get_waf_bypass_payloads

Instructions

Implementation Reference

• src/sqli_mcp/server.py:446-462 (handler)

  The MCP tool handler for 'get_waf_bypass_payloads'. Decorated with @mcp.tool(), it delegates to get_waf_bypass_variants() and returns a dict with original payload, list of technique names, and the technique-to-payload mapping.

  @mcp.tool()
  def get_waf_bypass_payloads(payload: str) -> dict:
      """
      Get all WAF bypass variants of a payload.
      
      Args:
          payload: Original SQL injection payload
      
      Returns:
          Dictionary of bypass techniques and their encoded payloads
      """
      variants = get_waf_bypass_variants(payload)
      return {
          "original": payload,
          "techniques": list(variants.keys()),
          "variants": variants
      }

• src/sqli_mcp/models.py:34-42 (schema)

  The WAFBypassTechnique enum defining all available bypass techniques (url_encode, double_url_encode, hex_encode, unicode, case_swap, comment_injection) used as input/output schema for the tool.

  class WAFBypassTechnique(str, Enum):
      """WAF bypass encoding techniques."""
      NONE = "none"
      URL_ENCODE = "url_encode"
      DOUBLE_URL_ENCODE = "double_url_encode"
      HEX_ENCODE = "hex_encode"
      UNICODE = "unicode"
      CASE_SWAP = "case_swap"
      COMMENT_INJECTION = "comment_injection"

• src/sqli_mcp/server.py:446-447 (registration)

  The tool is registered via the @mcp.tool() decorator on the function definition in server.py, where mcp = FastMCP('SQLi-MCP').

  @mcp.tool()
  def get_waf_bypass_payloads(payload: str) -> dict:

• src/sqli_mcp/payloads/loader.py:163-177 (helper)

  Helper function that generates all WAF bypass variants by iterating over each WAFBypassTechnique and calling apply_waf_bypass(). Called by the tool handler.

  def get_waf_bypass_variants(payload: str) -> dict[str, str]:
      """
      Get all WAF bypass variants of a payload.
      
      Args:
          payload: Original payload
      
      Returns:
          Dictionary mapping technique name to encoded payload
      """
      variants = {}
      for technique in WAFBypassTechnique:
          if technique != WAFBypassTechnique.NONE:
              variants[technique.value] = apply_waf_bypass(payload, technique)
      return variants

• src/sqli_mcp/payloads/loader.py:104-160 (helper)

  Helper function that applies a specific WAF bypass encoding technique to a payload. Supports URL encode, double URL encode, hex encode, unicode, case swap, and comment injection.

  def apply_waf_bypass(payload: str, technique: WAFBypassTechnique) -> str:
      """
      Apply WAF bypass encoding to a payload.
      
      Args:
          payload: The original SQL injection payload
          technique: The bypass technique to apply
      
      Returns:
          Encoded payload string
      """
      if technique == WAFBypassTechnique.NONE:
          return payload
      
      elif technique == WAFBypassTechnique.URL_ENCODE:
          # URL encode special characters
          return urllib.parse.quote(payload, safe='')
      
      elif technique == WAFBypassTechnique.DOUBLE_URL_ENCODE:
          # Double URL encode
          return urllib.parse.quote(urllib.parse.quote(payload, safe=''), safe='')
      
      elif technique == WAFBypassTechnique.HEX_ENCODE:
          # Hex encode the payload (useful for some contexts)
          return ''.join(f'%{ord(c):02x}' for c in payload)
      
      elif technique == WAFBypassTechnique.UNICODE:
          # Unicode encoding for bypassing simple filters
          encoded = ""
          for char in payload:
              if char in " '\"=<>":
                  encoded += f"%u{ord(char):04x}"
              else:
                  encoded += char
          return encoded
      
      elif technique == WAFBypassTechnique.CASE_SWAP:
          # Alternate case for keywords to bypass case-sensitive filters
          keywords = ["SELECT", "UNION", "WHERE", "FROM", "AND", "OR", "ORDER", "BY", 
                     "INSERT", "UPDATE", "DELETE", "DROP", "NULL", "SLEEP", "WAITFOR",
                     "CONCAT", "VERSION", "DATABASE", "USER", "TABLE", "HAVING", "GROUP"]
          result = payload
          for keyword in keywords:
              # Apply mixed case: SeLeCt, uNiOn, etc.
              mixed = ""
              for i, c in enumerate(keyword):
                  mixed += c.lower() if i % 2 == 0 else c.upper()
              result = result.replace(keyword, mixed)
              result = result.replace(keyword.lower(), mixed)
          return result
      
      elif technique == WAFBypassTechnique.COMMENT_INJECTION:
          # Insert comments between SQL keywords to bypass filters
          # Replace spaces with inline comments
          return payload.replace(" ", "/**/")
      
      return payload