waf-bypass 开源项目推荐（148 个）

0xInfection /Awesome-WAF

Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

devploit /nomore403

🚫 Advanced tool for security researchers to bypass 403/40X restrictions through smart techniques and adaptive request manipulation. Fast. Precise. Effective.

0xacb /recollapse

REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications

matrixleons /evilwaf

evilwaf is a penetration testing tool designed to detect and bypass common Web Application Firewalls (WAFs).

MyuriKanao /src-hunter-skill

实战 SRC / 众测 / Bug bounty 漏洞挖掘 Claude Code skill — 19 个攻击类 playbook、305 个结构化 payload、263 个 WAF/EDR 绕过、2887 份 HackerOne 真实案例、88,636 WooYun 案例统计

blacklanternsecurity /TREVORproxy

A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses!

Cyber-note /Full-Bug-Bounty-Hunting-Methodology-2026

How To approach recon on real targets — from passive enumeration to origin IP discovery. Covers tools, automation, and the logic behind each phase.

devploit /XORpass

Encoder to bypass WAF filters using XOR operations.

gagaltotal /Bypass-WAF-SQLMAP

Bypass WAF SQL Injection SQLMAP

dr34mhacks /ExecEvasion

ExecEvasion is a lightweight execution-evasion toolkit that generates command variants designed to bypass naive filters and WAF rules by leveraging real shell parsing behavior on Linux and Windows.

slicingmelon /gobypass403

A powerful WAF (HTTP 403/401) and URL parser bypass tool developed in Go, designed to preserve exact URL paths and structures during testing.

kh4sh3i /WAF-Bypass

🔥 Web application firewalls (WAF) bypass

xiabai2008 /ruoyi-scan

RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器

theghostshinobi /waf-stressor

Production-grade Web Application Firewall testing tool. Detects Cloudflare, AWS WAF, Akamai & more. Identifies bypass vectors via URL normalization. Perfect for bug bounty & pentesting.

miladrezanezhad /web-security-scanner-pro

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

easypro-tech /brs-xss

MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis via Playwright, ML-based risk scoring, and export in HTML/JSON/SARIF. Designed for integration with Brabus Recon Suite (BRS).

Xib3rR4dAr /filter-var-sqli

Bypassing FILTER_SANITIZE_EMAIL & FILTER_VALIDATE_EMAIL filters in filter_var for SQL Injection ( xD )

MartinPSDev /BypassNinja

Modern Bypass 403

Zeyad-Azima /WAF_Bypass_Guide

Guide For WAF Bypass Techniques

r3kind1e /Log4Shell-obfuscated-payloads-generator

Generate primary obfuscated or secondary obfuscated CVE-2021-44228 or CVE-2021-45046 payloads to evade WAF detection.