WAF Bypass

Web Application Firewalls inspect HTTP traffic and block requests matching known attack signatures. Every commercial WAF has implementation gaps — regex engine limits, encoding blind spots, protocol handling quirks, and normalization inconsistencies. Exploiting these gaps requires methodical identification of the WAF technology, understanding its rule engine, and crafting payloads that bypass detection without altering exploit semantics.

WAFs log aggressively. Every blocked request is recorded with your source IP, the matched rule ID, and the full request. Careless testing burns your IP, triggers escalating defenses (CAPTCHA, tarpit, permanent block), and alerts blue teams. Approach WAF bypass as a precision operation.

Triage Workflow

Follow this sequence. Each phase builds on the previous one.

Phase 1 — WAF Detection and Fingerprinting

Identify whether a WAF exists and which product it is. Do not skip this — blind bypass attempts waste time and generate noise.

Load: ToolSearch → select:mcp__hexstrike-ai__wafw00f_scan

# Primary detection — wafw00f identifies 150+ WAFs
wafw00f https://target.com

# Verbose mode reveals detection method
wafw00f https://target.com -v

# Scan all URLs in scope
wafw00f -i urls.txt -o waf-results.json

# Secondary — nmap NSE scripts
nmap -p 443 --script http-waf-detect target.com
nmap -p 443 --script http-waf-fingerprint target.com

Manual fingerprinting when tools are inconclusive:

• Send a benign request, note response headers (Server, X-Powered-By, Via, X-CDN)
• Send a clearly malicious request (?id=1' OR 1=1--), note the block response
• Compare block page HTML, status code, and headers against known WAF signatures
• Check Set-Cookie names — Cloudflare uses __cf_bm, Incapsula uses visid_incap_*, AWS WAF returns awsalb

Log the WAF identification immediately:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add target.com defense waf-type "Cloudflare Business" --source wafw00f
node ${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js add wafw00f target.com "waf-fingerprint" success --notes "Identified Cloudflare Business plan WAF"

See references/waf-fingerprinting.md for the complete fingerprinting reference.

Phase 2 — Origin IP Discovery (CDN Bypass)

If the target sits behind a CDN-based WAF (Cloudflare, Akamai, Incapsula, AWS CloudFront), finding the origin server IP bypasses the WAF entirely. This is the highest-value bypass — all WAF protections are eliminated.

Historical DNS records — check for A records that predate CDN adoption:

• SecurityTrails API, ViewDNS.info, DNS Dumpster, Wayback Machine DNS
• subfinder_scan + httpx_probe to find subdomains resolving to non-CDN IPs
• Mail servers (MX records), FTP servers, staging/dev subdomains often bypass CDN

Certificate transparency — search CT logs for certificates issued to the domain. Origin hosting providers issue certificates that reveal server IPs when cross-referenced with Censys/Shodan.

Email header analysis — trigger outbound emails (password reset, signup confirmation). Received: and X-Originating-IP headers reveal origin server IPs.

Censys/Shodan — search for the same SSL certificate SHA256, HTTP title, or favicon hash on non-CDN IP ranges.

Once the origin IP is found:

# Bypass CDN entirely — direct origin access
curl -H "Host: target.com" https://ORIGIN_IP/ --resolve target.com:443:ORIGIN_IP

# Or add to /etc/hosts for all tools
echo "ORIGIN_IP target.com" >> /etc/hosts

Log the origin IP discovery:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add target.com network origin-ip "203.0.113.42" --source "cert-transparency"
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add target.com config "cdn-bypass" MEDIUM "Origin IP exposed — WAF completely bypassed via direct access"

See references/cloudflare-bypass.md for Cloudflare-specific origin discovery.

Phase 3 — WAF Rule Analysis

Before crafting bypass payloads, understand what the WAF blocks and what it allows. Map the rule surface:

1. Baseline: Send normal requests and record responses (status, headers, body length, response time)
2. Trigger known signatures: Send common attack strings one at a time — <script>, ' OR 1=1--, {{7*7}}, ../../../etc/passwd, ; ls
3. Record block behavior: Note status codes (403, 406, 429, 503), block page content, response headers, and response time per blocked pattern
4. Test encoding: Repeat blocked payloads with URL encoding, double encoding, Unicode, case variation
5. Identify rule granularity: Determine if the WAF blocks on keywords, regex patterns, or semantic analysis

# Use httpx to probe with various payloads and record status codes
# Log each bypass attempt
node ${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js add "manual" target.com "waf-rule-probe" partial --notes "403 on <script>, 200 on <ScRiPt>"

Load: ToolSearch → select:mcp__hexstrike-ai__http_repeater

Use http_repeater to replay requests with modified payloads systematically. Use http_intruder to fuzz with encoding variations.

Phase 4 — Bypass Technique Selection

Select bypass strategy based on WAF type. Each WAF has known weaknesses.

Decision Tree

Phase 5 — Payload Crafting

Load: ToolSearch → select:mcp__hexstrike-ai__advanced_payload_generation

Generate WAF-evasion payloads with context about the specific WAF:

• advanced_payload_generation — specify WAF type, blocked signatures, and allowed encodings
• ai_generate_payload — context-aware generation for specific vulnerability + WAF combination

For SQLi with WAF evasion, use sqlmap tamper scripts:

# Common tamper script chains by WAF
# Cloudflare:
sqlmap -u "URL" --tamper=between,randomcase,space2comment,charencode

# ModSecurity CRS:
sqlmap -u "URL" --tamper=space2comment,between,randomcase,equaltolike

# AWS WAF:
sqlmap -u "URL" --tamper=charunicodeencode,space2mssqlblank,between

# Generic:
sqlmap -u "URL" --tamper=apostrophemask,randomcase,space2comment,charencode,percentage

Use http_set_rules to apply automatic evasion headers to all subsequent requests:

Load: ToolSearch → select:mcp__hexstrike-ai__http_set_rules

Apply rules:
- X-Forwarded-For: 127.0.0.1
- X-Originating-IP: 127.0.0.1
- X-Real-IP: 127.0.0.1
- X-Remote-Addr: 127.0.0.1
- User-Agent: Mozilla/5.0 (legitimate browser UA)

See references/encoding-evasion.md for the complete encoding technique reference. See references/protocol-level-bypass.md for HTTP-layer bypass techniques.

Phase 6 — Validation and Confirmation

A bypass is only valid when the payload reaches the application and produces the intended effect:

1. Confirm the payload was not modified/sanitized by the WAF (check response for reflected payload)
2. Confirm the exploit logic executed (verify SQLi data extraction, XSS DOM chan