SKILL: WAF Bypass Techniques

Metadata

• Skill Name: waf-bypass
• Folder: offensive-waf-bypass
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/waf-bypass.md

Description

WAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.

Trigger Phrases

Use this skill when the conversation involves any of: WAF bypass, web application firewall bypass, URL encoding, double encoding, Unicode bypass, comment injection, HTTP header bypass, chunked encoding, IP rotation, payload obfuscation, WAF evasion

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

---

Full Methodology

WAF Bypass Techniques

A Web Application Firewall (WAF) is a security tool that protects web applications from various attacks by analyzing HTTP requests and applying rules to identify and block suspicious traffic. This document outlines effective techniques to bypass WAF protections during security assessments.

graph TD
    A[Client] -->|HTTP Request| B[WAF]
    B -->|Filtered Request| C[Web Application]
    C -->|Response| D[WAF]
    D -->|Filtered Response| A

    E[Attacker] -->|Malicious Request| B
    B -->|Blocked| E

    F[Attacker with<br>Bypass Techniques] -->|Obfuscated<br>Malicious Request| B
    B -->|Request Appears Legitimate| C

    style B fill:#f9a,stroke:#333,color:#333
    style E fill:#f66,stroke:#333,color:#333
    style F fill:#f66,stroke:#333,color:#333

WAF Overview

WAFs operate in two primary models:

• Negative Model (Blacklist-based): Uses pre-set signatures to block known malicious requests, effective against common vulnerabilities
• Positive Model (Whitelist-based): Only allows requests that match specific patterns, blocking everything else by default

Popular WAFs

• Cloudflare - Identified by __cf_bm, cf_clearance, cf_chl_* cookies and "/cdn-cgi/" routes (cookies rotate roughly every 30 min)
• Akamai
• Imperva/Incapsula - Look for "X-CDN: Incapsula" headers
• AWS WAF - Commonly sets AWSALB or AWSALBCORS cookies
• Sucuri - Check for "X-Sucuri-ID" headers
• DataDome
• F5 Networks
• Barracuda
• Fortinet
• ModSecurity - Open-source WAF, commonly used with Apache
• NAXSI - Open-source WAF for NGINX
• Azure Front Door
• Fastly Next-Gen WAF
• Cloudflare AI WAF
• Radware
• Coraza - Modern open‑source WAF written in Go

Detection Methods

flowchart LR
    A[WAF Detection Methods] --> B[Control Page Analysis]
    A --> C[HTTP Header Inspection]
    A --> D[Cookie Analysis]
    A --> E[Route Examination]
    A --> F[JavaScript Object Analysis]

    B --> B1[Block Pages]
    B --> B2[Challenge Pages]
    B --> B3[CAPTCHA Systems]

    C --> C1[Custom Security Headers]
    C --> C2[Server Headers]
    C --> C3[CDN Markers]

    D --> D1[WAF-specific Cookies]
    D --> D2[Challenge Cookies]

    E --> E1[CDN Paths]
    E --> E2[WAF Asset Routes]

    F --> F1[Protection Objects]
    F --> F2[Challenge Scripts]

    style A fill:#f96,stroke:#333,stroke-width:2px,color:#333

1. Inspect Control Pages - Many WAFs display specific pages when blocking access
2. Analyze HTTP Headers - Check response headers for WAF-specific indicators
3. Examine Cookies - WAFs often set specific cookies (e.g., cf_clearance for Cloudflare)
4. Look for Specific Routes - e.g., /cdn-cgi/ for Cloudflare
5. Check JavaScript Objects - WAFs inject specific JS objects (e.g., \_cf_chl_opt)
6. JA3/JA4/TLS Fingerprints - Compare your client’s TLS fingerprint with common browser fingerprints; mismatches are often blocked.
7. HTTP/2/3 Support - Identify protocol negotiation; some WAF policies differ by protocol.

