Congratulations!

[Valid RSS] This is a valid RSS feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: https://waf-bypass.com/feed/

  1. <?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
  2. xmlns:content="http://purl.org/rss/1.0/modules/content/"
  3. xmlns:wfw="http://wellformedweb.org/CommentAPI/"
  4. xmlns:dc="http://purl.org/dc/elements/1.1/"
  5. xmlns:atom="http://www.w3.org/2005/Atom"
  6. xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  7. xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  8. >
  9.  
  10. <channel>
  11. <title>Web application firewalls bypasses collection and testing tools</title>
  12. <atom:link href="https://waf-bypass.com/feed/" rel="self" type="application/rss+xml" />
  13. <link>https://waf-bypass.com</link>
  14. <description>How to test, evaluate, compare, and bypass web application and API security solutions like WAF, NGWAF, RASP, and WAAP</description>
  15. <lastBuildDate>Fri, 11 Apr 2025 06:00:03 +0000</lastBuildDate>
  16. <language>en-US</language>
  17. <sy:updatePeriod>
  18. hourly </sy:updatePeriod>
  19. <sy:updateFrequency>
  20. 1 </sy:updateFrequency>
  21. <generator>https://wordpress.org/?v=6.7.2</generator>
  22.  
  23. <image>
  24. <url>https://waf-bypass.com/wp-content/uploads/2021/11/cropped-favicon-1-1-32x32.png</url>
  25. <title>Web application firewalls bypasses collection and testing tools</title>
  26. <link>https://waf-bypass.com</link>
  27. <width>32</width>
  28. <height>32</height>
  29. </image>
  30. <item>
  31. <title>WAF bypass by GREENARM0R</title>
  32. <link>https://waf-bypass.com/2025/04/11/waf-bypass-by-greenarm0r/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-greenarm0r</link>
  33. <comments>https://waf-bypass.com/2025/04/11/waf-bypass-by-greenarm0r/#respond</comments>
  35. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  36. <pubDate>Fri, 11 Apr 2025 06:00:03 +0000</pubDate>
  37. <category><![CDATA[Uncategorized]]></category>
  38. <guid isPermaLink="false">http://waf-bypass.com/2025/04/11/waf-bypass-by-greenarm0r/</guid>
  39.  
  40. <description><![CDATA[The bypass tool enables bypassing security restrictions through HTTPS/TLS, making it easier to bypass IDS/IPS and WAF, as well as restrictions imposed on the firewall. Additionally, it supports SOCKS5 and TUN, with SOCKS5 being ideal for routing tools like proxychains, Burp Suite, or your browser through the tunnel. Check out the original tweet here: https://twitter.com/GREENARM0R/status/1910326158425473514]]></description>
  41. <content:encoded><![CDATA[<p>The bypass tool enables bypassing security restrictions through HTTPS/TLS, making it easier to bypass IDS/IPS and WAF, as well as restrictions imposed on the firewall. Additionally, it supports SOCKS5 and TUN, with SOCKS5 being ideal for routing tools like proxychains, Burp Suite, or your browser through the tunnel.<br />
  42. Check out the original tweet here: https://twitter.com/GREENARM0R/status/1910326158425473514</p>
  43. ]]></content:encoded>
  45. <wfw:commentRss>https://waf-bypass.com/2025/04/11/waf-bypass-by-greenarm0r/feed/</wfw:commentRss>
  46. <slash:comments>0</slash:comments>
  49. </item>
  50. <item>
  51. <title>WAF bypass by KirollosBotros1</title>
  52. <link>https://waf-bypass.com/2025/04/11/waf-bypass-by-kirollosbotros1/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-kirollosbotros1</link>
  53. <comments>https://waf-bypass.com/2025/04/11/waf-bypass-by-kirollosbotros1/#respond</comments>
  55. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  56. <pubDate>Fri, 11 Apr 2025 05:00:02 +0000</pubDate>
  57. <category><![CDATA[Uncategorized]]></category>
  58. <guid isPermaLink="false">http://waf-bypass.com/2025/04/11/waf-bypass-by-kirollosbotros1/</guid>
  59.  
