PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

An Interesting XSS-Bypassing WAF

labs.cognisys.group | vulnerability | #pentesting | #web-security | #xss | #waf | #waf-bypass | #payload
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Overview
Published
Collected

Related coverage

research · portswigger.net
JavaScript without parentheses using DOMMatrix
Gareth Heyes shows how to execute JavaScript without parentheses by abusing the DOMMatrix constructor to generate otherwise-forbidden characters, solving a limited-charset XSS challenge.
research · portswigger.net
One XSS cheatsheet to rule them all
Gareth Heyes launches PortSwigger's XSS cheatsheet, packed with novel filter-bypass vectors such as :target CSS transitions and hash-triggered focus events, each with a hosted PoC.
research · portswigger.net
XSS without parentheses and semi-colons
Gareth Heyes adapts his classic onerror/throw trick to call functions without parentheses, semicolons or newlines, enabling XSS in heavily filtered contexts.
research · blog.quarkslab.com
In WAF we (should not) trust
Quarkslab deep-dives WAF bypasses: how blacklists, penalty boxes, rate limiting and parsing discrepancies between a WAF and its backend can be abused to sneak malicious payloads through.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · bishopfox.com
Zero-Day Collaboration: Working With Imperva to Eliminate a Critical Exposure
Bishop Fox found a WAF bypass in Imperva's Cloud WAF letting attackers evade rules with malicious POST payloads such as Log4j exploits and SQL injection; Imperva patched within days.
Back