evilwaf - evilwaf is a penetration testing tool designed to

项目说明

<p align="center">
<a href="
<img src=" alt="Stars">
</a>
<a href="
<img src=" alt="License">
</a>
<img src=" alt="Python">
<img src=" alt="Platform">
</p>

---

E is an ad transparent MITM Firewall bypass proxy and deep WAF scanner designed for authorized security testing. It operates at the transport layer — it does not touch payloads, cookies, or headers from your tools. Works with any tool like(ffuz, sqlmap, nuclei and etc) that supports --proxy.

---

Features

Proxy & Bypass

Transparent MITM Proxy — Works with any tool that supports --proxy. Zero configuration on tool side.

TCP Fingerprint Rotation — Rotates TCP stack options per request to avoid beha detection.

TLS Fingerprint Rotation — Rotates TLS fingerprint (JA3/JA4 style) paired with TCP profiles.

HTTP/2 Fingerprint Rotation — Per-request H2 SETTINGS and HEADERS frame profile rotation cycling through Chrome, Firefox, Safari, and Edge profiles to prevent WAF beha fingerprinting.

Source Port Manipulation — Rotates source port per request, breaking WAF session tracking and rate-limit counters that rely on source port consistency.

Cloudflare Header Injection — Injects Cloudflare-specific internal headers (CF-Connecting-IP, CF-Ray, True-Client-IP) with crafted to test WAF header trust and attempt IP allowlist bypass.

Tor IP Rotation — Routes traffic through Tor and rotates exit IP every request automatically.

Proxy Pool IP Rotation — Rotates IP every request through external proxy pool.

Origin IP Hunter — Discovers the real server IP behind the WAF using 10 parallel scanners:

- DNS history, SSL certificate analysis, subdomain enumeration
- DNS misconfiguration, cloud leak detection, GitHub leak search
- HTTP header leak, favicon hash, ASN range scan, Censys

Auto WAF Detection — Detects WAF automatically before bypass starts.

Direct Origin Bypass — Once real IP is found, routes all traffic directly to the server, skipping the WAF entirely.

Full HTTPS MITM — Intercepts and inspects HTTPS traffic with dynamic certificate generation per host.

HTTP/2 & HTTP/1.1 Support — Negotiates ALPN automatically and handles both protocols.

Response Advisor — Automatically retries on WAF blocks (403, 429, 503) with different techniques.

WAF Scanner

Deep Multi-Layer WAF Scanner — Treats the firewall itself as the target. Analyses all WAF defensi simultaneously across 10 independent scanning layers:

- Layer 1 Network — host bypass, sensitive path probing, Host header manipulation
- Layer 2 RuleEngine — Payload-based rule-gap detection: SQLi, XSS, RCE, LFI
- Layer 3 RateLimit — Burst and sustained rate-limit enforcement testing
- Layer 4 E — Encoding and normalisation bypass with 10 encoding per payload
- Layer 5 Beha — Timing analysis: tarpit, JS challenge delay, back-off detection
- Layer 6 Header — HTTP header injection and IP spoofing bypass
- Layer 7 TLS — TLS probing, SNI bypass, certificate fingerprinting
- Layer 8 MethodVerb — HTTP method bypass including WebDA
- Layer 9 Session — Cookie manipulation, auth bypass, session fixation probes
- Layer 10 Misconfig — WAF misconfiguration and information leak detection

Persistent Session — Each scan merges with historical JSON data from previous scans. Confidence grows over time — the longer you scan, the more accurate the results.

Statistical Confidence Engine — Per-layer confidence scores computed using mean, standard de, and stability analysis. A finding at 86% confidence after 15 passes is a real , not noise.

False Positi — Every finding is replayed against a clean baseline before reporting. Findings that do not reproduce are automatically excluded.

C Extension (_fast_scanner.c) — High-performance Python C extension for classification, entropy analysis, timing anomaly detection, and statistics hot paths.

Interface

TUI Dashboard — Real-time terminal UI showing li, acti, Tor IPs, source ports, proxy pool, and scanner findings per layer.

Headless Mode — --no-tui flag for scripting and CI/CD pipelines.

Scan-Only Mode — --scan-only to run the WAF scanner standalone without starting the proxy.

---

<details>
<summary><strong>About Cloudflare & Research</strong></summary>

<br>

Why Cloudflare?

Cloudflare is widely regarded as the most sophisticated Web Application Firewall in the world today. It is not simply a set of rules — it is a multi-layered defence system that combines several technologies working simultaneously to protect web applications.