  60. <description><![CDATA[The tweet suggests using SQLMap with the -tamper flag to bypass the WAF for bug bounty or penetration testing purposes. This technique is commonly used for SQL injection vulnerabilities. It is important to note that bypassing a WAF without proper authorization may be against ethical guidelines. It is recommended to report any vulnerabilities responsibly to [&#8230;]]]></description>
  61. <content:encoded><![CDATA[<p>The tweet suggests using SQLMap with the -tamper flag to bypass the WAF for bug bounty or penetration testing purposes. This technique is commonly used for SQL injection vulnerabilities. It is important to note that bypassing a WAF without proper authorization may be against ethical guidelines. It is recommended to report any vulnerabilities responsibly to the appropriate parties.<br />
  62. For more insights, check out the original tweet here: https://twitter.com/KirollosBotros1/status/1910499076178928105. And don’t forget to follow @KirollosBotros1 for more exciting updates in the world of cybersecurity.</p>
  63. ]]></content:encoded>
  65. <wfw:commentRss>https://waf-bypass.com/2025/04/11/waf-bypass-by-kirollosbotros1/feed/</wfw:commentRss>
  66. <slash:comments>0</slash:comments>
  69. </item>
  70. <item>
  71. <title>WAF bypass by AadityaPatil_</title>
  72. <link>https://waf-bypass.com/2025/04/10/waf-bypass-by-aadityapatil_/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-aadityapatil_</link>
  73. <comments>https://waf-bypass.com/2025/04/10/waf-bypass-by-aadityapatil_/#respond</comments>
  75. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  76. <pubDate>Thu, 10 Apr 2025 07:00:02 +0000</pubDate>
  77. <category><![CDATA[Uncategorized]]></category>
  78. <guid isPermaLink="false">http://waf-bypass.com/2025/04/10/waf-bypass-by-aadityapatil_/</guid>
  79.  
  80. <description><![CDATA[The user mentioned using Burp Suite MCP Server with Claude Desktop for WAF bypass testing. This combination proved to be effective in providing WAF bypass requests directly in Repeater without extra work. This toolset can be super helpful for quickly testing different payloads during pentesting activities. #CyberSecurity #BugBounty #WAFBypass Just tried out Burp Suite MCP [&#8230;]]]></description>
  81. <content:encoded><![CDATA[<p>The user mentioned using Burp Suite MCP Server with Claude Desktop for WAF bypass testing. This combination proved to be effective in providing WAF bypass requests directly in Repeater without extra work. This toolset can be super helpful for quickly testing different payloads during pentesting activities. #CyberSecurity #BugBounty #WAFBypass</p>
  82. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  83. <p lang="en" dir="ltr">Just tried out Burp Suite MCP Server with Claude Desktop today, and it worked really well. It gave me WAF bypass requests directly in Repeaterno extra work needed.<br />Super helpful for quickly testing different payloads during pentesting <a href="https://twitter.com/hashtag/CyberSecurity?src=hash&amp;ref_src=twsrc%5Etfw">#CyberSecurity</a> <a href="https://twitter.com/hashtag/BugBounty?src=hash&amp;ref_src=twsrc%5Etfw">#BugBounty</a> <a href="https://twitter.com/hashtag/BurpSuite?src=hash&amp;ref_src=twsrc%5Etfw">#BurpSuite</a> <a href="https://twitter.com/hashtag/Claude?src=hash&amp;ref_src=twsrc%5Etfw">#Claude</a></p>
  84. <p>&mdash; Aditya Patil (@AadityaPatil_) <a href="https://twitter.com/AadityaPatil_/status/1909901256681807955?ref_src=twsrc%5Etfw">April 9, 2025</a></p></blockquote>
  85. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  86. ]]></content:encoded>
  88. <wfw:commentRss>https://waf-bypass.com/2025/04/10/waf-bypass-by-aadityapatil_/feed/</wfw:commentRss>
  89. <slash:comments>0</slash:comments>
  92. </item>
  93. <item>
  94. <title>WAF bypass by Nicatabb</title>
  95. <link>https://waf-bypass.com/2025/04/10/waf-bypass-by-nicatabb/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-nicatabb</link>
  96. <comments>https://waf-bypass.com/2025/04/10/waf-bypass-by-nicatabb/#respond</comments>
  98. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  99. <pubDate>Thu, 10 Apr 2025 06:00:02 +0000</pubDate>
  100. <category><![CDATA[Uncategorized]]></category>
  101. <guid isPermaLink="false">http://waf-bypass.com/2025/04/10/waf-bypass-by-nicatabb/</guid>
  102.  
