offensive-waf-bypass

Name: offensive-waf-bypass
Author: SnailSploit

2.8kstars447forks

How to install offensive-waf-bypass?

snailsploit/claude-red/offensive-waf-bypass

$npx -y skills add SnailSploit/Claude-Red --skill offensive-waf-bypass

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: WAF Bypass Techniques
2
3	## Metadata
4	- Skill Name: waf-bypass
5	- Folder: offensive-waf-bypass
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/waf-bypass.md
7
8	## Description
9	WAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`WAF bypass, web application firewall bypass, URL encoding, double encoding, Unicode bypass, comment injection, HTTP header bypass, chunked encoding, IP rotation, payload obfuscation, WAF evasion`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# WAF Bypass Techniques
29
30	A Web Application Firewall (WAF) is a security tool that protects web applications from various attacks by analyzing HTTP requests and applying rules to identify and block suspicious traffic. This document outlines effective techniques to bypass WAF protections during security assessments.
31
32	```mermaid
33	graph TD
34	A[Client] -->\|HTTP Request\| B[WAF]
35	B -->\|Filtered Request\| C[Web Application]
36	C -->\|Response\| D[WAF]
37	D -->\|Filtered Response\| A
38
39	E[Attacker] -->\|Malicious Request\| B
40	B -->\|Blocked\| E
41
42	F[Attacker with<br>Bypass Techniques] -->\|Obfuscated<br>Malicious Request\| B
43	B -->\|Request Appears Legitimate\| C
44
45	style B fill:#f9a,stroke:#333,color:#333
46	style E fill:#f66,stroke:#333,color:#333
47	style F fill:#f66,stroke:#333,color:#333
48	```
49
50	## WAF Overview
51
52	WAFs operate in two primary models:
53
54	- Negative Model (Blacklist-based): Uses pre-set signatures to block known malicious requests, effective against common vulnerabilities
55	- Positive Model (Whitelist-based): Only allows requests that match specific patterns, blocking everything else by default
56
57	## Popular WAFs
58
59	- Cloudflare - Identified by `__cf_bm`, `cf_clearance`, `cf_chl_*` cookies and "/cdn-cgi/" routes (cookies rotate roughly every 30 min)
60	- Akamai
61	- Imperva/Incapsula - Look for "X-CDN: Incapsula" headers
62	- AWS WAF - Commonly sets `AWSALB` or `AWSALBCORS` cookies
63	- Sucuri - Check for "X-Sucuri-ID" headers
64	- DataDome
65	- F5 Networks
66	- Barracuda
67	- Fortinet
68	- ModSecurity - Open-source WAF, commonly used with Apache
69	- NAXSI - Open-source WAF for NGINX
70	- Azure Front Door
71	- Fastly Next-Gen WAF
72	- Cloudflare AI WAF
73	- Radware
74	- Coraza - Modern open‑source WAF written in Go
75
76	## Detection Methods
77
78	```mermaid
79	flowchart LR
80	A[WAF Detection Methods] --> B[Control Page Analysis]
81	A --> C[HTTP Header Inspection]
82	A --> D[Cookie Analysis]
83	A --> E[Route Examination]
84	A --> F[JavaScript Object Analysis]
85
86	B --> B1[Block Pages]
87	B --> B2[Challenge Pages]
88	B --> B3[CAPTCHA Systems]
89
90	C --> C1[Custom Security Headers]
91	C --> C2[Server Headers]
92	C --> C3[CDN Markers]
93
94	D --> D1[WAF-specific Cookies]
95	D --> D2[Challenge Cookies]
96
97	E --> E1[CDN Paths]
98	E --> E2[WAF Asset Routes]
99
100	F --> F1[Protection Objects]
101	F --> F2[Challenge Scripts]
102
103	style A fill:#f96,stroke:#333,stroke-width:2px,color:#333
104	```
105
106	1. Inspect Control Pages - Many WAFs display specific pages when blocking access
107	2. Analyze HTTP Headers - Check response headers for WAF-specific indicators
108	3. Examine Cookies - WAFs often set specific cookies (e.g., cf_clearance for Cloudflare)
109	4. Look for Specific Routes - e.g., /cdn-cgi/ for Cloudflare
110	5. Check JavaScript Objects - WAFs inject specific JS objects (e.g., `\_cf_chl_opt`)
111	6. JA3/JA4/TLS Fingerprints - Compare your client’s TLS fingerprint with common browser fingerprints; mismatches are often blocked.
112	7. HTTP/2/3 Support - Identify protocol negotiation; some WAF policies differ by protocol.
113
114	### Fingerprinting WAFs
115
116	Some specific fingerprints of common WAFs:
117
118	- Apache Generic: Writing method type in lowercase (e.g., `get` instead of `GET`)
119	- IIS Generic: Using tabs before method (e.g., ` GET /login.php HTTP/1.1`)
120	- Cloudflare: Challenge pages with JavaScript verification
121	- ModSecurity: Specific error messages and block pages
122	- AWS WAF: AWSELB cookies and specific headers
123	- Fastly Next‑Gen WAF: `fastly-debug-*` headers (when enabled), service IDs in responses
124	- Cloudflare Bot Fight Mode/AI WAF: presence of Turnstile, managed challenge flows, Bot Management headers
125
126	## Bypass Techniques
127
128	### 1. Use Residential IPs
129
130	- Data center IPs are easily detected by WAFs
131	- Residential IPs ap

