Bypassing WAFs for Fun and JS Injection with Parameter Pollution

Published

2025-08-04 00:00

Collected

2026-07-31 00:59

---
id: 5612
title: "Bypassing WAFs for Fun and JS Injection with Parameter Pollution"
source_domain: ethiack.com
source_url: "https://ethiack.com/info-hub/research/bypassing-wafs-for-fun-and-js-injection-with-parameter-pollution"
published_at: "2025-08-04T00:00:00Z"
tags: ["web-security", "xss", "waf", "asp-net", "ethiack", "parameter-pollution"]
phying_url: "https://phying.com/item/5612"
lang: en
---

# Bypassing WAFs for Fun and JS Injection with Parameter Pollution

## Summary

Ethiack details bypassing a strict WAF on an ASP.NET application via HTTP parameter pollution, splitting a JavaScript payload across duplicate parameters to evade inspection and trigger XSS.

## Intelligence Metadata

- **Sources:** ethiack.com
- **Published:** 2025-08-04T00:00:00Z
- **Original:** https://ethiack.com/info-hub/research/bypassing-wafs-for-fun-and-js-injection-with-parameter-pollution
- **Phying News:** https://phying.com/item/5612