Welcome back, aspiring cyberwarriors and bug bounty hunters!

In the previous article, we covered what a WAF is and how you can manually bypass it. These days, WAFs are getting smarter, moving from simple pattern matching to advanced behavior analysis. As a result, traditional tricks to hide your payload often get caught before they even reach the main application. To tackle this issue, let’s dive into EvilWAF, an open-source penetration testing tool designed to test and bypass those firewall defenses by manipulating transport-layer processes. Let’s get rolling!

What Is EvilWAF?

EvilWAF is a transparent Man-In-The-Middle (MITM) proxy and web application firewall (WAF) vulnerability scanner. Rather than changing attack payloads or headers like tools such as sqlmap, EvilWAF operates at the transport layer. This allows it to slip past WAF behavioral detection while checking for firewall weaknesses.

It has two modes: proxy and standalone WAF scanner.

In proxy mode, you just run EvilWAF on your machine and set up your testing tool to send its traffic through it. In this mode, there will be zero payload manipulation. EvilWAF won’t mess with the actual SQL injection payloads, HTTP body, or application headers that sqlmap sends out. While sqlmap hunts for app vulnerabilities, EvilWAF handles the connection, rotating TCP profiles, TLS fingerprints like JA3 or JA4, and so on, so the WAF doesn’t block or limit the automated connection. Also, if you use the auto-hunt option, EvilWAF will try to find the real backend IP behind the WAF and can send sqlmap’s traffic straight to the origin server, bypassing the WAF completely.

Besides that, EvilWAF isn’t just a passive proxy. It can also work independently. When you launch it with the scan-only flag, it targets the firewall itself, running a thorough assessment across ten different defense layers while checking for gaps in the rule engine, rate limiting, evasion techniques, HTTP method behaviors, and TLS settings to spot vulnerabilities in the WAF setup.

Installing EvilWAF

To install and configure EvilWAF on Kali Linux, you can set it up directly using a Python virtual environment.

kali> git clone https://github.com/matrixleons/evilwaf.git
kali> cd evilwaf
kali> python3 -m venv myenv
kali> source myenv/bin/activate
kali> pip3 install -r requirements.txt 
kali> python3 evilwaf.py -h

Since EvilWAF acts as a full HTTPS MITM proxy, it automatically generates a local CA certificate on its first run to inspect encrypted traffic. You need to trust this certificate on Kali Linux to prevent SSL errors when using proxying tools. Therefore, launch EvilWAF once to generate the CA certificate:

kali> python3 evilwaf.py -t https://example.com

Then, import and trust the certificate system-wide in Kali:

kali> sudo cp /tmp/evilwaf_ca_*/evilwaf-ca.pem /usr/local/share/ca-certificates/evilwaf-ca.crt

kali> sudo update-ca-certificates

Running EvilWAF

Start EvilWAF targeting the web application you are auditing. By default, it opens a real-time terminal UI listening on 127.0.0.1:8080:

kali> python3 evilwaf.py -t https://target.com

With EvilWAF running, instruct your testing tool to send its requests through this proxy. For example, let’s run sqlmap:

kali> sqlmap -u “https://target.com/page?id=1” –proxy=http://127.0.0.1:8080

After that, EvilWAF should show a terminal user interface like the one below.

It lets us monitor live traffic and, most importantly, shows which transport-layer manipulation techniques, fingerprint profiles, and header injections are actively applied to outbound requests.

Another valuable feature of EvilWAF is auto-hunt. It runs 10 parallel scanners to identify the origin IP. This includes DNS history, SSL certificate analysis, subdomain enumeration, and more.

kali> python3 evilwaf.py -t https://target.com –auto-hunt

Once a high-confidence IP is found, it asks for confirmation to route traffic directly to the real server.

You can also specify the IP manually if you already know it:

kali> python3 evilwaf.py -t https://target.com –server-ip 1.2.3.4

Now, let’s switch from proxy mode to a standalone WAF vulnerability scanner. EvilWAF can evaluate the firewall itself for configuration flaws without running third-party tools:

kali> python3 evilwaf.py -t https://target.com –scan-only

This probes 10 defensive layers simultaneously.

Important Note About Cloudflare

Cloudflare is regarded as one of the most advanced WAFs today, functioning as a multi-layered defense system rather than just a set of rules. It operates through hundreds of global data centers, allowing it to detect and mitigate emerging attack patterns swiftly across all protected sites.

Cloudflare analyzes requests using various signals, including TCP/IP and TLS fingerprints, HTTP/2 structure, and behavioral patterns. By correlating these factors, it assigns a risk score to each request. Unlike traditional WAFs that rely on known attack patterns, Cloudflare uses machine learning models trained on extensive real attack traffic to identify deviations from legitimate browser traffic.

This makes it challenging to bypass since many techniques that work on rule-based WAFs are ineffective against Cloudflare. Its behavioral fingerprinting can challenge requests even before payloads are inspected, identifying tools based on transport-layer characteristics. Rate limiting is sophisticated, tracking session patterns and applying progressive challenges, making it hard to exploit thresholds.

Therefore, EvilWAF is just one example of what a WAF bypass might look like. Still, it is certainly not a bulletproof solution.

Summary

To wrap up, EvilWAF marks the start of a new era of firewall bypass. Payload obfuscation and simple encoding are very unlikely to work on modern WAFs. Therefore, it is important to pay attention to tools like EvilWAF.

If you’re interested in bug bounty, red teaming, or AI, we invite you to our training center, where we offer a range of courses to build your skills and stay up to date in cybersecurity.

The post Bypass Web Application Firewall (WAF) with EvilWAF first appeared on Hackers Arise.