Skip to content

Back to the catalog

Bypass Web Application Firewall (WAF) with EvilWAF
hackers-arise.comarticle

Bypass Web Application Firewall (WAF) with EvilWAF

Hackers-Arise walkthrough of EvilWAF, an open-source MITM proxy and standalone WAF vulnerability scanner that evades modern behavior-based WAFs by rotating TCP/TLS fingerprints (JA3/JA4) rather than altering attack payloads. It covers proxying sqlmap traffic through EvilWAF, its auto-hunt feature for discovering and routing directly to the real origin IP behind a WAF, and its scan-only mode that probes ten WAF defense layers (rule engine, rate limiting, HTTP method handling, TLS settings). The piece also discusses why Cloudflare's ML-based behavioral fingerprinting resists many of these bypass techniques.

TL;DR Tutorial on EvilWAF, a transport-layer MITM proxy/scanner that bypasses WAF behavioral detection by spoofing TLS/TCP fingerprints and hunting origin IPs behind WAFs like Cloudflare.
Open original ↗
Document

What it is

EvilWAF (github.com/matrixleons/evilwaf), a Python-based MITM proxy and standalone WAF scanner for Kali Linux. The summary names it; the page adds install/run specifics and the proxy's default listening address.

How it works

EvilWAF sits between a testing tool (e.g. sqlmap) and the target, rewriting transport-layer characteristics — TCP profile and TLS fingerprint (JA3/JA4) — on each outbound connection, leaving the HTTP payload/headers untouched. A terminal UI shows live traffic and which fingerprint/manipulation profile is active per request. Auto-hunt runs 10 parallel scanners (DNS history, SSL cert analysis, subdomain enumeration, etc.) to identify the real origin IP behind the WAF, then prompts for confirmation before routing traffic directly to it, bypassing the WAF entirely. Scan-only mode probes the WAF's own 10 defense layers (rule engine, rate limiting, evasion handling, HTTP methods, TLS config) without needing a third-party fuzzer.

Preconditions / Affected

Target WAF must rely on rule/pattern matching or static transport fingerprinting rather than ML-based behavioral analysis. Cloudflare specifically is called out as resistant: it correlates TCP/IP, TLS, and HTTP/2 fingerprints with behavioral patterns via ML models trained on real attack traffic, and can challenge/score requests before payload inspection, defeating this transport-layer evasion approach.

What to do

git clone https://github.com/matrixleons/evilwaf.git
cd evilwaf
python3 -m venv myenv
source myenv/bin/activate
pip3 install -r requirements.txt
python3 evilwaf.py -h

First run generates a local CA cert (needed since EvilWAF MITMs HTTPS):

python3 evilwaf.py -t https://example.com
sudo cp /tmp/evilwaf_ca_*/evilwaf-ca.pem /usr/local/share/ca-certificates/evilwaf-ca.crt
sudo update-ca-certificates

Run against a target (listens on 127.0.0.1:8080 by default):

python3 evilwaf.py -t https://target.com
sqlmap -u "https://target.com/page?id=1" --proxy=http://127.0.0.1:8080

Auto-hunt the origin IP, or supply it directly:

python3 evilwaf.py -t https://target.com --auto-hunt
python3 evilwaf.py -t https://target.com --server-ip 1.2.3.4

Scan the WAF itself without a proxied tool:

python3 evilwaf.py -t https://target.com --scan-only

Caveats

The article states this is not a bulletproof technique and explicitly fails against Cloudflare's behavioral/ML scoring — the mechanism's own limitation, not a general disclaimer.

Organisations named here

  • JA3
  • JA4

Technologies named here

  • Cloudflare
  • EvilWAF
  • sqlmap
  • Kali Linux
  • Python

Techniques named here

  • Transport-layer manipulation for WAF evasion
  • Origin IP discovery / auto-hunt
  • Standalone WAF vulnerability scanning
  • Cloudflare behavioral fingerprinting and risk scoring
  • Progressive rate-limiting challenges

Related in Offensive Security