Awesome-WAF
🔥 Web-application firewalls (WAFs) from security standpoint.
https://github.com/0xInfection/Awesome-WAF
Last synced: 5 days ago
JSON representation
-
Video Presentations
-
Management:
- Evading Deep Inspection Systems for Fun and Shell - us-13).
- WAF Bypass Techniques Using HTTP Standard and Web Servers Behavior
- Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls - us-12).
- Web Application Firewall - Analysis of Detection Logic
- Bypassing Browser Security Policies for Fun & Profit
- Web Application Firewall Bypassing
- Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks
- Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload) - VQ).
- WAFs FTW! A modern devops approach to security testing your WAF
- Web Application Firewall Bypassing WorkShop
- Bypassing Modern WAF's Exemplified At XSS by Rafay Baloch
- WTF - WAF Testing Framework
- The Death of a Web App Firewall - N2sHnXFwi0XjDIMTPg).
- Adventures with the WAF
- Bypassing Intrusion Detection Systems
- Building Your Own WAF as a Service and Forgetting about False Positives
- WAF Bypass Techniques Using HTTP Standard and Web Servers Behavior
- Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls - us-12).
- Web Application Firewall - Analysis of Detection Logic
- Bypassing Browser Security Policies for Fun & Profit
- Web Application Firewall Bypassing
- Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks
- Evading Deep Inspection Systems for Fun and Shell - us-13).
- Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload) - VQ).
- WAFs FTW! A modern devops approach to security testing your WAF
- Web Application Firewall Bypassing WorkShop
- Bypassing Modern WAF's Exemplified At XSS by Rafay Baloch
- WTF - WAF Testing Framework
- The Death of a Web App Firewall - N2sHnXFwi0XjDIMTPg).
- Adventures with the WAF
- Bypassing Intrusion Detection Systems
- Building Your Own WAF as a Service and Forgetting about False Positives
- Web Application Firewall Bypassing
- Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks
- Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload) - VQ).
- Adventures with the WAF
- Bypassing Intrusion Detection Systems
- Bypassing Browser Security Policies for Fun & Profit
- Building Your Own WAF as a Service and Forgetting about False Positives
-
-
Testing Methodology:
-
Detection Techniques:
-
-
Evasion Techniques
-
Fuzzing/Bruteforcing:
-
Obfuscation:
-
HTTP Parameter Fragmentation
-
Google Dorks Approach:
-
Browser Bugs:
-
Using Atypical Equivalent Syntactic Structures
-
Abuse WAF limit on HTTP Responses
-
Abusing DNS History:
- IP History - trails) come to the rescue during the recon process.
-
-
Known Bypasses:
-
Airlock Ergon
-
AWS
-
WebKnight
-
Barracuda
- @Global-Evolution
- Barracuda WAF 8.0.1 - Remote Command Execution (Metasploit) - db.com/?author=479#)
- Barracuda Spam & Virus Firewall 5.1.3 - Remote Command Execution (Metasploit) - db.com/?author=479)
-
Cerber (WordPress)
-
Citrix NetScaler
- @BGA Security
- `generic_api_call.pl` XSS - db.com/?author=6654)
-
Cloudflare
-
Imperva
- @Giuseppe D'Amore
- Imperva SecureSphere <= v13 - Privilege Escalation - db.com/?author=8991)
- XSS Bypass
- XSS Bypass
- XSS Bypass
- XSS Bypass
- Imperva SecureSphere 13 - Remote Command Execution - db.com/?author=9396)
- @David Y
- @Emad Shanab
- @i_bo0om
- @c0d3g33k
- @DRK1WI
- XSS Bypass
-
DotDefender
-
Fortinet Fortiweb
-
Sucuri
-
F5 BIG-IP
- `report_type` XSS - db.com/?author=6654)
- @Anastasios Monachos
-
Kona SiteDefender
-
Profense
- GET Type CSRF Attack - db.com/?author=628) (>= v.2.6.2)
- @Michael Brooks
- XSS Bypass
-
Wordfence
- XSS Exploit - db.com/?author=1293) (>= v3.3.5)
- @brute Logic
- HTML Injection - db.com/?author=8505)
- Other XSS Bypasses
-
StackPath
-
F5 FirePass
-
WebARX
-
-
Awesome Tools
-
Evasion:
- Bypass WAF BurpSuite Plugin - A plugin for Burp Suite which adds some request headers so that the requests seem from the internal network.
-
Testing:
- WAF Testing Framework - A WAF testing tool by [Imperva](https://imperva.com).
-
-
Blogs and Writeups
-
Management:
- How To Exploit PHP Remotely To Bypass Filters & WAF Rules - By [@Secjuice](https://secjuice.com)
- XXE that can Bypass WAF - By [@WallArm](https://labs.wallarm.com).
- SQL Injection Bypassing WAF - By [@OWASP](https://owasp.com).
- How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing - By [@SunnyHoi](https://twitter.com/sunnyhoi).
- Bypassing Web-Application Firewalls by abusing SSL/TLS - By [@0x09AL](https://twitter.com/0x09al).
- Request Encoding to Bypass WAFs - By [@Soroush Dalili](https://twitter.com/irsdl)
- ModSecurity SQL Injection Challenge: Lessons Learned - By [@SpiderLabs](https://trustwave.com).
- Web Application Firewall (WAF) Evasion Techniques #2 - By [@Secjuice](https://www.secjuice.com).
- Web Application Firewall (WAF) Evasion Techniques #3 - By [@Secjuice](https://www.secjuice.com).
- How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing - By [@SunnyHoi](https://twitter.com/sunnyhoi).
- Web Application Firewall (WAF) Evasion Techniques #1 - By [@Secjuice](https://www.secjuice.com).
-
-
Credits & License:
-
Presentations:
- Pinaki - WAF is licensed under the [Apache 2.0 License](LICENSE).
-
Categories
Sub Categories
Management:
50
Imperva
13
Cloudflare
9
Kona SiteDefender
7
Wordfence
4
Google Dorks Approach:
4
DotDefender
4
Profense
3
WebKnight
3
Fuzzing/Bruteforcing:
3
Sucuri
3
Using Atypical Equivalent Syntactic Structures
3
Barracuda
3
Obfuscation:
3
WebARX
2
Fortinet Fortiweb
2
Browser Bugs:
2
Citrix NetScaler
2
F5 BIG-IP
2
Evasion:
1
Testing:
1
Presentations:
1
F5 FirePass
1
AWS
1
Cerber (WordPress)
1
Airlock Ergon
1
StackPath
1
Detection Techniques:
1
HTTP Parameter Fragmentation
1
Abuse WAF limit on HTTP Responses
1
Abusing DNS History:
1