  103. <description><![CDATA[This is an XSS bypass for Imperva WAF. The payload used is &#039;&#38;gt;&#38;lt;input type=hidden oncontentvisibilityautostatechange=alert(1) style=content-visibility:auto&#38;gt;&#039;. Details of the bypass: The payload exploits the oncontentvisibilityautostatechange attribute to trigger an alert(1) function, allowing an attacker to execute arbitrary JavaScript code. For more technical details, visit the blog post. Check out the original tweet here: https://twitter.com/Nicatabb/status/1909959990778962096]]></description>
  104. <content:encoded><![CDATA[<p>This is an XSS bypass for Imperva WAF. The payload used is &#039;&amp;gt;&amp;lt;input type=hidden oncontentvisibilityautostatechange=alert(1) style=content-visibility:auto&amp;gt;&#039;. Details of the bypass: The payload exploits the oncontentvisibilityautostatechange attribute to trigger an alert(1) function, allowing an attacker to execute arbitrary JavaScript code. For more technical details, visit the blog post.<br />
  105. Check out the original tweet here: https://twitter.com/Nicatabb/status/1909959990778962096</p>
  106. ]]></content:encoded>
  108. <wfw:commentRss>https://waf-bypass.com/2025/04/10/waf-bypass-by-nicatabb/feed/</wfw:commentRss>
  109. <slash:comments>0</slash:comments>
  112. </item>
  113. <item>
  114. <title>WAF bypass by mossad_inside</title>
  115. <link>https://waf-bypass.com/2025/04/10/waf-bypass-by-mossad_inside/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-mossad_inside</link>
  116. <comments>https://waf-bypass.com/2025/04/10/waf-bypass-by-mossad_inside/#respond</comments>
  118. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  119. <pubDate>Thu, 10 Apr 2025 05:00:02 +0000</pubDate>
  120. <category><![CDATA[Uncategorized]]></category>
  121. <guid isPermaLink="false">http://waf-bypass.com/2025/04/10/waf-bypass-by-mossad_inside/</guid>
  122.  
  123. <description><![CDATA[The tweet mentions a successful bypass of the Bangladesh WAF using a curl command with proxy and SSL ignore options. It suggests hiring a UI developer for the website. A blog post can detail the process of the bypass, the implications for the security of the website, and recommendations for securing the WAF against such [&#8230;]]]></description>
  124. <content:encoded><![CDATA[<p>The tweet mentions a successful bypass of the Bangladesh WAF using a curl command with proxy and SSL ignore options. It suggests hiring a UI developer for the website. A blog post can detail the process of the bypass, the implications for the security of the website, and recommendations for securing the WAF against such bypasses.<br />
  125. For more insights, check out the original tweet here: https://twitter.com/mossad_inside/status/1910159504269865020</p>
  126. ]]></content:encoded>
  128. <wfw:commentRss>https://waf-bypass.com/2025/04/10/waf-bypass-by-mossad_inside/feed/</wfw:commentRss>
  129. <slash:comments>0</slash:comments>
  132. </item>
  133. <item>
  134. <title>WAF bypass by gillzzey</title>
  135. <link>https://waf-bypass.com/2025/04/09/waf-bypass-by-gillzzey/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-gillzzey</link>
  136. <comments>https://waf-bypass.com/2025/04/09/waf-bypass-by-gillzzey/#respond</comments>
  138. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  139. <pubDate>Wed, 09 Apr 2025 05:00:02 +0000</pubDate>
  140. <category><![CDATA[Uncategorized]]></category>
  141. <guid isPermaLink="false">http://waf-bypass.com/2025/04/09/waf-bypass-by-gillzzey/</guid>
  142.  
  143. <description><![CDATA[This tweet highlights multiple XSS vulnerabilities and bypass techniques, including PostMessage Source Check Bypass, Parameter Smuggling, WAF Bypass via Hash Tricks, hostname validation bypass using dot trailing, and UserWay XSS via QuerySelector Injection. These techniques can circumvent various web application firewalls. A detailed blog post with technical details is recommended. For more insights, check out [&#8230;]]]></description>
  144. <content:encoded><![CDATA[<p>This tweet highlights multiple XSS vulnerabilities and bypass techniques, including PostMessage Source Check Bypass, Parameter Smuggling, WAF Bypass via Hash Tricks, hostname validation bypass using dot trailing, and UserWay XSS via QuerySelector Injection. These techniques can circumvent various web application firewalls. A detailed blog post with technical details is recommended.<br />
  145. For more insights, check out the original tweet here: https://twitter.com/gillzzey/status/1909604181549498582. And don’t forget to follow @gillzzey for more exciting updates in the world of cybersecurity.</p>
  146. ]]></content:encoded>
  148. <wfw:commentRss>https://waf-bypass.com/2025/04/09/waf-bypass-by-gillzzey/feed/</wfw:commentRss>
  149. <slash:comments>0</slash:comments>
  152. </item>
  153. <item>
  154. <title>WAF bypass by nullret</title>
  155. <link>https://waf-bypass.com/2025/04/08/waf-bypass-by-nullret/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-nullret</link>
  156. <comments>https://waf-bypass.com/2025/04/08/waf-bypass-by-nullret/#respond</comments>
  158. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  159. <pubDate>Tue, 08 Apr 2025 05:00:02 +0000</pubDate>
  160. <category><![CDATA[Uncategorized]]></category>
  161. <guid isPermaLink="false">http://waf-bypass.com/2025/04/08/waf-bypass-by-nullret/</guid>
  162.  
