# assetnote/nowafpls

Burp Plugin to Bypass WAFs through the insertion of Junk Data

Repository: https://github.com/assetnote/nowafpls
Canonical: https://ross.abutalabs.com/products/nowafpls
Language: Python
License Family: other
Last push: 2025-07-14T12:26:46+00:00

## Health v2 (maintenance only)
Score: 38/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 31, release rhythm 35, longevity 60
- inputs: {"age_days": 849, "days_push": 415, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1502, forks 147 (observed 2026-08-28T04:04:54.440040+00:00)

## What it is
nowafpls is a Jython-based Burp Suite plugin that bypasses web application firewalls (WAFs) by inserting junk data into HTTP request bodies. It exploits the request body size limits of WAFs so that malicious payloads placed after the junk data are not inspected by the firewall.

## Use cases
- bypass cloudflare waf
- bypass aws waf request body inspection
- insert junk data into http requests to evade waf
- burp suite plugin for waf bypass
- test waf request body size limits
- evade waf detection in penetration testing
- pad http post requests to skip waf inspection

## When to choose
- you are performing authorized penetration testing against a WAF-protected application
- you need to test whether a WAF's request body inspection limit can be exploited
- you want a simple, lightweight Burp Suite extension for WAF evasion
- you need contextual junk data insertion for URLEncoded, XML, or JSON request bodies

## When to avoid
- you are not authorized to test the target application
- you need a general-purpose web proxy or scanner rather than a WAF bypass tool
- you do not use Burp Suite or a compatible interception proxy
- the target WAF has no request body size inspection limit

## Facets
- artifact type: plugin
- maturity: active
- function: security, penetration-testing, plugin-system
- domain: security, penetration-testing, web-development, developer-tools
- platform: python, browser
- tags: burp-suite, waf-bypass, jython, web-security, penetration-testing, http-request-manipulation, security-testing, burp-extension, waf, request-padding

## Member repositories
- assetnote/nowafpls (main) score 38

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:54.440040+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:32:52.241331+00:00, confidence not recorded.
  - readme: https://github.com/assetnote/nowafpls (fetched 2026-08-28T04:04:54.440040+00:00, sha 53997ea6b5ac)
- Data as of 2026-08-30T08:39:29.467469+00:00.