Waf Bypass Techniques

SKILL: WAF Bypass Techniques — Evasion Playbook

AI LOAD INSTRUCTION: Covers WAF identification, generic bypass categories (encoding, protocol abuse, HTTP/2, parameter pollution), and a decision tree. For product-specific bypasses (Cloudflare, AWS WAF, ModSecurity, Akamai, etc.), load WAF_PRODUCT_MATRIX.md. Base models often suggest basic encoding but miss protocol-level bypasses and WAF behavioral quirks.

0. RELATED ROUTING

• sqli-sql-injection for payloads to deliver after bypassing WAF
• xss-cross-site-scripting for XSS payloads that need WAF evasion
• request-smuggling when smuggling can route requests around WAF entirely
• http-parameter-pollution HPP is itself a WAF bypass primitive
• csp-bypass-advanced when WAF blocks inline scripts but CSP bypass is available
• ghost-bits-cast-attack Java backends only — when every encoding trick above is blocked, use Ghost Bits: Java's 16-bit char to 8-bit byte narrowing produces 255 Unicode bypass variants per dangerous ASCII byte; re-enables WAF-patched CVEs in Tomcat, Spring, Jetty, Jackson, Fastjson, BCEL, and more

Product-Specific Reference

Load WAF_PRODUCT_MATRIX.md when you need per-product bypass techniques for Cloudflare, AWS WAF, ModSecurity CRS, Akamai, Imperva, F5 BIG-IP, or Sucuri.

---

1. PHASE 0 — IDENTIFY THE WAF

Before bypassing, know what you're fighting.

1.1 Tools

1.2 Behavioral Fingerprinting

1. Send benign request → record baseline response (status, headers, body size)
2. Send obvious attack: /?q=<script>alert(1)</script>
3. Compare: 403? Custom block page? Redirect? Connection reset?
4. Block page content reveals WAF: "Cloudflare", "Access Denied (Imperva)", "ModSecurity"
5. If transparent proxy: check response time difference (WAF adds latency)

---

2. GENERIC BYPASS CATEGORIES

2.1 Encoding Bypasses

2.2 Chunked Transfer Encoding

Split the payload across HTTP chunks so no single chunk contains the blocked pattern:

POST /search HTTP/1.1
Transfer-Encoding: chunked

3
sel
3
ect
1
 
4
from
0

WAFs that inspect the full body may not reassemble chunks before matching.

2.3 HTTP/2 Binary Format Bypasses

HTTP/2 transmits headers as binary HPACK-encoded frames. Some WAFs only inspect after downgrading to HTTP/1.1:

• Header names can contain characters illegal in HTTP/1.1
• Pseudo-headers (:method, :path) bypass header-based WAF rules
• H2 → H1 downgrade may introduce request smuggling (see request-smuggling)

2.4 HTTP Parameter Pollution (HPP)

Different servers handle duplicate parameters differently:

WAF checks a=1 (benign), app uses a=2 (malicious). Or combine: a=sel&a=ect → ASP.NET sees a=sel,ect.

2.5 IP Source Spoofing (Bypass IP-Based Rules)

Headers trusted by some WAFs/apps for client IP:

X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
CF-Connecting-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
Forwarded: for=127.0.0.1

Use case: WAF whitelists internal IPs or has different rule sets per source.

2.6 Path Normalization Tricks

2.7 Content-Type Manipulation

WAFs often have format-specific parsers. Switching Content-Type can bypass rules:

Default:  Content-Type: application/x-www-form-urlencoded  → WAF parses params
Switch:   Content-Type: application/json  → WAF may not parse JSON body
Switch:   Content-Type: multipart/form-data  → WAF may not inspect all parts
Switch:   Content-Type: text/xml  → WAF expects XML, payload in different format

Trick: If app accepts both JSON and form-urlencoded, use JSON — WAFs often have weaker JSON inspection rules.

