Skip to content

Back to the catalog

Introduction to Web Application Firewall (WAF) and Ways to Bypass It
hackers-arise.comarticle

Introduction to Web Application Firewall (WAF) and Ways to Bypass It

A Hackers-Arise tutorial explaining how Web Application Firewalls detect attacks (signature-based, anomaly scoring, behavioral analysis) and how to fingerprint which WAF a target uses via HTTP headers, curl probing, or the WAFW00F tool. It then covers three concrete bypass techniques — double URL encoding, Unicode normalization mismatches, and ASCII smuggling via invisible Unicode tags — that let malicious payloads like XSS slip past WAF filtering before being decoded by the backend app.

TL;DR Intro-level guide to WAF detection mechanics, fingerprinting with curl/WAFW00F, and bypass tricks like double URL encoding and Unicode-based ASCII smuggling.
Open original ↗
Document

What it is

Fingerprinting commands and specific response signals for identifying which WAF protects a target, plus three bypass techniques (double URL encoding, Unicode normalization mismatch, ASCII smuggling via invisible Unicode tags) — covered at the level of mechanism in the existing summary, but the page also gives the concrete fingerprinting commands and response codes/headers an engineer would actually run.

How it works

Fingerprinting: curl -I target.com surfaces WAF-identifying headers directly — e.g. X-Qrator-Request-ID, X-Qrator-Req-ID, Server: QRATOR, X-Qrator-IP, X-Qrator-Upstream for Qrator; Cloudflare is also visible in headers. A behavioral probe, curl -i -X CUSTOMVERB "https://example.com/", sends a nonstandard HTTP method to trigger WAF/bot-mitigation logic. Response codes map to specific defenses: 403 is the generic WAF block, 406 is associated specifically with ModSecurity CRS, and 418 paired with "kittenx" indicates an edge bot-mitigation layer rather than a classic WAF.

WAFW00F automates this: it sends a normal request first, then malicious requests, then falls back to analyzing prior responses to guess the WAF in play.

Preconditions / Affected

Applies to any Layer-7 HTTP target sitting behind a WAF using signature, anomaly-scoring, or behavioral detection. WAFW00F is preinstalled on Kali Linux.

What to do

curl -I target.com
curl -i -X CUSTOMVERB "https://example.com/"
wafw00f -h
wafw00f -l
wafw00f <url>

Run header inspection first, then the custom-verb probe if headers are inconclusive, then WAFW00F as an automated fallback. Use wafw00f -l to check tool coverage before relying on it for an unfamiliar vendor.

Caveats

The page notes a related but distinct risk: ASCII/Unicode manipulation techniques can also cause data poisoning against AI models lacking proper security guidelines — a separate attack surface from WAF bypass, mentioned only in passing with no mechanism given. The article states a follow-up piece on automated bypass solutions is planned but not yet published.

Organisations named here

  • Qrator

Technologies named here

  • Cloudflare
  • curl
  • wafw00f
  • Qrator WAF
  • ModSecurity CRS
  • ModSecurity
  • Kali Linux

Techniques named here

  • Signature-based detection
  • Anomaly scoring
  • Behavioral detection
  • WAF fingerprinting via HTTP headers
  • WAF fingerprinting via behavior analysis
  • Double URL encoding bypass
  • Unicode normalization bypass
  • ASCII smuggling

Related in Offensive Security