Why the WAF

This article explains considerations for web application security assessments with respect to Web Application Firewalls (WAFs), arguing that testing both with and without WAF protections can reveal application-level weaknesses and WAF gaps; it covers allowlisting tester IPs, the value of defense-in-depth, and describes common WAF bypass approaches (including request-padding techniques that overflow WAF inspection buffers).