Quick answer
The Cloudflare WAF doesn't inspect the whole body: it has per-plan limits (Free ~8 KB, Pro/Business low by default, Enterprise 128 KB). If your payload goes after the limit, the WAF doesn't see it. Classic bypass: padding + real payload at the end of the body. It works on POST/PUT/PATCH, JSON, multipart and form-urlencoded. Combine it with chunked transfer encoding to evade rules that do inspect the first bytes. Real severity only when you chain it with a SQLi/XSS/RCE behind it.
1. The concept: body inspection limits
Cloudflare inspects the first N bytes of the body. Above N, the content passes without analysis to the origin. It's documented by design behavior by Cloudflare — but in bug bounty what matters is the impact on the target's app.
Limits per plan (state post-December 2025)
| Plan | Inspection limit | Expandable |
|---|---|---|
| Free | ~8 KB | No |
| Pro | Low by default | Up to 1 MB via support |
| Business | Low by default | Up to 1 MB via support |
| Enterprise | 128 KB | Up to 1 MB via support |
Cloudflare tried to raise the limit to 1 MB for everyone in December 2025 (CVE-2025-55182, React RCE), but reverted due to massive false positives in managed rulesets. Result: the low limits are still in effect in the vast majority of Free/Pro deployments.
[!tip] Plan detection If you see advanced Bot Management, complex custom WAF rules and
cf-raywith enterprise prefixes → probably Enterprise. If thecdn-cgi/tracepage doesn't expose advanced features and thecf-cache-statusvalues are basic → Free/Pro.
2. Fingerprint the active WAF
Before firing oversize, confirm the WAF is inspecting the body. Send a basic payload that always triggers managed rules:
# SQLi clásico — debería disparar Managed Ruleset
curl -X POST https://target.com/api/search \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "q=' UNION SELECT password FROM users-- "
# Respuesta esperada con WAF activo:
# HTTP/1.1 403 Forbidden
# server: cloudflare
# cf-ray: <id>-<colo>
# (body con "Attention Required! | Cloudflare")
If you get a 403 → WAF active and inspecting. If it passes with 200/500 → either there's no WAF, or it doesn't inspect that endpoint, or it's already bypassed by default.
Keep reading the full chain
The remaining part includes the step-by-step PoC, exploitation code and the full chain that led to impact. Available to subscribers.
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Practice this in a lab
Cloudflare Waf Bypass
Keep learning · free account
Save your progress, unlock advanced payloads and rank your flags.
Related articles
Cloudflare WAF Bypass — oversized body, header stuffing and cache poisoning
Cloudflare's WAF has per-plan inspection limits (~8KB Free, 128KB Enterprise). Padding bypass, header stuffing >100 headers, IP origin disclosure.
CSRF advanced exploitation — SameSite bypass, JSON CSRF, Flash, file upload CSRF
Advanced CSRF techniques beyond the classic form submit: SameSite=Lax bypass via GET, JSON CSRF with Content-Type tricks, file upload CSRF and exploitation chains.
XSS WAF bypass — encoding, parser differentials, case-only mutations
WAF bypass techniques for XSS: HTML entities, hex/decimal/unicode encoding, parser differentials (browser vs WAF), comment injection, case variations, JS template literals.