Advanced WAF Security Analysis Platform

Comprehensive attack vectors and defense strategies for technical security professionals

15
Attack Categories
141
Attack Vectors
2
Expert-Level
7
CVE References

Current Request Analysis

/sitemap.xml
CLEAN REQUEST
← Reset to Clean Request

Request Fingerprint

{
  "method": "GET",
  "tlsFingerprint": {
    "ja3": "9342348ca94665d1044cb9d382e70070",
    "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
    "tlsVersion": "TLSv1.3",
    "cipher": "AEAD-AES256-GCM-SHA384"
  },
  "httpFingerprint": {
    "protocol": "HTTP/2",
    "headers": {
      "accept": "*/*",
      "accept-encoding": "gzip, br",
      "cf-cert-presented": "false",
      "cf-cert-revoked": "false",
      "cf-cert-verified": "false",
      "cf-connecting-ip": "216.73.216.237",
      "cf-ipcountry": "US",
      "cf-ray": "a3bb7bedf80c2c82",
      "cf-visitor": "{\"scheme\":\"https\"}",
      "connection": "Keep-Alive"
    }
  },
  "geoFingerprint": {
    "country": "US",
    "city": "Columbus",
    "region": "Ohio",
    "asn": 16509,
    "asOrganization": "Anthropic, PBC"
  },
  "riskIndicators": {
    "botScore": 1,
    "verifiedBot": true
  }
}

Bot Management

Bot Score 1/100
Verified Bot Yes
JA3 Hash 9342348ca946...
JA4 t13d1011h2_6...

WAF Attack Score (ML)

Overall Enterprise
SQLi N/A
XSS N/A
RCE N/A

TLS Fingerprint

Version TLSv1.3
Cipher AEAD-AES256-GCM...
HTTP HTTP/2

Geolocation

Country US
City Columbus
ASN 16509
Org Anthropic, PBC...

Risk Assessment

Threat Score N/A
Client Trust 1
IP 216.73.216.237

Attack Vectors Library

SQL Injection (SQLi)

INTERMEDIATE

Manipulate database queries through user input

Real-world: Equifax breach (2017), Heartland Payment Systems, Sony Pictures

Classic OR Injection CRITICAL UNION-based Extraction CRITICAL Time-based Blind HIGH Boolean-based Blind HIGH Error-based (MySQL) HIGH Error-based (MSSQL) HIGH Stacked Queries CRITICAL Second-Order SQLi CRITICAL Out-of-Band (OOB) CRITICAL WAF Bypass - Comments HIGH WAF Bypass - Encoding HIGH NoSQL Injection CRITICAL
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: 949110, 942100, 942110, 942120, 942130, 942140, 942150, 942160
Custom Rule:
(cf.waf.score.sqli lt 40) or (http.request.uri.query contains "UNION" and http.request.uri.query contains "SELECT")
Additional Measures:
  • Parameterized queries
  • Input validation
  • Least privilege DB accounts
  • WAF Attack Score threshold
Documentation →

Cross-Site Scripting (XSS)

INTERMEDIATE

Inject malicious scripts into web pages viewed by other users

Reflected XSS HIGH DOM-based XSS HIGH Stored XSS via SVG CRITICAL Event Handler XSS HIGH Template Literal XSS MEDIUM mXSS (Mutation) HIGH AngularJS Sandbox Escape CRITICAL Vue.js Template Injection CRITICAL React dangerouslySetInnerHTML HIGH Polyglot XSS HIGH
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: 941100, 941110, 941120, 941130, 941140, 941150, 941160
Custom Rule:
(cf.waf.score.xss lt 40) or (http.request.uri contains "<script" and not http.request.uri.path contains "/admin/")
Additional Measures:
  • Content-Security-Policy header
  • X-XSS-Protection
  • HTTPOnly cookies
  • Output encoding
Documentation →

Server-Side Template Injection (SSTI)

