#NahamCon2024: Modern WAF Bypass Techniques on Large Attack Surfaces

### Overview In this talk, Shubham Shah explores practical, modern Web Application Firewall (WAF) bypass strategies on large enterprise attack surfaces. Rather than focusing on complex, meticulously crafted payload mutations or traditional methods like origin IP discovery, Shah advocates for keeping bypass techniques simple and scalable. The presentation focuses on exploiting inherent WAF architectural limitations, utilizing cloud serverless compute for distributed testing, and abusing reverse proxy trust relationships.

### Key Topics - **WAF Inspection Limits:** Exploiting default maximum request body size thresholds in major WAF vendors. - **Automated Body Padding:** Using a specialized Burp Suite extension to push malicious payloads past inspection limits. - **Distributed Fuzzing via Serverless Compute:** Distributing reconnaissance, vulnerability scanning, and fuzzing traffic across thousands of dynamic IP addresses using AWS API Gateway and serverless fleets. - **WAF-via-WAF Bypasses:** Circumventing origin protections by funneling requests to known origin IPs through an attacker-controlled WAF account. - **HTTP/2 Cleartext (h2c) Smuggling:** Bypassing internal WAF layers and reverse proxies using h2c smuggling.

### Technical Details - **Request Body Size Limits:** For performance reasons, most WAFs only inspect a bounded prefix of request bodies (e.g., POST, PUT, PATCH requests). For example, AWS WAF defaults to inspecting 8 KB on ALBs/AppSync (up to 64 KB on CloudFront/API Gateway), Azure defaults to 128 KB, Akamai inspects the first 8 KB by default (configurable up to 128 KB), and Cloudflare inspects 128 KB (with up to 500 MB on enterprise plans). Anything sent past these limits is ignored by the inspection engine. Shah created a Burp Suite plugin, **no WAF please**, which context-awarely pads bodies with dummy data (XML comments, JSON dummy keys/values, or URL-encoded junk) so the actual payload executes cleanly beyond the inspection threshold. - **IP Rotation and API Gateways:** Shah discusses using the **IP Rotate** Burp plugin and **fireprox** to route HTTP traffic via AWS API Gateway instances across multiple regions, leveraging AWS's dynamic outbound IP pool to circumvent IP-based WAF rate limits. - **Mass Serverless Execution with Shadow Clone:** To overcome the high cost and bandwidth limits of proxy pools when testing large attack surfaces, Shah leverages **Shadow Clone**. This tool distributes commands across serverless functions (like AWS Lambda, where free tiers offer up to 1 million monthly invocations). Demonstrated workflows include: 1. Resolving live hosts across massive target lists using `httpx` split into 40 assets per worker. 2. Checking live assets for specific vulnerabilities (such as a path traversal payload matching a specific response string) without triggering Akamai IP bans. 3. Running singular Nuclei templates (e.g., Swagger discovery) across an attack surface with low split thresholds and guardrails. 4. Rapid directory and file brute forcing with `ffuf` where each request originates from a unique IP in serverless infrastructure. - **Alternative Bypass Vectors:** - *Bypassing WAF via WAF:* When backends rely on shared authenticated TLS certificates or whitelist WAF IP ranges (e.g., historical Cloudflare setups), an attacker who identifies the origin IP can point their own Cloudflare account's DNS to that origin IP, lower security controls to minimum, and route payloads through the trusted WAF network. - *h2c Smuggling:* Useful against AWS ALBs or custom reverse proxy/WAF architectures to smuggle requests past WAF inspection rules and rate limits.

### Takeaways Security testers do not need to spend excessive hours crafting obscure payload encodings when testing body-based endpoints; understanding size inspection thresholds provides a reliable bypass. Furthermore, serverless platforms provide high IP variability for fuzzing and scanning without prohibitive proxy costs. On defense, organizations must understand their WAF's body inspection caps, deploy strict per-zone origin authentication certificates, and recognize that WAFs are friction points rather than absolute boundaries.