Fingerprinting WAFs

Some specific fingerprints of common WAFs:

• Apache Generic: Writing method type in lowercase (e.g., get instead of GET)
• IIS Generic: Using tabs before method (e.g., GET /login.php HTTP/1.1)
• Cloudflare: Challenge pages with JavaScript verification
• ModSecurity: Specific error messages and block pages
• AWS WAF: AWSELB cookies and specific headers
• Fastly Next‑Gen WAF: fastly-debug-* headers (when enabled), service IDs in responses
• Cloudflare Bot Fight Mode/AI WAF: presence of Turnstile, managed challenge flows, Bot Management headers

Bypass Techniques

1. Use Residential IPs

• Data center IPs are easily detected by WAFs
• Residential IPs appear legitimate as they come from ISPs
• Mobile IPs are useful for websites showing different content for mobile users
• Use proxy rotation services to avoid IP-based rate limiting

2. Fortify Headless Browsers

Headless browsers often set special headers or variables that help WAFs recognize them as automation tools. Use the following libraries to make headless browsers appear more human-like:

• undetected_chromedriver for Selenium
• puppeteer-extra-plugin-stealth for Puppeteer/Playwright
• playwright-extra with playwright-extra-plugin-stealth for Playwright

3. Use Web Scraping APIs

Services like ZenRows implement sophisticated anti-bot techniques including:

• Premium proxies
• JS rendering
• WAF bypassing capabilities
• CAPTCHA solving
• Protocol emulation (HTTP/2 push/HTTP/3), humanization features

4. Call the Origin Server Directly

• Use services like Shodan or tools like CloudFlair to find the origin server IP
• Forge requests to make them appear as coming from a valid domain
• Bypass the WAF layer completely by contacting the server directly
• Check historical DNS records (e.g., with securitytrails API) – 2024 research found ~40 % of Fortune‑100 origins exposed via stale A records
• Check Alt-Svc leakage for HTTP/3, misconfigured Workers/Edge redirects exposing bucket hostnames

sequenceDiagram
    participant Attacker
    participant WAF
    participant Origin as Origin Server

    Note over Attacker,Origin: Normal Route (Blocked)
    Attacker->>WAF: Malicious Request
    WAF->>Attacker: Request Blocked

    Note over Attacker,Origin: Origin Bypass
    Attacker->>Attacker: Find Origin IP (Shodan, etc.)
    Attacker->>Origin: Direct Request with Host Header
    Origin->>Attacker: Response (WAF Bypassed)

5. Utilize WAF Solvers

• BypassWAF - Overcomes firewalls by looking for old DNS A records
• Cfscrape - Python module to bypass Cloudflare protection
• Cloudscraper - Python library to avoid Cloudflare waiting room

6. Reverse Engineer JavaScript Challenges

• Analyze injected JavaScript snippets used by WAFs
• Understand how the challenge works
• Create custom solutions that satisfy the challenge requirements

7. CAPTCHA Bypass Techniques

• Cloudflare Turnstile – low‑friction CAPTCHA replacement; see cloudflare_turnstile_bypass PoC (GUI‑driven, YMMV)
• Use CAPTCHA solving services - Though often expensive and not always reliable
• Utilize automated CAPTCHA solvers - Various libraries exist for different CAPTCHA types
• Implement prevention measures - Use techniques that prevent CAPTCHAs from appearing

Cloudflare Turnstile Bypass

// Visibility bypass: Complete Turnstile in hidden iframe
const iframe = document.createElement("iframe");
iframe.style.display = "none";
iframe.src = "https://challenges.cloudflare.com/...";
document.body.appendChild(iframe);

// Token reuse test: Check if cf_clearance tokens are single-use
// Save token from successful solve, attempt reuse across sessions

// Timing attack: Solve challenge, delay submission to test token expiry
setTimeout(() => submitWithToken(token), 60000);

Tools:

• cf-clearance-scraper (2024 fork with Turnstile support)
• cloudflare-turnstile-solver - Automated solving with browser automation
• turnstile-bypass - Research tool for testing Turnstile implementations

8. Avoid Honeypot Traps

• Don't interact with invisible elements (display: none)
• Skip elements with zero opacity or positioned off-screen
• Analyze HTML structure to identify potential honeypots
• Avoid filling hidden form fields

9. Defeat Browser Fingerprinting

• Randomize or spoof canvas fingerprinting results
• Use plugins that add noise to fingerprint data
• Modify user agent and other HTTP headers periodically
• Spoof hardware and software features to appear as different devices

10. TLS Fingerprinting Evasion

• Modify TLS parameters during handshake
• Use libraries that allow customization of SSL/TLS configuration
• Match TLS fingerprints of legitimate browsers
• Randomise both JA3 and JA4 fingerprints using libraries such as noble-tls or ja4py
• Consider using the abuse-ssl-bypass-waf tool to find supported SSL/TLS ciphers
• Align cipher suites, ALPN order, and signature algorithms with target browser versions.

11. Simulate Human Behavior

• Add random delays between requests
• Follow logical navigation patterns
• Implement mouse movements and scrolling behavior
• Interact with page elements naturally
• Vary request patterns and timing
• Use browser engines (Playwright/Selenium) with stealth plugins to match DOM APIs and canvas behavior.

mindmap
  root((WAF Bypass Techniques))
    Network Level
      Residential IPs
      Origin Server Direct
      IP Rotation
      Distributed Requests
    Browser Emulation
      Headless Browser Fortification
      TLS Fingerprint Evasion
      JS Challenge Solving
      Human Behavior Simulation
    Request Manipulation
      Header Manipulation
      Parameter Pollution
      HTTP Protocol Tricks
      Encoding Variations
    Attack Specific
      SQLi Bypasses
      XSS Obfuscation
      JSON-Based Injection
      Protocol Level Bypass
    Tools & Services
      WAF Solvers
      CAPTCHA Services
      Proxy Rotators
      Web Scraping APIs

12. SQL Injection Specific WAF Bypasses

• Case variation: SeLeCt, UnIoN instead of SELECT, UNION
• Comment injection: UN/**/ION SE/**/LECT to break up keywords
• Alternate encodings:
  • URL encoding: UNION → %55%4E%49%4F%4E
  • Hex encoding: SELECT → 0x53454C454354
  • Unicode encoding
• Whitespace manipulation: UNION/**/SELECT or using tabs/newlines/carriage returns
• Numeric representations:
  • 1 → 1-0, 1+0, CHAR(49)
• String concatenation:
  • MySQL: CONCAT('a','b')
  • Oracle: 'a'||'b'
  • MSSQL: 'a'+'b'
• Null byte injection:

  %00' UNION SELECT password FROM Users WHERE username='xyz'--
  

• Double encoding:

  First pass: / → %2f
  Second pass: %2f → %252f
  

• SQLMAP tamper scripts:
  • Use Atlas tool for suggesting tamper scripts
  • Try multiple tamper scripts in combination
  • Customize tamper scripts for specific WAFs
• JSON-Based SQL Injection (CVE-2023-50969):
  • Many WAFs (AWS, Cloudflare, F5, Imperva) don't properly support JSON syntax in SQL
  • Example: {"id": {"$gt": "' OR 1=1--"}}
  • Use SQLMap with JSON parameter support for exploitation
• Leverage mixed encodings (half‑width Unicode, overlong UTF‑8), embedded comments, and case folding differences.

graph TD
    A[SQL Injection WAF Bypass] --> B[Syntax Manipulation]
    A --> C[Character Encodings]
    A --> D[Alternative Representations]
    A --> E[SQLMap Tamper Scripts]

    B --> B1[Case Variation<br>SeLeCt]
    B --> B2[Comment Insertion<br>UN/**/ION]
    B --> B3[Whitespace Manipulation<br>UNION++++SELECT]