ADVANCED

Inject template syntax to achieve RCE on the server

Real-world: Uber template injection (2016), Atlassian Confluence CVE-2023-22515

Jinja2 Config Dump CRITICAL Jinja2 RCE Chain CRITICAL Jinja2 File Read CRITICAL Twig RCE (PHP) CRITICAL Freemarker RCE CRITICAL Smarty RCE (PHP) CRITICAL ERB RCE (Ruby) CRITICAL Velocity RCE (Java) CRITICAL Pebble RCE (Java) CRITICAL Nunjucks (Node.js) CRITICAL Expression Language (Java) HIGH Thymeleaf RCE CRITICAL CVE-2023-38286
View Protection Strategy
Managed Ruleset: Cloudflare OWASP Core Ruleset
Rule IDs: 934100, 934110, 934120
Custom Rule:
(http.request.uri.query contains "{{" or http.request.uri.query contains "${" or http.request.uri.query contains "<%" or http.request.uri.query contains "{%")
Additional Measures:
  • Sandbox template execution
  • Disable dangerous functions
  • Input validation
Documentation →

HTTP Request Smuggling

EXPERT

Desync frontend/backend request parsing to poison cache or bypass security

Real-world: PayPal bug bounty $20k, Capital One, Many CDN bypass vulnerabilities

CL.TE Basic CRITICAL TE.CL Basic CRITICAL TE.TE Obfuscation CRITICAL HTTP/2 Downgrade CRITICAL CVE-2023-25690 Request Tunneling CRITICAL CRLF Injection HIGH H2C Upgrade Smuggling CRITICAL
View Protection Strategy
Managed Ruleset: Cloudflare Built-in Protection
Rule IDs: Automatically normalized by Cloudflare proxy
Additional Measures:
  • Cloudflare terminates TLS and normalizes requests
  • HTTP/2 end-to-end
  • Reject ambiguous requests
Documentation →

GraphQL Attacks

ADVANCED

Exploit GraphQL-specific vulnerabilities

Introspection Query MEDIUM Batch Query DoS HIGH Deep Nesting DoS HIGH Alias-based DoS HIGH Directive Overload MEDIUM SQL Injection via Args CRITICAL IDOR via ID HIGH Mutation Abuse CRITICAL Field Suggestion Leak LOW Persisted Query Bypass MEDIUM
View Protection Strategy
Managed Ruleset: Cloudflare API Shield + Custom Rules
Rule IDs: Enable GraphQL protection in API Shield
Custom Rule:
(http.request.uri.path eq "/graphql" and http.request.body.raw contains "__schema")
Additional Measures:
  • Disable introspection in production
  • Query depth limiting
  • Query complexity analysis
  • Persisted queries only
Documentation →

JWT Attacks

ADVANCED

Exploit JSON Web Token vulnerabilities

Algorithm None CRITICAL CVE-2015-9235 RS256 to HS256 CRITICAL CVE-2016-5431 JKU/X5U Injection CRITICAL KID SQL Injection CRITICAL KID Path Traversal CRITICAL JWT Injection HIGH Expired Token Replay MEDIUM Weak Secret Brute Force HIGH
View Protection Strategy
Managed Ruleset: Custom WAF Rules + Application Logic
Rule IDs: Implement at application level
Custom Rule:
(http.request.headers["authorization"] contains "alg":"none" or http.request.headers["authorization"] contains "\"alg\":\"none\"")
Additional Measures:
  • Use asymmetric algorithms (RS256/ES256)
  • Validate all claims
  • Short expiry times
  • Rotate secrets regularly
Documentation →

Server-Side Request Forgery (SSRF)

INTERMEDIATE

Force server to make requests to unintended destinations

Real-world: Capital One breach (2019) - $80M fine, GitLab SSRF, Shopify bug bounties

