id: waf-xss-basic-bypass
info:
name: WAF XSS Basic Bypass
author: waftester
severity: high
description: |
Tests WAF effectiveness against fundamental cross-site scripting vectors.
Covers reflected XSS via script tags, event handlers, protocol handlers,
SVG injection, and various HTML element injection techniques. Tests both
GET and POST parameter vectors with multiple encoding styles.
reference:
- https://owasp.org/www-community/attacks/xss/
- https://portswigger.net/web-security/cross-site-scripting
- https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html
- https://html5sec.org/
- https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection
tags: xss,waf,bypass,owasp-a03,reflected,injection,waftester
classification:
cwe-id:
- CWE-79
- CWE-693
metadata:
verified: true
max-request: 22
shodan-query: "http.waf"
fofa-query: "header=\"WAF\""
http:
# Classic script tag injection
- method: GET
path:
- "{{BaseURL}}/?q="
- "{{BaseURL}}/?q="
- "{{BaseURL}}/?q="
- "{{BaseURL}}/?q="
matchers-condition: and
matchers:
- type: word
part: body
words:
- ""
# Event handler injection - common handlers
- method: GET
path:
- "{{BaseURL}}/?q=
"
- "{{BaseURL}}/?q=