Skip to content
Get packs

WAF Bypass Techniques

Gives the agent a checklist for evading web application firewalls during security tests

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This is a reference checklist that tells the agent how to get attack-style test requests past a web application firewall (WAF), the filter that sits in front of websites and blocks suspicious traffic. Once installed, when a user mentions WAF bypass, encoding tricks, or payload obfuscation, the agent works through the listed methods: identifying which WAF is present, trying encoding and header variations, using residential IPs or headless browsers, and looking for origin servers that skip the WAF. It is written for offensive security testing and assumes the user has authorization to test the target.

Great for

  • Penetration testers running authorized web application assessments who need to test whether a WAF can be defeated
  • Security teams validating that their own WAF rules catch evasion techniques
  • Students learning how WAFs are fingerprinted and evaded in a lab environment

Skip it if

  • Attacking websites you do not own or have written permission to test, since the methods are designed to evade protective controls and may be illegal
  • Developers simply trying to fix blocked legitimate requests, because the checklist focuses on evasion rather than allow-listing or tuning rules
  • Use with production systems without coordination, since origin-server and scraping techniques can disrupt live services and third parties

Try asking

  • “Our WAF is blocking payloads on the staging app during an authorized pentest; which encoding bypasses should we try first?”
  • “Identify which WAF is protecting this target from its headers and cookies, then list the fingerprint checks to run.”
  • “Suggest a checklist for testing whether the origin server can be reached directly without going through Cloudflare, for our authorized assessment.”
  • “Help me test whether our ModSecurity rules handle double encoding and chunked requests.”
Step-by-step guide: how to use WAF Bypass TechniquesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-waf-bypass.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-waf-bypass.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-waf-bypass.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State your authorization and scope up front so the agent frames its suggestions around a sanctioned engagement.
  • Ask for one technique at a time and verify results yourself, since the checklist is general and not tailored to a specific target.
  • Treat the listed third-party tools and claims (such as the 2024 statistic) as leads to verify, not established facts.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.