WAF Evasion Fundamentals

Hello! Welcome back.

In our last lesson, we learned how to act as a detective, analyzing server responses to determine if a Web Application Firewall (WAF) is standing guard. You now know how to spot the tell-tale signs—blocking pages, strange headers, and unique status codes—that reveal a target's first line of defense.

Knowing the guard is there is one thing; getting past them is another. Today, we transition from detection to evasion. Our goal is to apply basic WAF bypass techniques for common vulnerabilities like SQLi and XSS. This is where the cat-and-mouse game truly begins. We'll explore how to disguise our payloads to slip past the WAF's rulebook while ensuring the backend application still understands and executes them.

1. The WAF Bypass Mindset: Thinking Like an Evader

At its core, bypassing a WAF is about exploiting the differences between two systems: the WAF itself and the backend application it's protecting. The WAF uses a set of signatures (a blacklist) to spot malicious patterns. Our job is to craft a payload that doesn't match any of those patterns but is still functional.

This leads to a central concept in WAF evasion: Impedance Mismatch. This occurs when the WAF and the backend application interpret the same request in different ways. We abuse this difference to our advantage.

To better understand this concept and the general categories of bypass techniques, let's watch a segment from a talk by security researcher Khalil Bijjou.

As you saw, most of our work will live in the "Impedance Mismatch" and "Rule Set Bypassing" categories. We're looking for ways to encode, transform, or rewrite our payloads so the WAF either misinterprets them or simply doesn't have a signature to detect them.

But how do we do this systematically? A blind-fuzzing approach is inefficient. A professional uses a clear methodology.

This methodology is your new workflow: Probe, Pinpoint, and Pivot. You probe with a known-bad payload, pinpoint the exact trigger, and then pivot your strategy to obfuscate that specific part.

2. Bypassing WAFs for SQL Injection

SQL Injection (SQLi) payloads are often rich with keywords (SELECT, UNION, FROM) and symbols (', --, *) that WAFs are trained to detect. Let's apply our methodology to get past them.

Technique 1: Whitespace and Comment Obfuscation

Many WAF rules are surprisingly rigid. They might look for the exact string UNION SELECT. By introducing characters that the WAF might filter out or that the SQL database ignores, we can break the signature.

• Inline Comments: Most SQL dialects support inline comments like /* */. A WAF might not see UNION/*comment*/SELECT as a threat, but the database will execute it as UNION SELECT.
• Whitespace Manipulation: SQL is flexible with whitespace. You can often use characters like newlines (%0a), tabs (%09), or other non-standard space characters to break up a signature.
• No Whitespace: Sometimes, the best way to hide is to not use spaces at all. Certain SQL constructs can be smashed together using parentheses.

Let's see this in action with a live demo focused on bypassing a WAF that blocks spaces in an SQLi payload.

Technique 2: Alternative Syntax and Encoding

SQL, like any language, has synonyms. If a WAF blocks AND 1=1, it might not block AND 2>1. If it blocks substring(), it might allow mid().

The document "Methods to Bypass a Web Application Firewall" provides an excellent list of such variations.

This variety is a key weapon. Always consider if there's a different, less common way to express your intent.

Test your understanding!

A WAF is blocking the following SQLi payload:
' OR 1=1--

Based on the techniques you've just learned, propose two different ways you might modify this payload to bypass the WAF.

Show answer

Here are a few possibilities:

1. Comment Obfuscation: ' OR/*foo*/1=1-- (Breaks up the OR 1=1 signature).
2. Alternative Logic: ' OR 2>1-- (Uses a different logical expression that still evaluates to true).
3. Encoding: ' OR 1%3d1-- (URL-encodes the = sign, which the WAF might miss but the backend may decode).
4. Case Variation: ' oR 1=1-- (Simple case changes can sometimes defeat case-sensitive rules).

3. Bypassing WAFs for Cross-Site Scripting (XSS)

Your JavaScript skills will be a significant asset here. XSS bypasses often rely on the browser's flexible parsing of HTML and JavaScript, creating a massive impedance mismatch between the WAF's rigid rules and the browser's forgiving nature.

Technique 1: Encoding, Encoding, Encoding

This is the most fundamental XSS bypass technique. Payloads can be encoded in multiple ways, and if the WAF doesn't decode it in the same way the browser does, the payload slips through.

• HTML Entities: < can be < or < or <.
• URL Encoding: < can be %3c.
• JavaScript Encoding: You can use Unicode (\u003c) or Hex (\x3c) escapes within JavaScript strings.

The following demonstrations show how different types of encoding and payload transformation can be used to achieve XSS.

Technique 2: Finding Obscure Event Handlers and Tags

WAFs have signatures for <script>, onerror, and onload. But the HTML and SVG specifications include hundreds of tags and event handlers. Many are obscure and less likely to be in a WAF's blacklist.

For example, a WAF might block onerror but not onwheel (triggered by a mouse wheel) or onfocus (triggered when an element receives focus).

The 'Web Ninja' tool shown in the next video automates the process of finding which tags and event handlers are not blocked.

Technique 3: Context-Specific Bypasses

The best bypass is one that is tailored to its environment. If your injection point is inside an XML document, you should think about XML-based obfuscation.

PortSwigger's lab on this topic is a perfect example.

Conclusion

You have now moved from a WAF detector to a WAF evader. You've learned that WAFs are not infallible fortresses but complex rule engines with inherent blind spots and weaknesses that can be systematically discovered and exploited.

Key Takeaways:

• WAF Bypassing is an Art of Mismatch: The most effective bypasses exploit differences in how the WAF and the backend application interpret your payload.
• Methodology is Crucial: Adopt the "Probe, Pinpoint, Pivot" workflow to deconstruct WAF rules instead of guessing randomly.
• Master the Core Techniques: Obfuscation through encoding (URL, HTML, hex), comments, whitespace manipulation, and using alternative syntax are your primary tools for both SQLi and XSS.
• Context is King: The best bypass is tailored to the specific vulnerability, technology stack, and data format (like XML or JSON) you are targeting.

Next Lesson Preview:

With this lesson, we conclude our module on advanced server-side vulnerabilities. You've covered a wide range of attack vectors from SSRF to WAF bypasses. We will now move into our next module, "Advanced Web Attacks & API Security." We'll begin by dissecting a technology at the heart of most modern authentication systems: JSON Web Tokens (JWTs). You will learn their structure and, more importantly, how to exploit common implementation flaws to achieve devastating impact.