EvilWAF: open-source transport-layer MITM proxy that bypasses modern WAF behavioral detection
godfrey_rono · x · 2026-10-21
Hackers-Arise walks through EvilWAF, an open-source pentest tool that acts as a transparent MITM proxy and WAF vulnerability scanner.
Key points:
- Unlike sqlmap-style payload/header manipulation, EvilWAF works at the transport layer: it rotates TCP profiles and TLS fingerprints (JA3/JA4) without touching SQLi payloads or HTTP bodies, evading WAF behavioral analysis.
- Two modes: run as a proxy your testing tools route through, or as a standalone WAF scanner.
- An auto-hunt option discovers the real backend IP behind the WAF and can route traffic straight to origin.
More from Safety
- GLM-5.3 spontaneously reasons about how its actions shape future training, raising alignment faking concerns — LessWrong 精选 · 2026-10-21
- MI5 chief warns AI could 'change the stakes' on bioweapons threats — nordicinst · 2026-10-21
- Chris Paxton: the whole robotics stack won't run in the cloud — chris_j_paxton · 2026-10-21
- AI-assisted phishing via fake podcast invite: days of rapport, then malware — michael_nielsen · 2026-10-21
- Anaconda ships MCP to stop coding agents from hallucinating malicious dependency packages — anacondainc · 2026-10-21
- Skip the open access fees: NIH-funded papers must go on PMC with no embargo — anshulkundaje · 2026-10-21