How I Built a WAF-Bypassing Engine in Rust (v9.2.1 Release)

Building a web vulnerability scanner is easy. Building one that actually works against modern infrastructure protected by WAFs (Web Application Firewalls) is where the real engineering starts.

Last week, I released vuln-scanner v9.0.0 and the feedback was incredible. But one thing stood out: hardened targets were blocking basic payloads. So, for v9.2.1, I went back to the drawing board to implement advanced stealth and obfuscation techniques.

Here’s how I approached it using Rust.

The Problem: Deterministic Pattern Matching

Most WAFs look for specific strings like ' OR 1=1-- or . If your scanner sends these raw, you get a 403 Forbidden faster than you can say &quot;SQLi&quot;.</p> <p>The Solution: Dynamic Obfuscation</p> <p>In vuln-scanner v9.2.1, I implemented a dedicated waf_bypass module in Rust that transforms every payload before it hits the wire.</p> <ol> <li>Double-Encoding (%252F)</li> </ol> <p>Some filters decode the URL once and check for malicious characters. By double-encoding, the WAF sees a harmless string, but the back-end application (which often decodes twice) receives the actual payload.</p> <p>// Snippet of our encoding logic<br> pub fn double_encode(input: &amp;str) -&gt; String {<br> let first = utf8_percent_encode(input, NON_ALPHANUMERIC).to_string();<br> utf8_percent_encode(&amp;first, NON_ALPHANUMERIC).to_string()<br> }</p> <ol> <li>Comment Injection &amp; Case Mixing</li> </ol> <p>WAFs often miss payloads if they are interrupted by SQL comments or if the casing is randomized (e.g., sElEcT instead of SELECT).<br> The scanner now automatically injects /**/ in SQLi payloads and &lt;? ?&gt; or random casing in LFI paths.</p> <ol> <li>Global Response Caching</li> </ol> <p>To avoid rate-limiting (another form of WAF blocking), I implemented a global cache. If the scanner sees the same response structure multiple times, it skips redundant requests, keeping the traffic profile &quot;human-like&quot;.</p> <p>Why Rust?</p> <p>Performance is obvious, but memory safety and concurrency (via Tokio) are the real winners here. We can run 18 different scanner &quot;motors&quot; simultaneously without worrying about race conditions or crashing the engine mid-scan.</p> <p>Check out the Source Code</p> <p>The project is 100% open-source. I’d love to get your thoughts on the src/scanner/waf_bypass.rs implementation.</p> <p>🔗 GitHub Repository: <a href="https://github.com/5n4vc4smh8-pixel/vuln-scanner">https://github.com/5n4vc4smh8-pixel/vuln-scanner</a></p> <p>Happy Hacking (Responsibly)!</p>