PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The art of payload obfuscation: how to mask malicious scripts and bypass defence mechanisms

yeswehack.com | blog | #bug-bounty | #encoding | #payload-obfuscation | #log4shell | #waf-bypass | #evasion
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to payload obfuscation for bypassing WAFs and input filters: URL, Unicode, hex, octal and mixed encoding, variable expression assignment, arrays in parameters and JavaScript tricks.
Published
Collected

Related coverage

blog · bugcrowd.com
Machine talk: The long road to understanding payload obfuscation
A bug bounty primer covering the CS fundamentals—binary, bits, bytes, and encoding—as groundwork for understanding how payload obfuscation evades security controls. Part two covers the tricks.
research · portswigger.net
Bypassing WAFs and cracking XOR with Hackvertor
Gareth Heyes showcases Hackvertor's tag-based encoding for chaining multiple conversion layers inside Burp requests, demonstrating a Cloudflare WAF bypass and XOR cracking.
research · portswigger.net
SVG animate XSS vector
Gareth Heyes finds an SVG animate XSS vector that hides a javascript: URL inside the values attribute, using keyTimes and repeatCount to slip past WAFs scanning for the JavaScript protocol.
research · blog.quarkslab.com
In WAF we (should not) trust
Quarkslab deep-dives WAF bypasses: how blacklists, penalty boxes, rate limiting and parsing discrepancies between a WAF and its backend can be abused to sneak malicious payloads through.
blog · yeswehack.com
‘Hunters’ biggest mistake? Expecting immediate results’: ‘RL’ on building a Bug Bounty career
Q&A with 'RL' (Harel): starting during Covid via Hack The Box, why documentation is underrated, WAF bypass tricks, and his top find — a Glassdoor cache-poisoning bug via URL parser confusion.
blog · yeswehack.com
DOJO CHALLENGE #17 Winners!
Winners of DOJO Challenge #17, a LeHack special edition: players bypassed a simulated WAF to execute JavaScript and retrieve a hidden password. Five best write-ups were rewarded.
Back