https://souljian.cn/tags/waf/Recent content in WAF on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088168/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088168/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>WAF 绕过测试只在授权测试环境进行。</p> <h2 id="一waf-架构">一、WAF 架构 </h2><img src="https://souljian.cn/img/waf-architecture.svg" alt="WAF 架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 流量接入 → ② 规则匹配 → ③ 动作执行（允许/阻止/重写） </span></span></code></pre></td></tr></table> </div> </div><h2 id="二绕过方式">二、绕过方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">编码绕过：URL编码/Base64/Unicode </span></span><span class="line"><span class="cl">分块传输：Transfer-Encoding: chunked </span></span><span class="line"><span class="cl">协议滥用：HTTP/2 · Host 头注入 </span></span><span class="line"><span class="cl">大小写混淆：SeLeCt / UNION+SELECT </span></span><span class="line"><span class="cl">注释插入：/**/ · /*xx*/ </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">规则更新 · 深度包检测（DPI）· 行为分析 </span></span><span class="line"><span class="cl">多层 WAF 部署 · 异常流量告警 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>WAF 是 Web 安全的重要防线，但<strong>不是万能的</strong>。绕过 WAF 的方法多样，防御方需持续更新规则并结合行为分析。</p>