WAF Bypass Checklist

Photo by Sigmund on Unsplash

Generic techniques

  • ASPX removes % not followed by two hex characters (https://site.com/index.php?%file=cat /etc/paswd)
  • We can use spaces to fool a WAF (<Img src = x onerror = “javascript: window.onerror = alert; throw XSS”>)