WAF bypass

WAF bypass

TL;DR: WAFs are signature/score engines on a normalised view of the request; bypass the normaliser, change the encoding, split the payload, or hide it behind something the WAF won’t parse.

What it is

A Web Application Firewall (Cloudflare, Akamai, F5/ASM, AWS WAF, Imperva, ModSecurity + CRS) inspects requests against rule sets. Bypasses target one of four surfaces: the normaliser (how the WAF parses the request), the rule set (what patterns it matches), the path (whether the WAF sees the request at all), or the scoring (anomaly-score thresholds and exclusions).

Preconditions / where it applies

  • A WAF in front of a vulnerable application — the underlying bug must exist; this is about delivery.
  • You can adjust headers, body, encoding, transport (HTTP/1.1 vs H2), and timing.
  • Sometimes the origin IP leaks (DNS history, certificate transparency, misconfigured subdomain) — then you just skip the WAF entirely.

Technique

  1. Find the origin. Skip the WAF by reaching the origin directly. Sources: securitytrails.com, crt.sh, archived A records, cloud reverse DNS, virtual-host probing.
  2. Encoding tricks.
    • URL-encode special chars (%27 for '), then double-encode (%2527). Some WAFs decode once, the app twice.
    • Unicode/IDN equivalents in payloads (<scrıpt> in some parsers).
    • Mixed case, NULL byte (%00), , JS template-literal tricks for cross-site-scripting.
  3. Comment / whitespace splitting. SQLi inline comments (/*!UNION*/), tab/CR/LF instead of space, () to remove space requirement.
  4. HTTP-level evasion.
    • Chunked Transfer-Encoding with body that re-assembles into the payload — many WAFs only inspect non-chunked bodies.
    • Content-Type tricks — switch JSON to XML or multipart and put the payload in a field name; some WAFs only parse the expected type.
    • Header location — payload in User-Agent, Referer, X-Forwarded-For; some rule sets only inspect body and query.
    • HTTP Parameter Pollution — duplicate parameters; WAF sees one, app concatenates both. See http-parameter-pollution.
  5. Oversize body. Many WAFs skip inspection above a configured limit (e.g. AWS WAF 8 KB on basic, Cloudflare default 128 KB). Pad with junk to push the payload past it.
  6. Path / parameter mismatch. ;, matrix params, double slashes, URL-encoded slashes — front-end routes one way, WAF normalises another, app a third.
  7. HTTP/2 and smuggling. Use H2-only features (http2-h2-downgrade-desync-v3) or http-request-smuggling to reach the back-end with a request the WAF never saw.

  8. Score-tuning. Where the WAF uses anomaly score (CRS), keep each individual signature below threshold and let the application sum the payload.

    1
2
3
4
5

    POST /search?q=x HTTP/1.1
Content-Type: application/json
Content-Length: 9999
...padding...
{"q":"%55NION %53ELECT 1,2,3"}

Detection and defence

  • Defense in depth: WAF + secure code. WAF is a delay, not a gate.
  • Keep rule sets current; subscribe to vendor advisories for newly-found bypasses.
  • Normalise inputs identically at WAF and app — same URL decoding, same JSON parser, same multipart handling.
  • Block ambiguous requests (TE+CL, duplicate params unless required, chunked + oversize body), inspect uploads.
  • Detection: anomaly-score buckets with frequent near-threshold hits; bursts from a single IP that probe encoding variants; correlation with origin-IP scans.

References