~ / research / waf-parser-differential

Bypassing a WAF with parser differentials

How inconsistent request parsing between a CDN and origin let a blocked payload slip through.

Web application firewalls and origin servers don’t always parse a request the same way. When the CDN normalises a header one way and the origin another, a payload the WAF considered safe can reach the app intact.

The mismatch

Describe the specific parsing quirk you abused — header folding, duplicate parameters, or content-type confusion — and how you confirmed the two systems disagreed.

Impact & fix

Explain the impact and the mitigation: normalise before inspection, and reject ambiguous requests outright.

wafhttpbypass