  163. <description><![CDATA[The tweet mentions attempts to bypass Imperva WAF using encoded payloads, null bytes, case-swapping, and time-based delays. The user expresses frustration as the WAF remains resilient. This showcases the challenges faced in bypassing Imperva WAF&#039;s security measures. It would be interesting to explore the specific techniques used and the reasons for their failure in a [&#8230;]]]></description>
  164. <content:encoded><![CDATA[<p>The tweet mentions attempts to bypass Imperva WAF using encoded payloads, null bytes, case-swapping, and time-based delays. The user expresses frustration as the WAF remains resilient. This showcases the challenges faced in bypassing Imperva WAF&#039;s security measures. It would be interesting to explore the specific techniques used and the reasons for their failure in a blog post, highlighting the robustness of Imperva&#039;s security technology.<br />
  165. For more insights, check out the original tweet here: https://twitter.com/nullret/status/1909378176079614104. And don’t forget to follow @nullret for more exciting updates in the world of cybersecurity.</p>
  166. ]]></content:encoded>
  168. <wfw:commentRss>https://waf-bypass.com/2025/04/08/waf-bypass-by-nullret/feed/</wfw:commentRss>
  169. <slash:comments>0</slash:comments>
  172. </item>
  173. <item>
  174. <title>WAF bypass by Allan_K_R</title>
  175. <link>https://waf-bypass.com/2025/04/07/waf-bypass-by-allan_k_r/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-allan_k_r</link>
  176. <comments>https://waf-bypass.com/2025/04/07/waf-bypass-by-allan_k_r/#respond</comments>
  178. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  179. <pubDate>Mon, 07 Apr 2025 07:00:02 +0000</pubDate>
  180. <category><![CDATA[Uncategorized]]></category>
  181. <guid isPermaLink="false">http://waf-bypass.com/2025/04/07/waf-bypass-by-allan_k_r/</guid>
  182.  
  183. <description><![CDATA[The tweet suggests using rotating proxies on a VPN for WAF bypass. This approach can help in creating a large pool of IP addresses to evade WAF detection. Running the tool on a VPS can handle the huge workload efficiently. However, it&#039;s important to note that using rotating proxies for WAF bypass may have legal [&#8230;]]]></description>
  184. <content:encoded><![CDATA[<p>The tweet suggests using rotating proxies on a VPN for WAF bypass. This approach can help in creating a large pool of IP addresses to evade WAF detection. Running the tool on a VPS can handle the huge workload efficiently. However, it&#039;s important to note that using rotating proxies for WAF bypass may have legal and ethical implications, so use it responsibly.<br />
  185. For more details, check out the original tweet here: https://twitter.com/Allan_K_R/status/1908877834698842245</p>
  186. ]]></content:encoded>
  188. <wfw:commentRss>https://waf-bypass.com/2025/04/07/waf-bypass-by-allan_k_r/feed/</wfw:commentRss>
  189. <slash:comments>0</slash:comments>
  192. </item>
  193. <item>
  194. <title>WAF bypass by coffinxp7</title>
  195. <link>https://waf-bypass.com/2025/04/07/waf-bypass-by-coffinxp7-38/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-coffinxp7-38</link>
  196. <comments>https://waf-bypass.com/2025/04/07/waf-bypass-by-coffinxp7-38/#respond</comments>
  198. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  199. <pubDate>Mon, 07 Apr 2025 06:00:03 +0000</pubDate>
  200. <category><![CDATA[Uncategorized]]></category>
  201. <guid isPermaLink="false">http://waf-bypass.com/2025/04/07/waf-bypass-by-coffinxp7-38/</guid>
  202.  
