WAF filters HTTP traffic at the application layer, blocking known attacks (XSS, SQLi, LFI).
WAF Bypass
- Encoding: URL, Unicode, Base64, HTML entities.
- Case variation, whitespace injection.
- HTTP parameter pollution.
- Chunked transfer encoding.
Popular: ModSecurity, Cloudflare WAF, AWS WAF.