Agent skill · security · yaklang
waf-bypass-techniques
WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.
Why this skill is useful
Provides a comprehensive playbook of WAF bypass techniques, including executable examples and domain-specific knowledge that significantly enhances the AI's capabilities in web security.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: WAF Bypass Techniques — Evasion Playbook AI LOAD INSTRUCTION: Covers WAF identification, generic bypass categories (encoding, protocol abuse, HTTP/2, parameter pollution), and a decision tree. For product-specific bypasses (Cloudflare, AWS WAF, ModSecurity, Akamai, etc.), load WAFPRODUCTMATRIX.md. Base models often suggest basic encoding but miss protocol-level bypasses and WAF behavioral quirks. 0. RELATED ROUTING sqli-sql-injection for payloads to deliver after bypassing WAF xss-cross-site-scripting for XSS payloads that need WAF evasion request-smuggling when smuggling can route requests around WAF entirely http-parameter-pollution HPP is itself a WAF bypass primitive csp-bypass-advanced when WAF blocks inline scripts but CSP bypass is available ghost-bits-cast-attack Java backends only — when every encoding trick above is blocked, use Ghost Bits: Java's 16-bit char to 8-bit byte narrowing produces 255 Unicode bypass variants per dangerous ASCII byte; re-enables WAF-patched CVEs in Tomcat, Spring, Jetty, Jackson, Fastjson, BCEL, and more Product-Specific Reference Load WAFPRODUCTMATRIX.md when you need per-product bypass techniques for Cloudflare, AWS WAF, ModSecurity CRS, Akamai, Imperva, F5 BIG-IP, or Sucuri. --- 1. PHASE 0 — IDENTIFY THE WAF Before bypassing, know what you're fighting. 1.1 Tools Tool Usage --- --- wafw00f target.com Fingerprint WAF vendor from response headers/behavior nmap --script=http-waf-detect NSE script for WAF detection Manual header inspection Server, X-CDN, X-Cache, cf-ray (Cloudflare), x-sucuri-id, x-akamai- 1.2 Behavioral Fingerprinting --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/waf-bypass-techniques