  203. <description><![CDATA[Using a proxy with multiple IPs in every request can be a more effective option than using a VPN for WAF or rate limit bypass. This method allows for bypassing rate limits by sending requests from different IP addresses. Consider this approach for enhancing your bypass techniques. Check out the original tweet here: https://twitter.com/coffinxp7/status/1908878532324835382]]></description>
  204. <content:encoded><![CDATA[<p>Using a proxy with multiple IPs in every request can be a more effective option than using a VPN for WAF or rate limit bypass. This method allows for bypassing rate limits by sending requests from different IP addresses. Consider this approach for enhancing your bypass techniques.<br />
  205. Check out the original tweet here: https://twitter.com/coffinxp7/status/1908878532324835382</p>
  206. ]]></content:encoded>
  208. <wfw:commentRss>https://waf-bypass.com/2025/04/07/waf-bypass-by-coffinxp7-38/feed/</wfw:commentRss>
  209. <slash:comments>0</slash:comments>
  212. </item>
  213. <item>
  214. <title>WAF bypass by iampopg</title>
  215. <link>https://waf-bypass.com/2025/04/07/waf-bypass-by-iampopg-2/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-iampopg-2</link>
  216. <comments>https://waf-bypass.com/2025/04/07/waf-bypass-by-iampopg-2/#respond</comments>
  218. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  219. <pubDate>Mon, 07 Apr 2025 05:00:07 +0000</pubDate>
  220. <category><![CDATA[Uncategorized]]></category>
  221. <guid isPermaLink="false">http://waf-bypass.com/2025/04/07/waf-bypass-by-iampopg-2/</guid>
  222.  
  223. <description><![CDATA[The tweet mentions using &#039;Ghuari&#039; for WAF bypass. Ghuari could be a custom tool or payload used for bypassing Web Application Firewalls. It is important to conduct further analysis to understand its capabilities and effectiveness in bypassing different WAFs. For more insights, check out the original tweet here: https://twitter.com/iampopg/status/1908929279355675028]]></description>
  224. <content:encoded><![CDATA[<p>The tweet mentions using &#039;Ghuari&#039; for WAF bypass. Ghuari could be a custom tool or payload used for bypassing Web Application Firewalls. It is important to conduct further analysis to understand its capabilities and effectiveness in bypassing different WAFs.<br />
  225. For more insights, check out the original tweet here: https://twitter.com/iampopg/status/1908929279355675028</p>
  226. ]]></content:encoded>
  228. <wfw:commentRss>https://waf-bypass.com/2025/04/07/waf-bypass-by-iampopg-2/feed/</wfw:commentRss>
  229. <slash:comments>0</slash:comments>
  232. </item>
  233. <item>
  234. <title>WAF bypass by RoxyhunkPush</title>
  235. <link>https://waf-bypass.com/2025/04/06/waf-bypass-by-roxyhunkpush-7/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-roxyhunkpush-7</link>
  236. <comments>https://waf-bypass.com/2025/04/06/waf-bypass-by-roxyhunkpush-7/#respond</comments>
  238. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  239. <pubDate>Sun, 06 Apr 2025 07:00:02 +0000</pubDate>
  240. <category><![CDATA[Uncategorized]]></category>
  241. <guid isPermaLink="false">http://waf-bypass.com/2025/04/06/waf-bypass-by-roxyhunkpush-7/</guid>
  242.  
  243. <description><![CDATA[The tweet mentions collecting URLs with GF patterns, automating error-based SQL injection using nuclei templates, and manually analyzing databases. It also highlights that 90% of time-based SQL injections are not protected. The tweet concludes by stating that SQLi WAFs are easy to bypass. This tweet emphasizes the prevalence of SQL injection vulnerabilities and the effectiveness [&#8230;]]]></description>
  244. <content:encoded><![CDATA[<p>The tweet mentions collecting URLs with GF patterns, automating error-based SQL injection using nuclei templates, and manually analyzing databases. It also highlights that 90% of time-based SQL injections are not protected. The tweet concludes by stating that SQLi WAFs are easy to bypass. This tweet emphasizes the prevalence of SQL injection vulnerabilities and the effectiveness of blind boolean SQLi payloads in bypassing SQLi WAFs. This information can be used to raise awareness about the importance of securing against SQL injection attacks.<br />
  245. Original tweet: https://twitter.com/RoxyhunkPush/status/1908570190171808095</p>
  246. ]]></content:encoded>
  248. <wfw:commentRss>https://waf-bypass.com/2025/04/06/waf-bypass-by-roxyhunkpush-7/feed/</wfw:commentRss>
  249. <slash:comments>0</slash:comments>
  252. </item>
  253. <item>
  254. <title>WAF bypass by TheDarkSideOps</title>
  255. <link>https://waf-bypass.com/2025/04/06/waf-bypass-by-thedarksideops/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-thedarksideops</link>
  256. <comments>https://waf-bypass.com/2025/04/06/waf-bypass-by-thedarksideops/#respond</comments>
  258. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  259. <pubDate>Sun, 06 Apr 2025 06:00:02 +0000</pubDate>
  260. <category><![CDATA[Uncategorized]]></category>
  261. <guid isPermaLink="false">http://waf-bypass.com/2025/04/06/waf-bypass-by-thedarksideops/</guid>
  262.  
