Web Application Firewall Bypassing
summary
Shows concrete bypass techniques: preprocessor exploitation (skipping parameter checks, malformed methods, overload), impedance mismatches (HTTP parameter pollution, double-URL encoding) and rule‑set bypassing by fuzzing and reverse engineering. Demonstrates a Python CLI, WAFNinja CLI tool, that fuzzes GET/POST/cookies via a proxy, sending 157 fuzzing strings to map responses and finds an onwheel+img tag bypass in a demo; recommends fixing root causes not just adding WAF rules.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:16Bypassing a WAF - Why?
- 1:49Main Goal
- 3:31Functionality
- 4:47Normalization Functions
- 5:44Input Validation
- 6:39Security Models
- 12:22Skipping Parameter Verification
- 13:30Malformed HTTP Methods
- 14:11Overloading the WAF
- 15:05HTTP Parameter Pollution
- 16:35Double URL Encoding
- 18:05Bypass Rule Set
- 19:10Overview
- 21:55Reconnaissance
- 22:21Attacking The Pre-processor
- 23:17Finding an Impedance Mismatch
- 24:07Finding Other Vulnerabilities
- 24:36After the Pentest
- 27:12Fuzzing
- 36:52Never forget!
related talks
43mWAF Bypass Techniques Using HTTP Standard and Web Servers’ Behavior
14mWeb Application Firewalls: A False Sense of Security?
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
40mWeb Application Firewalls: Analysis of Detection Logic
26mBridging the Gap Between Research and Practice in Intelligently Bypassing WAF
42mModern web application bugs
42mDon’t use a WAF, and when you should, anyway.
38mWeb Application Firewalls Revisited