Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/waf-bypass-techniques/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/waf-bypass-techniques/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/waf-bypass-techniques.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 101 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 102 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01480 |
| Opus 5.5 | $0.00032 | $0.00592 |
| Sonnet 5.5 | $0.00016 | $0.00296 |
| Haiku 4.5 | $0.00008 | $0.00148 |
Grade A, and why
waf-bypass-techniques scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
waf-bypass-techniques — 绕过与对抗专项深度挖掘
何时调用（触发条件）
- payload 被 WAF/过滤器/防火墙拦截
- 403 拒绝、请求被改写/丢弃
- 连续 3 次 payload 失败（停止同方向硬刚）
- 黑名单/白名单/正则/语义分析防御
- 需要跨层绕过（代理与后端解析差异）
一、对抗意识框架（先定位再绕过）
遇到防御时的思考框架：
- 这个防御是在哪一层做的？（WAF/应用层/框架层/数据库层）
- 防御的规则是什么？（黑名单/白名单/正则/语义分析）
- 规则的边界在哪？（哪些情况没覆盖到）
- 能否通过协议差异绕过？（代理和后端解析不一致）
- 能否通过编码差异绕过？（不同层对编码的处理不同）
- 能否通过逻辑差异绕过？（校验和执行不是同一段代码）
二、失败升级路径（Level 1-7）
Level 1: 编码绕过
→ URL编码/双重编码/Unicode/十六进制/HTML实体/Base64
Level 2: 变形绕过
→ 大小写混合/双写/注释插入/空白符替换/等价函数
Level 3: 逻辑绕过
→ 换HTTP方法/换Content-Type/换参数位置/利用解析差异
Level 4: 协议层绕过
→ HTTP走私/分块传输/管道化/WebSocket升级
Level 5: 换入口点
→ 同功能的其他接口/旧版本接口/移动端接口/内部接口
Level 6: 组合利用
→ A接口的信息泄露 + B接口的弱校验 = 完整攻击链
Level 7: 时间维度
→ 并发/竞态/延时/定时任务触发
硬性规则：至少尝试到 Level 4 才能下"无漏洞"结论。
三、通用绕过技术库
编码类
- URL 编码 / 双重编码（%252e）
- Unicode（\u002e、全角字符）
- 十六进制 / 八进制 / 十进制 IP
- HTML 实体 / Base64 / 分块编码
变形类
- 大小写混合（SeLeCt）
- 双写（selselectect）
- 注释插入（/**/、/!/）
- 空白符替换（%09、%0a、${IFS}）
- 等价函数/等价标签
逻辑类
- 换 HTTP 方法（POST↔GET、PUT、PATCH）
- 换 Content-Type（JSON↔form↔multipart）
- 参数位置迁移（参数名→参数值→Header→Cookie→Path）
- 参数污染（重复参数、数组化）
协议类
- HTTP 走私（CL/TE 差异）
- 分块传输（Transfer-Encoding: chunked）
- 管道化、WebSocket 升级
- 路径标准化差异（//、/./、/../、%2e）
四、分类绕过速查
SQL 注入绕过
大小写：SeLeCt / 双写：selselectect
注释：/**/、/*!*/、--+、#
编码：URL编码、十六进制、Unicode
等价函数：substr→mid、ascii→ord
XSS 绕过
HTML实体：<script>
事件：onerror/onload/onfocus/onmouseover
标签：<svg>、<img>、<iframe>、<math>
伪协议：javascript:、data:
命令注入绕过
分隔符：| / || / & / && / ; / %0a
空格：${IFS} / $IFS$9 / %09 / {cat,/etc/passwd}
通配符：/???/??t /etc/passwd
文件上传绕过
扩展名：.php5/.phtml/.phar/.htaccess/.user.ini
双扩展：shell.php.jpg / shell.jpg.php
%00截断：shell.php%00.jpg
内容：GIF89a头、图片马
SSRF 绕过
IP混淆：十进制/十六进制/八进制
重定向：302跳转、DNS重绑定
协议差异：@符号、URL解析差异
五、403 绕过专项
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin
路径变体：/admin/、//admin、/./admin、/admin%2f、/ADMIN
方法替换：GET→POST→OPTIONS→X-HTTP-Method-Override
分号截断：/admin;.css、/admin;.js
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 146 lines · 81 tokens per session scan A 2ac37c64a6fb
waf-bypass-techniques is a skill published in the GitHub repository zhaji2333/CkSKILLS (126 stars, last pushed 1mo ago), licensed MIT. It adds 81 tokens to every session and 1,480 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
make_plan
For external plan request scenarios, guides the Agent to request a clear, actionable, step-by-step plan from a stronger Agent via listagents and chatwithagent, emphasizing that the plan is executed by the requester, not by the consulted Agent.
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.
motion-showreel
A code-based workflow for making short videos built from animated graphics, text, logos, or interface elements. It produces MP4 video and editable source code rather than filming or editing existing footage.
new
Create a new project to start development quickly.
oss-upload
Upload local files to Tencent COS (oss.1024code.com CDN) using coscli. Use when user wants to upload a file to CDN/OSS, or deploy static assets.
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…