PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

In WAF we (should not) trust

blog.quarkslab.com | research | #appsec | #web-security | #command-obfuscation | #waf | #http | #pentest | #payload-obfuscation | #waf-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab deep-dives WAF bypasses: how blacklists, penalty boxes, rate limiting and parsing discrepancies between a WAF and its backend can be abused to sneak malicious payloads through.
Published
Collected

Related coverage

research · portswigger.net
SVG animate XSS vector
Gareth Heyes finds an SVG animate XSS vector that hides a javascript: URL inside the values attribute, using keyTimes and repeatCount to slip past WAFs scanning for the JavaScript protocol.
blog · yeswehack.com
The art of payload obfuscation: how to mask malicious scripts and bypass defence mechanisms
Guide to payload obfuscation for bypassing WAFs and input filters: URL, Unicode, hex, octal and mixed encoding, variable expression assignment, arrays in parameters and JavaScript tricks.
vulnerability · labs.cognisys.group
An Interesting XSS-Bypassing WAF
Overview
blog · netspi.com
Application Self Protection – A New Addition to the OWASP Top 10
Breaks down OWASP Top 10 2017 candidate A7, Insufficient Attack Protection, urging apps to detect, block, log, and respond to automated attacks rather than only validating input.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Introducing HTTP Anomaly Rank
James Kettle introduces HTTP Anomaly Rank, an algorithm that surfaces the most interesting HTTP responses from huge result sets. It ships in Turbo Intruder and Burp Suite's 2025.10 API.
Back