  263. <description><![CDATA[A vulnerability in the JSON processing of the backend system allows an attacker to bypass the WAF using unicode obfuscation. By injecting a malicious payload into the PUT request at /api/user/profile, the attacker can trigger a stored XSS attack on /dashboard/profile. This bypass technique exploits the trust placed on JSON fields by the backend system, [&#8230;]]]></description>
  264. <content:encoded><![CDATA[<p>A vulnerability in the JSON processing of the backend system allows an attacker to bypass the WAF using unicode obfuscation. By injecting a malicious payload into the PUT request at /api/user/profile, the attacker can trigger a stored XSS attack on /dashboard/profile. This bypass technique exploits the trust placed on JSON fields by the backend system, even though client-side sanitization is in place. The WAF evasion technique showcases the importance of thorough input validation and security measures to prevent such attacks.</p>
  265. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  266. <p lang="en" dir="ltr">Inject `{&quot;profile&quot;:{&quot;name&quot;:&quot;&lt;svg onload=alert(1)&gt;&quot;},&quot;email&quot;:&quot;x@x.com&quot;}` into PUT `/api/user/profile` where client-side sanitizes but backend trusts JSON fields. Bypass WAF using unicode obfuscation and trigger stored XSS on `/dashboard/profile`. <a href="https://twitter.com/hashtag/bugbounty?src=hash&amp;ref_src=twsrc%5Etfw">#bugbounty</a> <a href="https://twitter.com/hashtag/hacking?src=hash&amp;ref_src=twsrc%5Etfw">#hacking</a></p>
  267. <p>&mdash; Parth Patel (@TheDarkSideOps) <a href="https://twitter.com/TheDarkSideOps/status/1908570290461786320?ref_src=twsrc%5Etfw">April 5, 2025</a></p></blockquote>
  268. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  269. ]]></content:encoded>
  271. <wfw:commentRss>https://waf-bypass.com/2025/04/06/waf-bypass-by-thedarksideops/feed/</wfw:commentRss>
  272. <slash:comments>0</slash:comments>
  275. </item>
  276. <item>
  277. <title>WAF bypass by seke4l</title>
  278. <link>https://waf-bypass.com/2025/04/06/waf-bypass-by-seke4l-8/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-seke4l-8</link>
  279. <comments>https://waf-bypass.com/2025/04/06/waf-bypass-by-seke4l-8/#respond</comments>
  281. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  282. <pubDate>Sun, 06 Apr 2025 05:00:02 +0000</pubDate>
  283. <category><![CDATA[Uncategorized]]></category>
  284. <guid isPermaLink="false">http://waf-bypass.com/2025/04/06/waf-bypass-by-seke4l-8/</guid>
  285.  
  286. <description><![CDATA[A DOM XSS bypass was discovered affecting Akamai WAF. The bypass payload used was &#039;javascript:window[&#039;al&#039;+&#039;er&#039;+([&#039;t&#039;,&#039;b&#039;,&#039;c&#039;][0])](origin)&#039;. The attacker utilized the referer header to bypass the WAF and exploit the vulnerability by hosting the payload on their own server. This highlights a security weakness in the Akamai WAF that allows for DOM XSS attacks. #CyberSecurity #BugBounty #pentest [&#8230;]]]></description>
  287. <content:encoded><![CDATA[<p>A DOM XSS bypass was discovered affecting Akamai WAF. The bypass payload used was &#039;javascript:window[&#039;al&#039;+&#039;er&#039;+([&#039;t&#039;,&#039;b&#039;,&#039;c&#039;][0])](origin)&#039;. The attacker utilized the referer header to bypass the WAF and exploit the vulnerability by hosting the payload on their own server. This highlights a security weakness in the Akamai WAF that allows for DOM XSS attacks. #CyberSecurity #BugBounty #pentest</p>
  288. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  289. <p lang="en" dir="ltr">Always look everything: DOM XSS + Akamai Waf Bypass</p>
  290. <p>Payload: javascript:window[&#39;al&#39;+&#39;er&#39;+([&#39;t&#39;,&#39;b&#39;,&#39;c&#39;][0])](origin)</p>
  291. <p>The url can&#39;t open directly, due referer header, so was put a html for exploit to my own server.<a href="https://twitter.com/hashtag/CyberSecurity?src=hash&amp;ref_src=twsrc%5Etfw">#CyberSecurity</a> <a href="https://twitter.com/hashtag/BugBounty?src=hash&amp;ref_src=twsrc%5Etfw">#BugBounty</a> <a href="https://twitter.com/hashtag/pentest?src=hash&amp;ref_src=twsrc%5Etfw">#pentest</a> <a href="https://t.co/5Zbm41paDp">https://t.co/5Zbm41paDp</a></p>
  292. <p>&mdash; Seke4l (@seke4l) <a href="https://twitter.com/seke4l/status/1908596094260433240?ref_src=twsrc%5Etfw">April 5, 2025</a></p></blockquote>
  293. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  294. ]]></content:encoded>
  296. <wfw:commentRss>https://waf-bypass.com/2025/04/06/waf-bypass-by-seke4l-8/feed/</wfw:commentRss>
  297. <slash:comments>0</slash:comments>
  300. </item>
  301. <item>
  302. <title>WAF bypass by kobi_hk</title>
  303. <link>https://waf-bypass.com/2025/04/05/waf-bypass-by-kobi_hk/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-kobi_hk</link>
  304. <comments>https://waf-bypass.com/2025/04/05/waf-bypass-by-kobi_hk/#respond</comments>
  306. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  307. <pubDate>Sat, 05 Apr 2025 08:00:02 +0000</pubDate>
  308. <category><![CDATA[Uncategorized]]></category>
  309. <guid isPermaLink="false">http://waf-bypass.com/2025/04/05/waf-bypass-by-kobi_hk/</guid>
  310.  
