Bypassing Modern WAF's Exemplified At XSS (Webcast)
Past Saturday, I conducted a "Webcast" on "Garage4hackers" on one of my favorite subjects in the field of Information Security i.e. "WAF Bypass". Initially, i had decided to present something on the topic of "Mobile Browser Security" due to the fact that this has been a topic I have been recently conducting a research on.
However i later realized that the "TakeAways" would not be much helpful, therefore i decided to talk about something that Bughunters/Pentesters can use in their day to day pentests and security engagements and hence i decided to present on this topic.
I must admit that the response has been overwhelming along with it, i have also managed to get a chance to learn more from the feedback and CTF responses.
I would like to specially thank "Imdadullah", "Himanshu", "Sandeep" along with other garage4hackers members for inviting/supporting me through out the journey. One of the best things "G4H Community" is the work they are doing for the security community by conducting free of cost Webcasts. You can find a list of other Webcasts here - "http://www.garage4hackers.com/ranchoddas/"
In this webinar, the we will talk about various techniques that can be used to bypass WAF"s such as Brute Forcing, Regular expression reversing and browser bugs. The webinar would mostly discuss
- Basic know how about XSS attacks
After the webinar, we had this "CTF" challenge made up by a friend of mine "FileDescriptor", certain parts the first two challenges are based upon characteristics of a real world WAF that I encountered in wild which was combined with FD's ideas to make up the challenge . The last challenge is based upon "@FileDescriptor" unqiue idea and hence, it's not easy to crack and hence we named it as "Hard".
CTF Link :http://184.108.40.206