At the network level, Cloudflare operates across hundreds of data centres globally, meaning every request passes through infrastructure that has into traffic patterns from millions of websites at once. This global is one of its most powerful ad — it can detect attack patterns emerging anywhere in the world and deploy mitigations across all protected properties within seconds.

At the inspection level, Cloudflare analyses requests across multiple dimensions simultaneously: TCP/IP fingerprint, TLS fingerprint, HTTP/2 frame structure, header ordering, request timing, beha patterns across sessions, and payload content. Any single one of these signals alone is not enough to block a request, but Cloudflare correlates all of them together to build a risk score per request.

The machine learning component is what makes Cloudflare fundamentally different from traditional WAFs. Where rule-based WAFs look for known bad patterns, Cloudflare's ML models are trained on petabytes of real attack traffic. They learn what legitimate browser traffic looks like at the transport layer — the exact sequence of TCP options, the precise structure of a TLS ClientHello, the ordering of HTTP/2 SETTINGS frames — and flag anything that de from that baseline, even if the payload itself appears clean. This is why simply encoding a payload or rotating headers is not enough against Cloudflare. The bypass has to happen at the transport layer, not the application layer.

Why Is Cloudflare Hard to Bypass?

Most WAF bypass techniques target the rule engine — obfuscating payloads, using encoding , splitting attack strings across parameters. These techniques work against signature-based WAFs because those WAFs only look at payload content.

Cloudflare's defence operates before the payload is e. A request from a Python HTTP library, e a completely benign payload, can be challenged or blocked because the TLS fingerprint does not match any known browser. This means the tool making the request is identified before the content is analysed. Cloudflare calls this beha fingerprinting, and it is the primary reason standard penetration testing tools fail against it even when the underlying payloads are correct.

Rate limiting on Cloudflare is also intelligent — it is not simply a counter of requests per IP per second. It tracks request patterns across sessions, correlates behaviour across IPs sharing the same ASN, and applies progressi rather than hard blocks, making it difficult to detect the threshold through automated testing.

The De's Research Approach

The de of E approaches Cloudflare not as a target to attack but as a subject of study. The research methodology is systematic: observe how Cloudflare responds to different transport-layer identities, measure which signals trigger challenges blocks silent passes, and build statistical models of its behaviour from live data.

This is fundamentally different from reading documentation or studying CVEs. Cloudflare's behaviour cannot be fully understood from external sources because it changes continuously — models are retrained, thresholds are adjusted, new signals are added. The only reliable way to understand it is through li, authorised experimentation and careful analysis of the data collected.

The goal of this research is to produce tools and knowledge that help the security research community understand what WAF bypass actually looks like at a technical level in 2026 — not to cause harm, but to ensure that defenders understand the real capabilities and limitations of the technologies they rely on. A security researcher who understands how Cloudflare detects and blocks requests is better equipped to test whether applications behind it are truly protected.

E's scanner architecture — persistent sessions, statistical confidence, multi-layer analysis, timing anomaly detection — exists because this kind of research requires long obser periods and rigorous data collection, not quick scans. Real WAF research takes time, and the tools should reflect that.

</details>

---

Disclaimer

Important: Read This Before Using E

This tool is designed for authorized security testing only

You must have explicit permission to test the target systems

Intended for educational purposes, security research, and authorized penetration testing

Not for malicious or illegal acti

Legal Compliance

Users are solely responsible for how they use this tool

The de are not liable for any misuse or damage caused

Ensure compliance with local, state, and federal laws

---

Support

I do not offer support for illegal use cases, but I will help you reach your goal in authorized testing.

LinkedIn

E is made by Matrix Leons.

---

Support The Project

If E has been useful to you, consider supporting its de. Your contribution helps keep this project maintained and growing.

---

CA Certificate Setup (Required for HTTPS)

---

Installation

Docker Installation

---

Usage

Connecting Your Tool

Once E is running, point any tool to it :

API Keys (Optional)

Without API keys, E still runs using free sources (DNS history, SSL certs, HTTP headers, favicon hash, subdomain enum).

---

Contributing

Contributions are welcome. E is growing and there are many areas to improve.

Guidelines

Keep code clean and consistent with existing style

Test your changes before submitting a PR

Do not create techniques which modify the body, headers, payloads, or cookies of proxied requests

Open an issue first for large changes so we can discuss

---

License

Licensed under the Apache License, 2.0

项目信息

开发语言：Python

Star 数：897

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕evilwaf is a penetration testing tool designed to detect and bypass common Web Application Firewalls (WAFs).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。