Module header 

HTTP header obfuscation for WAF bypass.

WAFs inspect HTTP headers to detect malicious requests. This module applies transformations that are valid per HTTP RFCs but confuse WAF header parsers, causing them to misparse or skip inspection.

Techniques

• Case mixing — cOnTeNt-TyPe instead of Content-Type
• Whitespace tricks — tabs, spaces around colons and values
• Header folding — obsolete but still parsed by many servers (RFC 7230 §3.2.4)
• Duplicate headers — first vs. last wins disagreement
• Underscore substitution — Content_Type accepted by some servers
• Null byte injection — Content-Type\x00 truncates header name
• SPaced header name — Content-Type trailing space before colon
• Header value wrapping — Value spread across multiple continuation lines
• Comma-joined header values — Multiple values in one header via comma

Enums

HeaderTechnique

A header transformation technique.

Functions

all_obfuscations

Apply all header obfuscation techniques to a header name/value pair.

case_mix

Apply case mixing to a header name.

comma_join

Comma-join multiple values into a single header.

duplicate_header

Generate a duplicate header pair: returns (benign_line, real_line).

lf_only_line_fold

Apply LF-only line folding.

lf_only_multi_line_fold

Apply LF-only multi-line folding.

line_fold

Apply obsolete line folding (RFC 7230 §3.2.4).

multi_line_fold

Apply multi-line folding — value spread across 3+ continuation lines.

null_byte_inject

Inject a null byte into the header name at the midpoint.

tab_separator

Apply tab separator: Header:\tvalue instead of Header: value.

trailing_space

Add a trailing space before the colon separator.

underscore_substitute

Replace hyphens with underscores in the header name.

whitespace_pad

Apply whitespace padding around the value.