Bypass WAF
Summary: PortSwigger's BApp Store lists a Burp Suite extension called Bypass WAF, authored by Josh Berry at version 0.2.3 and last updated 29 March 2017, which automatically adds headers to all Burp requests to bypass some WAF products. The listing states its features can be combined to provide multiple bypass options, rates its overall system impact as Low, and notes that extensions are written by third-party users of Burp with no warranty from PortSwigger.
What you should know: A free, third-party extension that automatically appends WAF-evading headers to every request in an intercepting proxy has sat in the BApp Store since 2017, so the tooling to test whether your WAF actually blocks anything is one install away for anyone who can run Burp.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026