Waf Bypass Techniques

If you're getting 403s on SQLi or XSS payloads, this walks you through the evasion toolkit: wafw00f fingerprinting, encoding tricks (double URL encode, hex, overlong UTF-8), chunked transfer splitting, HTTP/2 binary bypasses, parameter pollution, and path normalization games like semicolon injection for Tomcat. It covers both generic techniques and routes you to a product matrix for Cloudflare, ModSecurity, AWS WAF specifics. The decision tree is practical, the examples are copy-paste ready, and it includes a Ghost Bits reference for Java backends when standard encoding fails. This is the playbook you open when a WAF is eating your test payloads and you need to iterate fast.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill waf-bypass-techniques --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: WAF Bypass Techniques — Evasion Playbook

AI LOAD INSTRUCTION: Covers WAF identification, generic bypass categories (encoding, protocol abuse, HTTP/2, parameter pollution), and a decision tree. For product-specific bypasses (Cloudflare, AWS WAF, ModSecurity, Akamai, etc.), load WAF_PRODUCT_MATRIX.md. Base models often suggest basic encoding but miss protocol-level bypasses and WAF behavioral quirks.