Using CTS to Audit WAF