/waf-bypass

name: waf-bypass
description: |
  This skill should be used when the user mentions "WAF", "web application firewall", "WAF bypass",
  "WAF evasion", "WAF detection", "WAF fingerprint", "wafw00f", "firewall bypass", "firewall evasion",
  "request filtering", "request blocked", "payload blocked", "blocked by WAF", "403 forbidden",
  "406 not acceptable", "429 too many requests", "rate limit", "rate limiting", "IP ban", "IP block",
  "IP reputation", "IP blacklist", "CDN bypass", "origin IP", "origin discovery",
  "Cloudflare", "Cloudflare bypass", "CF bypass", "Cloudflare WAF",
  "AWS WAF", "AWS Shield", "AWS managed rules",
  "Akamai", "Akamai Kona", "Akamai WAF",
  "Imperva", "Incapsula", "Imperva WAF",
  "ModSecurity", "OWASP CRS", "Core Rule Set", "ModSec", "paranoia level",
  "Sucuri", "Sucuri WAF", "F5 BIG-IP", "F5 ASM", "Barracuda WAF",
  "Fortinet FortiWeb", "FortiWeb", "Citrix WAF", "Azure WAF", "Azure Front Door",
  "payload encoding", "double encoding", "URL encoding bypass", "Unicode normalization",
  "Unicode bypass", "null byte injection", "comment injection", "obfuscation",
  "mixed encoding", "hex encoding", "HTML entity encoding", "overlong UTF-8",
  "HTTP verb tampering", "method tampering", "HTTP/2 smuggling", "request smuggling",
  "chunked transfer", "chunked encoding", "content-type switching", "multipart abuse",
  "multipart boundary", "transfer-encoding", "HTTP parameter pollution", "HPP",
  "tamper script", "sqlmap tamper", "WAF rule bypass", "WAF rule evasion",
  "managed rules bypass", "custom rules bypass", "regex bypass", "regex evasion",
  "WAF fingerprinting", "WAF identification", "WAF detection technique",
  "nmap http-waf-detect", "nmap http-waf-fingerprint", "WAF error page",
  "WAF signature", "WAF response analysis", "security header analysis",
  "X-Forwarded-For bypass", "header injection bypass", "path normalization",
  "path confusion", "path traversal bypass", "directory traversal bypass".
version: 2.0.0

WAF Bypass

Web Application Firewalls inspect HTTP traffic and block requests matching known attack signatures. Every commercial WAF has implementation gaps — regex engine limits, encoding blind spots, protocol handling quirks, and normalization inconsistencies. Exploiting these gaps requires methodical identification of the WAF technology, understanding its rule engine, and crafting payloads that bypass detection without altering exploit semantics.

WAFs log aggressively. Every blocked request is recorded with your source IP, the matched rule ID, and the full request. Careless testing burns your IP, triggers escalating defenses (CAPTCHA, tarpit, permanent block), and alerts blue teams. Approach WAF bypass as a precision operation.

Triage Workflow

Follow this sequence. Each phase builds on the previous one.

Phase 1 — WAF Detection and Fingerprinting

Identify whether a WAF exists and which product it is. Do not skip this — blind bypass attempts waste time and generate noise.

Load: `ToolSearch` → `select:mcp__hexstrike-ai__wafw00f_scan`

# Primary detection — wafw00f identifies 150+ WAFs
wafw00f https://target.com

# Verbose mode reveals detection method
wafw00f https://target.com -v

# Scan all URLs in scope
wafw00f -i urls.txt -o waf-results.json

# Secondary — nmap NSE scripts
nmap -p 443 --script http-waf-detect target.com
nmap -p 443 --script http-waf-fingerprint target.com

Manual fingerprinting when tools are inconclusive:

• Send a benign request, note response headers (Server, X-Powered-By, Via, X-CDN)
• Send a clearly malicious request (`?id=1' OR 1=1--`), note the block response
• Compare block page HTML, status code, and headers against known WAF signatures
• Check `Set-Cookie` names — Cloudflare uses `__cf_bm`, Incapsula uses `visid_incap_*`, AWS WAF returns `awsalb`

Log the WAF identification immediately:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add target.com defense waf-type "Cloudflare Business" --source wafw00f
node ${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js add wafw00f target.com "waf-fingerprint" success --notes "Identified Cloudflare Business plan WAF"

See `references/waf-fingerprinting.md` for the complete fingerprinting reference.

Phase 2 — Origin IP Discovery (CDN Bypass)

If the target sits behind a CDN-based WAF (Cloudflare, Akamai, Incapsula, AWS CloudFront), finding the origin server IP bypasses the WAF entirely. This is the highest-value bypass — all WAF protections are eliminated.

**Historical DNS records** — check for A records that predate CDN adoption:

• SecurityTrails API, ViewDNS.info, DNS Dumpster, Wayback Machine DNS
• `subfinder_scan` + `httpx_probe` to find subdomains resolving to non-CDN IPs
• Mail servers (MX records), FTP servers, staging/dev subdomains often bypass CDN

**Certificate transparency** — search CT logs for certificates issued to the domain. Origin hosting providers issue certificates that reveal server IPs when cross-referenced with Censys/Shodan.

**Email header analysis** — trigger outbound emails (password reset, signup confirmation). `Received:` and `X-Originating-IP` headers reveal origin server IPs.

**Censys/Shodan** — search for the same SSL certificate SHA256, HTTP title, or favicon hash on non-CDN IP ranges.

**Once the origin IP is found**:

# Bypass CDN entirely — direct origin access
curl -H "Host: target.com" https://ORIGIN_IP/ --resolve target.com:443:ORIGIN_IP

# Or add to /etc/hosts for all tools
echo "ORIGIN_IP target.com" >> /etc/hosts

Log the origin IP discovery:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add target.com network origin-ip "203.0.113.42" --source "cert-transparency"
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add target.com config "cdn-bypass" MEDIUM "Origin IP exposed — WAF completely bypassed via direct access"

See `references/cloudflare-bypass.md` for Cloudflare-specific origin discovery.

Phase 3 — WAF Rule Analysis

Before cra