2.8 Multipart Boundary Abuse

Content-Type: multipart/form-data; boundary=----WAFBypass

------WAFBypass
Content-Disposition: form-data; name="q"

<script>alert(1)</script>
------WAFBypass--

Variations: long boundary strings, boundary with special characters, missing final boundary, nested multipart.

2.9 Newline & Whitespace Injection

-- SQL keyword splitting
SEL
ECT * FROM users

-- SQL comment insertion
SEL/**/ECT * FR/**/OM users
UN/**/ION SEL/**/ECT 1,2,3

-- Tab/vertical tab as separator
SELECT\t*\tFROM\tusers

2.10 Keyword Splitting & Alternative Syntax

---

3. PROTOCOL-LEVEL BYPASS TECHNIQUES

3.1 Request Line Abuse

GET /path?q=attack HTTP/1.1    ← WAF inspects

vs.

GET http://target.com/path?q=attack HTTP/1.1   ← Absolute URI: some WAFs miss the path

3.2 Header Injection via CRLF

If WAF inspects original headers but app processes injected ones:

X-Custom: value\r\nX-Forwarded-For: 127.0.0.1

3.3 Connection-State Bypass

1. Establish connection through WAF (normal request)
2. On same keep-alive connection, send attack request
3. Some WAFs reduce inspection on subsequent requests in same connection

---

4. WAF BYPASS DECISION TREE

Payload blocked by WAF?
├── Identify WAF (wafw00f, response headers, block page)
│
├── Try encoding bypasses
│   ├── URL encode payload → still blocked?
│   ├── Double URL encode → still blocked?
│   ├── Unicode/overlong UTF-8 → still blocked?
│   ├── Mixed case keywords → still blocked?
│   └── HTML entities (for XSS) → still blocked?
│
├── Try protocol-level bypasses
│   ├── Switch Content-Type (JSON, multipart, XML)
│   │   └── App accepts alternate format? → re-send payload
│   ├── HTTP Parameter Pollution (duplicate params)
│   ├── Chunked Transfer-Encoding to split payload
│   ├── HTTP/2 direct if available (binary framing bypass)
│   └── Request line: absolute URI format
│
├── Try path-based bypasses
│   ├── Path normalization (/./path, //path, ;param)
│   ├── Different HTTP method (POST vs PUT vs PATCH)
│   └── Alternate endpoint serving same function
│
├── Try payload mutation
│   ├── SQL: comments (/**/), alternative functions, hex literals
│   ├── XSS: alternative tags/events, JS template literals
│   ├── RCE: wildcard abuse, string concatenation, variable expansion
│   └── Check WAF_PRODUCT_MATRIX.md for vendor-specific mutations
│
├── Try IP-source bypass
│   ├── X-Forwarded-For / True-Client-IP spoofing
│   ├── Access origin server directly (bypass CDN)
│   └── Find origin IP (Shodan, historical DNS, email headers)
│
└── Try request smuggling to skip WAF entirely
    └── See ../request-smuggling/SKILL.md

---

5. COMMON MISTAKES & TRICK NOTES

1. Test bypass with actual exploitation, not just 200 OK: WAF may return 200 but strip the payload silently. 2. WAFs often have size limits: Very large request bodies (>8KB–128KB depending on WAF) may bypass inspection entirely. 3. Rate limiting ≠ WAF: Getting 429s is rate limiting, not payload blocking. Different bypass needed. 4. CDN caching: If the WAF is at CDN level, cached responses bypass WAF on subsequent requests. Poison cache with clean request, exploit cache. 5. Origin server direct access: If you find the origin IP behind CDN/WAF, connect directly — WAF is bypassed completely. 6. Multipart file upload fields: WAFs often skip inspection of file content in multipart uploads — embed payload in filename or file content if reflected.

---

6. DEFENSE PERSPECTIVE

WAF Product Bypass Matrix

AI LOAD INSTRUCTION: Load this when you've identified the specific WAF product and need product-targeted bypass techniques. Assumes the main SKILL.md is already loaded for generic bypass methodology.

