HTTP Junk Header Injection - Possible WAF Bypass

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•10

This rule detects HTTP requests containing multiple common HTTP header names (X-Forwarded-For, X-Real-IP, X-Originating-IP) in the 'http.header_names' field. This pattern is often associated with attempts to bypass Web Application Firewalls (WAFs) or other security devices by injecting junk or spoofed headers to confuse or misdirect them.