waf-bypass-hunter

What problem does it solve?

This Skill helps security researchers automatically discover bypass techniques against a WAF by analyzing parser differences between Go (WAF) and Node.js (backend), enabling faster discovery of bypass payloads and reducing manual trial-and-error.

Core Features & Use Cases

• Parser-differential testing: Tests multiple payload variants to identify bypasses that bypass WAF filtering while still being parsed by the backend.
• Payload cataloging: Maintains a library of bypass payload patterns and evaluation results.
• Use Case: A pentester wants to enumerate WAF bypass techniques for a lab environment; the skill can generate and test payloads against a local WAF to gather bypass evidence and potential CVEs.

Quick Start

Run a basic bypass test against the local WAF at port 9091 using a minimal test payload, then review results and logs in the executor.