WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.
WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.
SKILL: WAF Bypass Techniques — Evasion Playbook
AI LOAD INSTRUCTION: Covers WAF identification, generic bypass categories (encoding, protocol abuse, HTTP/2, parameter pollution), and a decision tree. For product-specific bypasses (Cloudflare, AWS WAF, ModSecurity, Akamai, etc.), load WAF_PRODUCT_MATRIX.md. Base models often suggest basic encoding but miss protocol-level bypasses and WAF behavioral quirks.
csp-bypass-advanced when WAF blocks inline scripts but CSP bypass is available
ghost-bits-cast-attackJava backends only — when every encoding trick above is blocked, use Ghost Bits: Java's 16-bit char to 8-bit byte narrowing produces 255 Unicode bypass variants per dangerous ASCII byte; re-enables WAF-patched CVEs in Tomcat, Spring, Jetty, Jackson, Fastjson, BCEL, and more
Product-Specific Reference
Load WAF_PRODUCT_MATRIX.md when you need per-product bypass techniques for Cloudflare, AWS WAF, ModSecurity CRS, Akamai, Imperva, F5 BIG-IP, or Sucuri.
1. PHASE 0 — IDENTIFY THE WAF
Before bypassing, know what you're fighting.
1.1 Tools
Tool
Usage
wafw00f target.com
Fingerprint WAF vendor from response headers/behavior
Use case: WAF whitelists internal IPs or has different rule sets per source.
2.6 Path Normalization Tricks
Technique
Example
Effect
Dot segments
/./admin or /../target/admin
WAF sees different path than app
Double slash
//admin
Some normalizers collapse, WAFs may not
URL encoding path
/%61dmin
WAF sees encoded, app decodes
Null byte in path
/admin%00.jpg
Legacy: app truncates at null, WAF sees .jpg
Backslash (IIS)
/admin\..\/secret
IIS treats \ as /
Trailing dot/space
/admin. or /admin%20
OS-level normalization (Windows)
Semicolon (Tomcat)
/admin;jsessionid=x
Tomcat strips after ;, WAF may not
2.7 Content-Type Manipulation
WAFs often have format-specific parsers. Switching Content-Type can bypass rules:
Default: Content-Type: application/x-www-form-urlencoded → WAF parses params
Switch: Content-Type: application/json → WAF may not parse JSON body
Switch: Content-Type: multipart/form-data → WAF may not inspect all parts
Switch: Content-Type: text/xml → WAF expects XML, payload in different format
Trick: If app accepts both JSON and form-urlencoded, use JSON — WAFs often have weaker JSON inspection rules.
GET http://target.com/path?q=attack HTTP/1.1 ← Absolute URI: some WAFs miss the path
3.2 Header Injection via CRLF
If WAF inspects original headers but app processes injected ones:
X-Custom: value\r\nX-Forwarded-For: 127.0.0.1
3.3 Connection-State Bypass
1. Establish connection through WAF (normal request)
2. On same keep-alive connection, send attack request
3. Some WAFs reduce inspection on subsequent requests in same connection
4. WAF BYPASS DECISION TREE
Payload blocked by WAF?
├── Identify WAF (wafw00f, response headers, block page)
│
├── Try encoding bypasses
│ ├── URL encode payload → still blocked?
│ ├── Double URL encode → still blocked?
│ ├── Unicode/overlong UTF-8 → still blocked?
│ ├── Mixed case keywords → still blocked?
│ └── HTML entities (for XSS) → still blocked?
│
├── Try protocol-level bypasses
│ ├── Switch Content-Type (JSON, multipart, XML)
│ │ └── App accepts alternate format? → re-send payload
│ ├── HTTP Parameter Pollution (duplicate params)
│ ├── Chunked Transfer-Encoding to split payload
│ ├── HTTP/2 direct if available (binary framing bypass)
│ └── Request line: absolute URI format
│
├── Try path-based bypasses
│ ├── Path normalization (/./path, //path, ;param)
│ ├── Different HTTP method (POST vs PUT vs PATCH)
│ └── Alternate endpoint serving same function
│
├── Try payload mutation
│ ├── SQL: comments (/**/), alternative functions, hex literals
│ ├── XSS: alternative tags/events, JS template literals
│ ├── RCE: wildcard abuse, string concatenation, variable expansion
│ └── Check WAF_PRODUCT_MATRIX.md for vendor-specific mutations
│
├── Try IP-source bypass
│ ├── X-Forwarded-For / True-Client-IP spoofing
│ ├── Access origin server directly (bypass CDN)
│ └── Find origin IP (Shodan, historical DNS, email headers)
│
└── Try request smuggling to skip WAF entirely
└── See ../request-smuggling/SKILL.md
5. COMMON MISTAKES & TRICK NOTES
Test bypass with actual exploitation, not just 200 OK: WAF may return 200 but strip the payload silently.
WAFs often have size limits: Very large request bodies (>8KB–128KB depending on WAF) may bypass inspection entirely.
Rate limiting ≠ WAF: Getting 429s is rate limiting, not payload blocking. Different bypass needed.
CDN caching: If the WAF is at CDN level, cached responses bypass WAF on subsequent requests. Poison cache with clean request, exploit cache.
Origin server direct access: If you find the origin IP behind CDN/WAF, connect directly — WAF is bypassed completely.
Multipart file upload fields: WAFs often skip inspection of file content in multipart uploads — embed payload in filename or file content if reflected.
