https://github.com/devploit/XORpass

Encoder to bypass WAF filters using XOR operations.
https://github.com/devploit/XORpass

bugbounty pentesting php waf-bypass websec xor

Last synced: about 1 month ago
JSON representation

Encoder to bypass WAF filters using XOR operations.

• Host: GitHub
• URL: https://github.com/devploit/XORpass
• Owner: devploit
• License: gpl-3.0
• Created: 2019-10-26T15:01:44.000Z (about 5 years ago)
• Default Branch: master
• Last Pushed: 2022-07-07T14:00:04.000Z (over 2 years ago)
• Last Synced: 2024-08-02T13:30:57.848Z (4 months ago)
• Topics: bugbounty, pentesting, php, waf-bypass, websec, xor
• Language: Python
• Homepage:
• Size: 22.5 KB
• Stars: 250
• Watchers: 7
• Forks: 43
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-starz - devploit/XORpass - Encoder to bypass WAF filters using XOR operations. (Python)

README

        






[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/dwyl/esta/issues)

XORpass is an encoder to bypass WAF filters using XOR operations.

### Installation & Usage

```

git clone https://github.com/devploit/XORpass

cd XORpass

$ python3 xorpass.py -h

```

### Example of bypass:

Using clear PHP function:



Using XOR bypass of that function:

```bash

$ python3 xorpass.py -e "system(ls)"

```



#### Why does PHP treat our payload as a string?

The ^ is the exclusive or operator, which means that we're in reality working with binary values. So lets break down what happens.

The XOR operator on binary values will return 1 where just one of the bits were 1, otherwise it returns 0 (0^0 = 0, 0^1 = 1, 1^0 = 1, 1^1 = 0). When you use XOR on characters, you're using their ASCII values. These ASCII values are integers, so we need to convert those to binary to see what's actually going on.

```

A = 65 = 1000001

S = 83 = 1010011

B = 66 = 1000010

A       1000001

        ^

S       1010011

        ^

B       1000010

----------------

result  1010000 = 80 = P

A^S^B = P

```

If we do an 'echo "A"^"S"^"B";' PHP will return us a P as we see.



### Contributors

[@julianjm](https://github.com/julianjm)

### Contact

[![Twitter: devploit](https://img.shields.io/badge/-Twitter-blue?style=flat-square&logo=Twitter&logoColor=white&link=https://twitter.com/devploit/)](https://twitter.com/devploit/)