AWS IMDS v1 CRITICAL AWS IMDS v2 Bypass CRITICAL GCP Metadata CRITICAL Azure IMDS CRITICAL Kubernetes API CRITICAL Docker Socket CRITICAL Internal Port Scan HIGH DNS Rebinding HIGH File Protocol CRITICAL Gopher Protocol CRITICAL URL Bypass - Decimal IP HIGH URL Bypass - IPv6 HIGH URL Bypass - Redirect HIGH
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: 931100, 931110, 931120, 931130
Custom Rule:
(http.request.uri.query contains "169.254" or http.request.uri.query contains "metadata" or http.request.uri.query contains "127.0.0.1" or http.request.uri.query contains "localhost" or http.request.uri.query contains "file://")
Additional Measures:
  • Allowlist outbound URLs
  • Block private IP ranges
  • Disable unnecessary protocols
  • Use IMDSv2 with hop limit
Documentation →

Web Cache Poisoning

EXPERT

Inject malicious content into cached responses

Unkeyed Header Poison CRITICAL Unkeyed Cookie Poison CRITICAL Fat GET Request HIGH Parameter Cloaking HIGH Route Poisoning CRITICAL Web Cache Deception HIGH Path Confusion HIGH Response Splitting CRITICAL
View Protection Strategy
Managed Ruleset: Cache Rules + WAF
Rule IDs: Configure cache keys carefully
Custom Rule:
(any(http.request.headers.names[*] eq "X-Forwarded-Host") and not ip.src in {trusted-ips})
Additional Measures:
  • Enable Cache Deception Armor
  • Audit cache key configuration
  • Vary header usage
  • Strict content-type validation
Documentation →

Prototype Pollution

ADVANCED

Modify JavaScript object prototypes for XSS or RCE

Real-world: Kibana CVE-2019-7609 (RCE), npm packages: lodash, jquery

Query String HIGH JSON Body HIGH Constructor Prototype HIGH Nested Pollution HIGH Server-side RCE CRITICAL EJS RCE CRITICAL Handlebars RCE CRITICAL DOM XSS via PP HIGH
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: Check latest ruleset updates
Custom Rule:
(http.request.uri.query contains "__proto__" or http.request.uri.query contains "constructor[prototype]" or http.request.body.raw contains "\"__proto__\"")
Additional Measures:
  • Use Object.create(null)
  • Freeze prototypes
  • Input sanitization
  • Use Map instead of object
Documentation →

XXE (XML External Entity)

ADVANCED

Exploit XML parsers for file read, SSRF, or DoS

Basic File Read CRITICAL SSRF via XXE CRITICAL Blind XXE (OOB) CRITICAL Error-based XXE HIGH Billion Laughs DoS HIGH XInclude Attack CRITICAL SVG XXE CRITICAL DOCX/XLSX XXE CRITICAL
View Protection Strategy
Managed Ruleset: Cloudflare OWASP Core Ruleset
Rule IDs: 200002, 200003, 200004
Custom Rule:
(http.request.body.raw contains "<!ENTITY" or http.request.body.raw contains "SYSTEM" or http.request.body.raw contains "<!DOCTYPE")
Additional Measures:
  • Disable external entities
  • Disable DTD processing
  • Use JSON instead of XML
  • Validate content-type
Documentation →

Remote Code Execution (RCE)

ADVANCED

Execute arbitrary commands on the server

Real-world: Log4Shell (Dec 2021) - Widespread impact, Apache Struts Equifax breach

OS Command Injection CRITICAL Pipe Injection CRITICAL Backtick Execution CRITICAL $(cmd) Substitution CRITICAL Log4Shell CRITICAL CVE-2021-44228 Spring4Shell CRITICAL CVE-2022-22965 Text4Shell CRITICAL CVE-2022-42889 PHP Wrapper RCE CRITICAL PHP Data Wrapper CRITICAL PHP Expect Wrapper CRITICAL Python pickle RCE CRITICAL Java Deserialization CRITICAL Ruby ERB Injection CRITICAL
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: 932100, 932105, 932110, 932115, 932120, 932130, 932140
Custom Rule:
(cf.waf.score.rce lt 40) or (http.request.uri contains "${jndi" or http.request.headers["user-agent"] contains "${jndi")
Additional Measures:
  • Avoid shell execution
  • Input validation
  • Sandbox execution
  • Patch dependencies
Documentation →

