PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web application firewall bypass

yeswehack.com | blog | #bug-bounty | #pentesting | #web-security | #waf | #cloudflare | #payloads | #bypass | #akamai
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bypassing web application firewalls after a flaw is found: abusing regex and blacklist weaknesses, normalisation quirks and frontend/backend filter collisions to slip payloads past WAFs.
Published
Collected

Related coverage

research · portswigger.net
HTTP/1.1 must die: the desync endgame
HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.
research · portswigger.net
Bypassing Web Cache Poisoning Countermeasures
James Kettle examines and bypasses vendor countermeasures to web cache poisoning from Cloudflare, Akamai and Fastly, flagging pitfalls like cacheable block pages enabling DoS.
research · projectblack.io
Whitelisting an IP Address for Penetration Testing in Cloudflare
Why to whitelist a penetration tester's IP in Cloudflare's WAF: rate limits slow testing and the WAF can mask code-level flaws. Includes steps for a skip rule, then re-testing with the WAF enabled.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
Back