<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# WAF Bypass Templates — API Reference

## Nuclei WAF Testing Options

```bash
# WAF fingerprint scan
nuclei -u https://target.com -t waf-fingerprint.yaml -json

# Bypass testing with rate limit
nuclei -u https://target.com -t waf-bypass.yaml -rate-limit 5 -json

# Follow redirects (WAF redirect blocks)
nuclei -u https://target.com -t waf-bypass.yaml -follow-redirects -json
```

## WAF Fingerprint Signatures

| WAF | Detection Header/String |
|-----|------------------------|
| Cloudflare | `cf-ray`, `cf-cache-status` |
| AWS WAF | `aws-waf`, `awselb` |
| Akamai | `akamai`, `x-cdn` |
| Sucuri | `x-sucuri-id`, `x-sucuri-cache` |
| Imperva | `x-iinfo`, `incapsula` |
| ModSecurity | `mod_security`, `NOYB` |
| F5 BIG-IP | `BigIP`, `TS` cookie prefix |

## Common Encoding Bypass Techniques

| Technique | Example |
|-----------|---------|
| Double URL encoding | `%2527` instead of `%27` |
| Unicode encoding | `%C0%A7` for single quote |
| MySQL comment injection | `/*!UNION*/` |
| Case variation | `SeLeCt`, `uNiOn` |
| Null bytes | `%00` between keywords |
| Charset confusion | `Content-Type: charset=ibm037` |

## Named Matchers

| Feature | Description |
|---------|-------------|
| `name: vendor` | Labels matcher for output identification |
| `condition: or` | Any word matches for vendor detection |
| `negative: true` | Excludes WAF block indicators |
