Skip to main content

27. WAF Bypass Playbook: Small Variations That Disrupt Signatures

WAFs generally block requests using regular expressions/signatures. The key bypass strategy is therefore to “change the form while preserving the function.” The following variations are common in CTFs and real-world testing.

1) Disrupt Encoding and Normalization​

  • Double URL encoding (%252f) and mixed encoding (%2f + /)
  • Replace slashes/spaces with Unicode compatibility characters such as %u2215
  • Split tokens with letter case, whitespace, and comments

2) Change the Payload Structure​

  • SQLi: split with comments such as UNION/**/SELECT and /*!50000UNION*/
  • XSS: distribute event handlers and switch context with svg/math tags
  • SSTI: decompose attribute chains to evade filters (__class__ → attr chain)

3) Vary Request Paths and Headers​

  • Access the same resource through another path, such as ;/ or ..;/
  • Header-based bypasses using X-Forwarded-For or X-Original-URL

Defensive Perspective​

  • Perform normalization first on the server (decode → canonicalize), then inspect
  • Reinforce WAF rules with behavior-based signals such as rate, entropy, and behavior

Ultimately, bypassing is a game of finding “gaps before normalization.” Verify techniques legally and only in a test environment.