People who liked this also viewed

6 picks

Type

offensive-waf-bypass

2.8kstars447forks

View on GitHub

How to install offensive-waf-bypass?

snailsploit/claude-red/offensive-waf-bypass

$npx -y skills add SnailSploit/Claude-Red --skill offensive-waf-bypass

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: WAF Bypass Techniques
2
3	## Metadata
4	- Skill Name: waf-bypass
5	- Folder: offensive-waf-bypass
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/waf-bypass.md
7
8	## Description
9	WAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`WAF bypass, web application firewall bypass, URL encoding, double encoding, Unicode bypass, comment injection, HTTP header bypass, chunked encoding, IP rotation, payload obfuscation, WAF evasion`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# WAF Bypass Techniques
29
30	A Web Application Firewall (WAF) is a security tool that protects web applications from various attacks by analyzing HTTP requests and applying rules to identify and block suspicious traffic. This document outlines effective techniques to bypass WAF protections during security assessments.
31
32	```mermaid
33	graph TD
34	A[Client] -->\|HTTP Request\| B[WAF]
35	B -->\|Filtered Request\| C[Web Application]
36	C -->\|Response\| D[WAF]
37	D -->\|Filtered Response\| A
38
39	E[Attacker] -->\|Malicious Request\| B
40	B -->\|Blocked\| E
41
42	F[Attacker with<br>Bypass Techniques] -->\|Obfuscated<br>Malicious Request\| B
43	B -->\|Request Appears Legitimate\| C
44
45	style B fill:#f9a,stroke:#333,color:#333
46	style E fill:#f66,stroke:#333,color:#333
47	style F fill:#f66,stroke:#333,color:#333
48	```
49
50	## WAF Overview
51
52	WAFs operate in two primary models:
53
54	- Negative Model (Blacklist-based): Uses pre-set signatures to block known malicious requests, effective against common vulnerabilities
55	- Positive Model (Whitelist-based): Only allows requests that match specific patterns, blocking everything else by default
56
57	## Popular WAFs
58
59	- Cloudflare - Identified by `__cf_bm`, `cf_clearance`, `cf_chl_*` cookies and "/cdn-cgi/" routes (cookies rotate roughly every 30 min)
60	- Akamai
61	- Imperva/Incapsula - Look for "X-CDN: Incapsula" headers
62	- AWS WAF - Commonly sets `AWSALB` or `AWSALBCORS` cookies
63	- Sucuri - Check for "X-Sucuri-ID" headers
64	- DataDome
65	- F5 Networks
66	- Barracuda
67	- Fortinet
68	- ModSecurity - Open-source WAF, commonly used with Apache
69	- NAXSI - Open-source WAF for NGINX
70	- Azure Front Door
71	- Fastly Next-Gen WAF
72	- Cloudflare AI WAF
73	- Radware
74	- Coraza - Modern open‑source WAF written in Go
75
76	## Detection Methods
77
78	```mermaid
79	flowchart LR
80	A[WAF Detection Methods] --> B[Control Page Analysis]
81	A --> C[HTTP Header Inspection]
82	A --> D[Cookie Analysis]
83	A --> E[Route Examination]
84	A --> F[JavaScript Object Analysis]
85
86	B --> B1[Block Pages]
87	B --> B2[Challenge Pages]
88	B --> B3[CAPTCHA Systems]
89
90	C --> C1[Custom Security Headers]
91	C --> C2[Server Headers]
92	C --> C3[CDN Markers]
93
94	D --> D1[WAF-specific Cookies]
95	D --> D2[Challenge Cookies]
96
97	E --> E1[CDN Paths]
98	E --> E2[WAF Asset Routes]
99
100	F --> F1[Protection Objects]
101	F --> F2[Challenge Scripts]
102
103	style A fill:#f96,stroke:#333,stroke-width:2px,color:#333
104	```
105
106	1. Inspect Control Pages - Many WAFs display specific pages when blocking access
107	2. Analyze HTTP Headers - Check response headers for WAF-specific indicators
108	3. Examine Cookies - WAFs often set specific cookies (e.g., cf_clearance for Cloudflare)
109	4. Look for Specific Routes - e.g., /cdn-cgi/ for Cloudflare
110	5. Check JavaScript Objects - WAFs inject specific JS objects (e.g., `\_cf_chl_opt`)
111	6. JA3/JA4/TLS Fingerprints - Compare your client’s TLS fingerprint with common browser fingerprints; mismatches are often blocked.
112	7. HTTP/2/3 Support - Identify protocol negotiation; some WAF policies differ by protocol.
113
114	### Fingerprinting WAFs
115
116	Some specific fingerprints of common WAFs:
117
118	- Apache Generic: Writing method type in lowercase (e.g., `get` instead of `GET`)
119	- IIS Generic: Using tabs before method (e.g., ` GET /login.php HTTP/1.1`)
120	- Cloudflare: Challenge pages with JavaScript verification
121	- ModSecurity: Specific error messages and block pages
122	- AWS WAF: AWSELB cookies and specific headers
123	- Fastly Next‑Gen WAF: `fastly-debug-*` headers (when enabled), service IDs in responses
124	- Cloudflare Bot Fight Mode/AI WAF: presence of Turnstile, managed challenge flows, Bot Management headers
125
126	## Bypass Techniques
127
128	### 1. Use Residential IPs
129
130	- Data center IPs are easily detected by WAFs
131	- Residential IPs ap

People who liked this also viewed

6 picks

Type