What problem does it solve? When a WAF or edge proxy blocks a sensitive path with a 403 or challenge page, the underlying origin server may still serve the same route under a normalized path variant, and manually probing these differences is error-prone and easy to do incompletely. ## Core Features & Use Cases - Edge vs. Origin Fingerprinting: Confirms whether a block is enforced at the WAF layer or the application layer by comparing response headers and body signatures. - Path Variant Testing: Systematically tries trailing slashes, doubled slashes, dot-segments, encoded slashes, and case variations that WAF string-match rules often miss but origin routers accept. - Severity Assessment: Provides a severity matrix based on what the bypass actually reaches, from cosmetic WAF gaps to unauthenticated admin endpoints. - Use Case: During an assessment, a Keycloak admin realm path returns a 403 from the edge. Use this Skill to test normalization variants, confirm the origin serves the realm's JWKS or config payload, and grade the finding correctly. ## Quick Start Test the blocked path /admin/realms/master on this target for WAF path-normalization bypasses and confirm whether the origin still serves the sensitive content.
