Defeating Modern Web Application Firewalls (WAFs): Advanced Bypasses and Evasion Techniques

Web Application Firewalls (WAFs) inspect incoming HTTP traffic to block malicious payloads like SQL Injection, Cross-Site Scripting (XSS), and Path Traversal. However, signature-based and heuristic detection mechanisms can often be bypassed using clever encoding, alternative syntaxes, or protocol-level anomalies.

Attackers use various techniques to obfuscate payloads:

• Double URL Encoding: Bypassing filters that decode input only once. For example, %2527 decodes to %27 (single quote) after the first decode phase.
• SQL Comment Injections: Using comments like /*!50000SELECT*/ in MySQL to bypass signature patterns.
• Unicode Normalization: Sending homoglyphs or alternate Unicode representations that resolve to target characters after normalization.

Modern WAFs often decode request bodies, but discrepancies between how the WAF parses a body (e.g., duplicate JSON keys) and how the backend parses it can lead to security blind spots. For instance, sending:

{
  "username": "admin",
  "username": "malicious' OR 1=1 --"
}

might cause the WAF to inspect the first instance of "username" while the backend processes the second instance, executing the injection.

Chunked Transfer Encoding is an HTTP/1.1 mechanism designed to stream data in parts (chunks). If a WAF does not fully support or reconstruct chunked requests while the backend does, an attacker can split their malicious payload across multiple chunks. The WAF examines chunks individually and fails to match the signature, while the backend reassembles them, triggering the vulnerability.

POST /submit HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Type: application/x-www-form-urlencoded

4
id=1
5
&val=
6
SELECT
0

HTTP Parameter Pollution (HPP) involves injecting multiple parameters with the same name. Different backend servers handle duplicate query parameters in distinct ways:

• ASP.NET: Concatenates them with a comma (e.g., id=1&id=2 becomes 1,2).
• PHP/Apache: Processes only the last parameter (e.g., id=1&id=2 becomes 2).
• JSP/Tomcat: Processes only the first parameter (e.g., id=1&id=2 becomes 1).

By splitting a payload across duplicate parameters (e.g., ?sel=select&sel=password), the WAF might analyze them separately while ASP.NET joins them into a single string (select,password), bypassing the check.