// TOOLS

Security Tools

🛡️ WAF Evasion Lab

Paste any payload and the mutator generates evasion variants (case toggling, inline comments, URL/HTML/Unicode encoding, string-to-hex…) explaining why each one bypasses the filter. Or use the 158-payload curated library across 8 categories.

⚠️ For authorised audits, lab environments and CTFs only. Testing payloads against systems you do not own is illegal.

Frequently asked questions

What does the Mutator do?
It takes your payload (XSS, SQLi…) and generates evasion variants using real techniques —case toggling, inline comments, URL/HTML encoding, string-to-hex…— explaining why each one may bypass the filter.
Is it legal to test these payloads?
Only against your own systems or with explicit permission. Firing payloads at third-party sites without authorization is illegal.
Will it bypass any WAF?
There are no guarantees: it depends on the WAF, its rules and the injection context. It is a way to test how effective your protections are, not a master key.