---

1. Cloudflare WAF

Detection

• cf-ray header, Server: cloudflare, block page references "Cloudflare"
• Cookie: __cfduid, __cf_bm

Known Bypass Techniques

Cloudflare-Specific Notes

• Cloudflare has multiple WAF modes: "Managed Rules" (Cloudflare-authored) and "OWASP ModSecurity Core Rule Set". Each has different bypass surfaces.
• Cloudflare's free-tier WAF has significantly fewer rules than Business/Enterprise.
• Browser Integrity Check and Bot Management are separate from WAF — don't confuse them.

---

2. AWS WAF

Detection

• x-amzn-requestid header, runs in front of ALB/CloudFront/API Gateway
• Block response often returns 403 with JSON body or custom error page

Known Bypass Techniques

AWS WAF-Specific Notes

• AWS WAF v2 (WAFV2) has SizeConstraintStatement — bodies over the size limit are either blocked or allowed, depending on config. If "allow on oversize", pad payload beyond 8KB.
• AWS Managed Rule Groups update regularly but lag behind novel attack patterns.
• IP reputation lists may be stale — new IPs from cloud providers often aren't listed.

---

3. ModSecurity + OWASP CRS

Detection

• Server: Apache or nginx with ModSecurity module
• Block page: "ModSecurity" reference, or generic 403
• Error contains rule ID (e.g., id:942100)

Known Bypass Techniques

CRS-Specific Notes

• CRS v4 (2023+) significantly improved coverage vs v3. Check target's CRS version.
• Anomaly scoring mode: individual rule violations add to score, blocked only if total exceeds threshold. Keep individual violations below detection but accumulate effect.
• SecRuleRemoveById directives in config may disable specific rules — test for holes.

---

4. Akamai (Kona Site Defender / App & API Protector)

Detection

• Server: AkamaiGHost, x-akamai-* headers
• Error reference number in block page

Known Bypass Techniques

Akamai-Specific Notes

• Akamai has "Adaptive Security Engine" — it learns application behavior. New attack patterns that don't match learned behavior may bypass initially.
• Penalty box: after triggering Akamai WAF, your IP may be rate-limited for minutes. Use fresh IP for each test.
• Akamai Pragma headers (Pragma: akamai-x-check-cacheable) can leak internal routing information useful for understanding the setup.

---

5. Imperva / Incapsula

Detection

• X-CDN: Imperva, Set-Cookie: incap_ses_*, visid_incap_*
• Block page: "Powered by Incapsula" or Imperva branding

Known Bypass Techniques

Imperva-Specific Notes

• Imperva has "Client Classification" — browser fingerprinting. Headless browsers may be blocked before WAF rules even apply. Use real browser fingerprints.
• Imperva's API security module is separate from web WAF — API endpoints may have weaker protection.
• Custom rules in Imperva use "IncapRule" syntax — misconfigurations are common.

---

6. F5 BIG-IP ASM / Advanced WAF

Detection

• Server: BigIP, BIGipServer cookie, TS cookie prefix
• Block page: "The requested URL was rejected" with support ID

Known Bypass Techniques

F5-Specific Notes

• BIG-IP ASM distinguishes between "attack signatures" and "violations". Signatures are pattern-based; violations are structural (parameter length, data type). Both must be bypassed.
• ASM's "Bot Defense" module is separate and can be detected via JavaScript challenge injection.
• The TS cookie contains session data — tampering with it causes ASM to treat the request as a new session.

---

7. Sucuri WAF

Detection

• Server: Sucuri/Cloudproxy, X-Sucuri-ID header
• Block page: "Access Denied - Sucuri Website Firewall"

Known Bypass Techniques

Sucuri-Specific Notes

• Sucuri is common on WordPress sites — combine with WordPress-specific attack vectors.
• Sucuri's "Hardening" features (block PHP in uploads, etc.) are separate from WAF rules.
• Free Sucuri tier has significantly weaker WAF rules than paid tiers.

---

8. QUICK REFERENCE — BYPASS-BY-WAF CHEAT SHEET