  311. <description><![CDATA[A DOM XSS bypass was discovered for Akamai WAF. The payload used was &#039;javascript:window[&#039;al&#039;+&#039;er&#039;+([&#039;t&#039;,&#039;b&#039;,&#039;c&#039;][0])](origin)&#039;. Due to the referer header restriction, the URL cannot be opened directly, but an HTML exploit was used to send the payload to a server for exploitation. This bypass poses a serious security risk and highlights a vulnerability in Akamai WAF [&#8230;]]]></description>
  312. <content:encoded><![CDATA[<p>A DOM XSS bypass was discovered for Akamai WAF. The payload used was &#039;javascript:window[&#039;al&#039;+&#039;er&#039;+([&#039;t&#039;,&#039;b&#039;,&#039;c&#039;][0])](origin)&#039;. Due to the referer header restriction, the URL cannot be opened directly, but an HTML exploit was used to send the payload to a server for exploitation. This bypass poses a serious security risk and highlights a vulnerability in Akamai WAF that allows an attacker to execute arbitrary JavaScript code on the target website. Security measures need to be implemented to prevent such bypasses in the future.</p>
  313. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  314. <p lang="en" dir="ltr">DOM XSS + Akamai Waf Bypass??</p>
  315. <p>Payload: javascript:window[&#39;al&#39;+&#39;er&#39;+([&#39;t&#39;,&#39;b&#39;,&#39;c&#39;][0])](origin)</p>
  316. <p>The url can&#39;t open directly, due referer header, i put a html for exploit to my own server. <a href="https://t.co/z0skB2CJbE">pic.twitter.com/z0skB2CJbE</a></p>
  317. <p>&mdash; mobin (@kobi_hk) <a href="https://twitter.com/kobi_hk/status/1908090669727375459?ref_src=twsrc%5Etfw">April 4, 2025</a></p></blockquote>
  318. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  319. ]]></content:encoded>
  321. <wfw:commentRss>https://waf-bypass.com/2025/04/05/waf-bypass-by-kobi_hk/feed/</wfw:commentRss>
  322. <slash:comments>0</slash:comments>
  325. </item>
  326. <item>
  327. <title>WAF bypass by coffinxp7</title>
  328. <link>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-37/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-coffinxp7-37</link>
  329. <comments>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-37/#respond</comments>
  331. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  332. <pubDate>Sat, 05 Apr 2025 07:00:02 +0000</pubDate>
  333. <category><![CDATA[Uncategorized]]></category>
  334. <guid isPermaLink="false">http://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-37/</guid>
  335.  
