How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the different security testing methodologies that can be applied to test Web Application Firewall? I was able to find a free WAF testing framework developed by Imperva, which generates traffic to test how legitimate and illegitimate traffic is handled by WAF for false positives. I think this technique is limited to traffic generator capability. Is this the only way to test WAF?
To properly test your appliance and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules.
I would also make them test the application which you are protecting without a WAF, as this will purely test the security of your application. (A WAF is not a miracle to protect a badly secured web application)
If you don't have a budget have a look at Burp (not free) or ZAP and gather some custom payloads from the internet yourself to fuzz your application with.