Path Traversal / LFI

INTERMEDIATE

Access files outside the intended directory

Basic Traversal CRITICAL Double Encoding CRITICAL UTF-8 Encoding CRITICAL Null Byte HIGH Filter Bypass HIGH Absolute Path CRITICAL Windows Path CRITICAL Wrapper Chain CRITICAL
View Protection Strategy
Managed Ruleset: Cloudflare Managed Ruleset
Rule IDs: 930100, 930110, 930120, 930130
Custom Rule:
(http.request.uri contains ".." or http.request.uri contains "%2e%2e" or http.request.uri contains "%252e")
Additional Measures:
  • Validate and sanitize file paths
  • Use allowlist for accessible files
  • Chroot/jail file access
Documentation →

Authentication Bypass

INTERMEDIATE

Circumvent authentication mechanisms

Default Credentials HIGH SQL Auth Bypass CRITICAL LDAP Injection CRITICAL NoSQL Auth Bypass CRITICAL Password Reset Poison HIGH Mass Assignment HIGH OAuth Token Theft CRITICAL SAML Signature Bypass CRITICAL Session Fixation HIGH 2FA Bypass CRITICAL
View Protection Strategy
Managed Ruleset: Multiple layers
Rule IDs: Application-specific
Custom Rule:
(http.request.uri.query contains "[$ne]" or http.request.uri.query contains "[$gt]" or http.request.headers["host"] ne "expected-host.com")
Additional Measures:
  • Rate limiting on auth endpoints
  • Account lockout
  • MFA enforcement
  • Secure session management
Documentation →

WebSocket Attacks

ADVANCED

Exploit WebSocket connections for hijacking or injection

CSWSH CRITICAL WS Message Injection HIGH WS SQLi CRITICAL WS XSS HIGH WS DoS MEDIUM Insecure WS (ws://) HIGH
View Protection Strategy
Managed Ruleset: Custom implementation
Rule IDs: Application-level checks
Custom Rule:
Configure WebSocket protection in Workers
Additional Measures:
  • Validate Origin header
  • Use wss:// only
  • Authenticate WS connections
  • Rate limit messages
Documentation →

API Security

INTERMEDIATE

Exploit API-specific vulnerabilities

BOLA/IDOR HIGH BFLA CRITICAL Excessive Data Exposure HIGH Mass Assignment HIGH Rate Limit Bypass MEDIUM API Key Exposure HIGH Broken Auth CRITICAL SSRF via Webhook CRITICAL
View Protection Strategy
Managed Ruleset: API Shield
Rule IDs: Enable API Shield features
Custom Rule:
(http.request.uri.path matches "^/api/admin" and not cf.access.authenticated)
Additional Measures:
  • Schema validation
  • mTLS authentication
  • Rate limiting
  • Sequence mitigation
Documentation →

Cloudflare Protection Quick Reference

WAF Attack Score

ML-based scoring: cf.waf.score (1-99, lower = more likely attack)

Component scores: cf.waf.score.sqli, cf.waf.score.xss, cf.waf.score.rce

Bot Management

Bot score: cf.bot_management.score (1-99, higher = more likely human)

Fingerprinting: cf.bot_management.ja3_hash, cf.bot_management.ja4

Managed Rulesets

Enable in Security > WAF > Managed Rules

Key rulesets: Cloudflare Managed, OWASP Core, Exposed Credentials Check

Custom Rules

Combine signals: (cf.waf.score lt 50) or (cf.threat_score gt 30)

Actions: Block, Challenge, JS Challenge, Managed Challenge, Log

Rate Limiting

Path-based: http.request.uri.path eq "/api/login"

Counting: Requests per period with sliding window

API Shield

Schema validation, mTLS, sequence mitigation

GraphQL: Depth limiting, complexity analysis