Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/waf-bypass-techniques/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/waf-bypass-techniques/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/waf-bypass-techniques"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/waf-bypass-techniques.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 101 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 102 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01480 |
| Opus 5 | $0.00041 | $0.00740 |
| Sonnet 5 | $0.00016 | $0.00296 |
| Haiku 4.5 | $0.00008 | $0.00148 |
Grade A, and why
waf-bypass-techniques scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
waf-bypass-techniques — 绕过与对抗专项深度挖掘
何时调用（触发条件）
- payload 被 WAF/过滤器/防火墙拦截
- 403 拒绝、请求被改写/丢弃
- 连续 3 次 payload 失败（停止同方向硬刚）
- 黑名单/白名单/正则/语义分析防御
- 需要跨层绕过（代理与后端解析差异）
一、对抗意识框架（先定位再绕过）
遇到防御时的思考框架：
- 这个防御是在哪一层做的？（WAF/应用层/框架层/数据库层）
- 防御的规则是什么？（黑名单/白名单/正则/语义分析）
- 规则的边界在哪？（哪些情况没覆盖到）
- 能否通过协议差异绕过？（代理和后端解析不一致）
- 能否通过编码差异绕过？（不同层对编码的处理不同）
- 能否通过逻辑差异绕过？（校验和执行不是同一段代码）
二、失败升级路径（Level 1-7）
Level 1: 编码绕过
→ URL编码/双重编码/Unicode/十六进制/HTML实体/Base64
Level 2: 变形绕过
→ 大小写混合/双写/注释插入/空白符替换/等价函数
Level 3: 逻辑绕过
→ 换HTTP方法/换Content-Type/换参数位置/利用解析差异
Level 4: 协议层绕过
→ HTTP走私/分块传输/管道化/WebSocket升级
Level 5: 换入口点
→ 同功能的其他接口/旧版本接口/移动端接口/内部接口
Level 6: 组合利用
→ A接口的信息泄露 + B接口的弱校验 = 完整攻击链
Level 7: 时间维度
→ 并发/竞态/延时/定时任务触发
硬性规则：至少尝试到 Level 4 才能下"无漏洞"结论。
三、通用绕过技术库
编码类
- URL 编码 / 双重编码（%252e）
- Unicode（\u002e、全角字符）
- 十六进制 / 八进制 / 十进制 IP
- HTML 实体 / Base64 / 分块编码
变形类
- 大小写混合（SeLeCt）
- 双写（selselectect）
- 注释插入（/**/、/!/）
- 空白符替换（%09、%0a、${IFS}）
- 等价函数/等价标签
逻辑类
- 换 HTTP 方法（POST↔GET、PUT、PATCH）
- 换 Content-Type（JSON↔form↔multipart）
- 参数位置迁移（参数名→参数值→Header→Cookie→Path）
- 参数污染（重复参数、数组化）
协议类
- HTTP 走私（CL/TE 差异）
- 分块传输（Transfer-Encoding: chunked）
- 管道化、WebSocket 升级
- 路径标准化差异（//、/./、/../、%2e）
四、分类绕过速查
SQL 注入绕过
大小写：SeLeCt / 双写：selselectect
注释：/**/、/*!*/、--+、#
编码：URL编码、十六进制、Unicode
等价函数：substr→mid、ascii→ord
XSS 绕过
HTML实体：<script>
事件：onerror/onload/onfocus/onmouseover
标签：<svg>、<img>、<iframe>、<math>
伪协议：javascript:、data:
命令注入绕过
分隔符：| / || / & / && / ; / %0a
空格：${IFS} / $IFS$9 / %09 / {cat,/etc/passwd}
通配符：/???/??t /etc/passwd
文件上传绕过
扩展名：.php5/.phtml/.phar/.htaccess/.user.ini
双扩展：shell.php.jpg / shell.jpg.php
%00截断：shell.php%00.jpg
内容：GIF89a头、图片马
SSRF 绕过
IP混淆：十进制/十六进制/八进制
重定向：302跳转、DNS重绑定
协议差异：@符号、URL解析差异
五、403 绕过专项
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin
路径变体：/admin/、//admin、/./admin、/admin%2f、/ADMIN
方法替换：GET→POST→OPTIONS→X-HTTP-Method-Override
分号截断：/admin;.css、/admin;.js
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 146 lines · 81 tokens per session scan A 2ac37c64a6fb
waf-bypass-techniques is a skill published in the GitHub repository zhaji2333/CkSKILLS (81 stars, last pushed 12d ago), licensed MIT. It adds 81 tokens to every session and 1,480 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
A set of instructions for working with PDF files, which are documents designed to preserve their layout across devices.
make_plan
For external plan request scenarios, guides the Agent to request a clear, actionable, step-by-step plan from a stronger Agent via listagents and chatwithagent, emphasizing that the plan is executed by the requester, not by the consulted Agent.
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.
new
Create a new project to start development quickly.