stealth-techniques

Configure evasion patterns to bypass WAFs, IDS/IPS, and rate limits during authorized security testing.

6|1|Updated Mar 1, 2026

Search Tags:#waf #stealth #evasion #header-spoofing #timing-evasion #session-mimicking

Ready to run

npx skills add https://github.com/narlyseorg/superhackers --skill stealth-techniques

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: stealth-techniques
Source: https://github.com/narlyseorg/superhackers/tree/main/skills/stealth-techniques
Command: npx skills add https://github.com/narlyseorg/superhackers --skill stealth-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Use when security tools are being blocked by WAF, rate limiting, or intrusion detection systems. It provides comprehensive evasion techniques including User-Agent spoofing, header randomization, timing evasion, session mimicking, and WAF bypass patterns for stealthy security assessments.

Core Features & Use Cases

Stealth testing workflow to bypass WAFs, IDS/IPS, and rate limits during authorized assessments.
Techniques include header spoofing, randomization, timing delays, and session impersonation.
Use Case: For a pentest against a web app behind a rate-limiting gateway, apply evasion techniques to maintain testing flow without triggering blocks.

Quick Start

Provide a target URL and enable a stealth profile, then start testing with default stealth settings and observe for any blocks.

Frequently Asked Questions about stealth-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I bypass WAF and rate limiting during authorized security testing?▼

To bypass WAF and rate limiting during security testing, apply evasion patterns like User-Agent spoofing, header randomization, timing delays, and session mimicking to maintain your testing flow without triggering blocks.

What is header spoofing and how does it evade intrusion detection systems?▼

Header spoofing evades intrusion detection systems by randomizing request headers and mimicking legitimate user sessions. This disguises automated security testing traffic, preventing IDS/IPS or WAFs from flagging the activity as malicious.

Can I use timing evasion techniques to avoid getting blocked by API rate limits?▼

Yes, timing evasion techniques help avoid API rate limit blocks by introducing timing delays between requests. This slows down the testing pace to mimic normal user behavior, maintaining operation within authorization boundaries.

How do I configure a stealth profile for web application pentesting?▼

Configuring a stealth profile for web application pentesting involves providing a target URL and enabling default stealth settings. This applies session mimicking and header randomization to observe and bypass security controls.

What is the best way to maintain testing flow against a rate-limiting gateway?▼

The best way to maintain testing flow against a rate-limiting gateway is to apply comprehensive evasion techniques. Combining header randomization with timing delays keeps your security assessment stealthy and operational.