic security chatbot into an actual penetration testing copilot.

Professional Security Reports

After a scan, Fray generates a self-contained HTML report you can share with your team, attach to a pentest deliverable, or hand to a client. No external dependencies — just open it in any browser or print to PDF.

What's in the report:

• Executive summary — total payloads tested, blocked vs bypassed, security score
• Block rate progress bar — visual effectiveness metric at a glance
• Category breakdown table — per-category (XSS, SQLi, SSRF, etc.) block rates with status badges
• Vulnerabilities discovered — bypassed payloads grouped by severity (Critical → Low)
• Recommendations — WAF-specific tuning advice and OWASP remediation steps
• Detailed results — full payload-by-payload log with HTTP status codes

MCP Server: Let AI Call Fray Directly

Fray v3.1 ships with an MCP (Model Context Protocol) server — the standard that Claude, Cursor, and other AI IDEs use to call external tools. Instead of copy-pasting payloads, your AI assistant calls Fray directly.

6 Tools Available via MCP

Once configured, Claude can search payloads, look up CVEs, and suggest WAF-specific bypasses in real time — without you ever leaving your IDE.

Why Open Source? Why Free?

I could have kept this proprietary. A curated payload database with WAF detection and AI integration has real commercial value — security consulting firms would pay for it. But I'm open-sourcing it for four reasons:

How to Actually Use This

Scenario 1: "Is my WAF actually protecting me?"

Scenario 2: "We just deployed a WAF — what do we test first?"

Start with the OWASP Top 10 payloads. If your WAF can't block these, nothing else matters:

1. A03: Injection — Run all XSS and SQLi payloads. This is where most breaches start.
2. A01: Broken Access Control — Test path traversal and SSRF payloads.
3. A10: SSRF — Critical for cloud deployments. Test metadata endpoint access.

Scenario 3: "I'm doing a bug bounty and found a WAF"

1. Run fray detect to identify the vendor
2. Check vendor-specific bypass payloads in the database
3. Try the 138 modern bypass techniques (2025–2026)
4. Use encoding variations and polyglots

Scenario 4: "Test our LLM deployment for prompt injection"

Custom Payloads: The Real Power

The pre-built database is just the starting point. The real power of Fray is building custom payloads for your specific environment.

Every organization's WAF configuration is different. The rules that Cloudflare applies to an e-commerce site are different from what AWS WAF applies to a financial API. Generic testing misses the gaps. Custom testing finds them.

With AI assistants, you can go even further: describe your tech stack in plain English and let Claude or ChatGPT generate targeted payloads using Fray's database as a foundation.

What's Next

Fray is just getting started. Here's what we're building:

• Auto-update pipeline — new CVEs and bypass techniques added within 48 hours of disclosure
• Monthly WAF benchmark reports — public reports comparing vendor effectiveness against our payload database
• Community payload submissions — structured contribution process with automated validation
• REST API mode — integrate Fray into your CI/CD pipeline
• More AI integrations — Codex CLI, Gemini, local LLMs via Ollama