  336. <description><![CDATA[The tweet discusses a WAF bypass using proxychains in SQLMap for SQL Injection vulnerabilities, specifically targeting Cloudflare and ModSecurity. The upcoming video will demonstrate a live bypass on these WAFs. This method is significant as it shows how attackers can circumvent security measures to exploit vulnerabilities. It&#039;s crucial for organizations to be aware of such [&#8230;]]]></description>
  337. <content:encoded><![CDATA[<p>The tweet discusses a WAF bypass using proxychains in SQLMap for SQL Injection vulnerabilities, specifically targeting Cloudflare and ModSecurity. The upcoming video will demonstrate a live bypass on these WAFs. This method is significant as it shows how attackers can circumvent security measures to exploit vulnerabilities. It&#039;s crucial for organizations to be aware of such bypass techniques to enhance their cybersecurity defenses.<br />
  338. For more details, check out the original tweet here: https://twitter.com/coffinxp7/status/1908097762069008716</p>
  339. ]]></content:encoded>
  341. <wfw:commentRss>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-37/feed/</wfw:commentRss>
  342. <slash:comments>0</slash:comments>
  345. </item>
  346. <item>
  347. <title>WAF bypass by R4yt3d</title>
  348. <link>https://waf-bypass.com/2025/04/05/waf-bypass-by-r4yt3d/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-r4yt3d</link>
  349. <comments>https://waf-bypass.com/2025/04/05/waf-bypass-by-r4yt3d/#respond</comments>
  351. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  352. <pubDate>Sat, 05 Apr 2025 06:00:02 +0000</pubDate>
  353. <category><![CDATA[Uncategorized]]></category>
  354. <guid isPermaLink="false">http://waf-bypass.com/2025/04/05/waf-bypass-by-r4yt3d/</guid>
  355.  
  356. <description><![CDATA[A React Router flaw has been identified that exposes web apps to cache poisoning and WAF bypass attacks. The vulnerability affects the React Router, making it susceptible to cache poisoning and bypassing Web Application Firewalls (WAFs). This bypass exploit can potentially enable attackers to evade WAF protections and carry out malicious activities. WAF administrators and [&#8230;]]]></description>
  357. <content:encoded><![CDATA[<p>A React Router flaw has been identified that exposes web apps to cache poisoning and WAF bypass attacks. The vulnerability affects the React Router, making it susceptible to cache poisoning and bypassing Web Application Firewalls (WAFs). This bypass exploit can potentially enable attackers to evade WAF protections and carry out malicious activities. WAF administrators and developers should be aware of this issue and take necessary steps to mitigate the risk. For more technical details, check out the blog post on this WAF bypass vulnerability.</p>
  358. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  359. <p lang="en" dir="ltr">Cyber Security news I found interesting:<br />React Router Flaw Exposes Web Apps to Cache Poisoning &amp; WAF Bypass Attacks <a href="https://t.co/elxt4hNivW">https://t.co/elxt4hNivW</a><a href="https://twitter.com/hashtag/R4yt3d?src=hash&amp;ref_src=twsrc%5Etfw">#R4yt3d</a></p>
  360. <p>&mdash; Ray (@R4yt3d) <a href="https://twitter.com/R4yt3d/status/1908105971949256882?ref_src=twsrc%5Etfw">April 4, 2025</a></p></blockquote>
  361. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  362. ]]></content:encoded>
  364. <wfw:commentRss>https://waf-bypass.com/2025/04/05/waf-bypass-by-r4yt3d/feed/</wfw:commentRss>
  365. <slash:comments>0</slash:comments>
  368. </item>
  369. <item>
  370. <title>WAF bypass by coffinxp7</title>
  371. <link>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-36/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-coffinxp7-36</link>
  372. <comments>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-36/#respond</comments>
  374. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  375. <pubDate>Sat, 05 Apr 2025 05:00:02 +0000</pubDate>
  376. <category><![CDATA[Uncategorized]]></category>
  377. <guid isPermaLink="false">http://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-36/</guid>
  378.  
  379. <description><![CDATA[The tweet mentions attempting to bypass a WAF that is blocking Akamai SQL Injections. The user expresses interest in trying a website in their free time for bypassing, ensuring it&#039;s not a false positive. This could lead to potential WAF evasion techniques that may be risky and unethical. More information is needed to provide a [&#8230;]]]></description>
  380. <content:encoded><![CDATA[<p>The tweet mentions attempting to bypass a WAF that is blocking Akamai SQL Injections. The user expresses interest in trying a website in their free time for bypassing, ensuring it&#039;s not a false positive. This could lead to potential WAF evasion techniques that may be risky and unethical. More information is needed to provide a detailed analysis.<br />
  381. For more insights, check out the original tweet here: https://twitter.com/coffinxp7/status/1908344232781165046. And don’t forget to follow @coffinxp7 for more exciting updates in the world of cybersecurity.</p>
  382. ]]></content:encoded>
  384. <wfw:commentRss>https://waf-bypass.com/2025/04/05/waf-bypass-by-coffinxp7-36/feed/</wfw:commentRss>
  385. <slash:comments>0</slash:comments>
  388. </item>
  389. <item>
  390. <title>WAF bypass by MachinaRecord</title>
  391. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-machinarecord/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-machinarecord</link>
  392. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-machinarecord/#respond</comments>
  394. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  395. <pubDate>Fri, 04 Apr 2025 11:00:02 +0000</pubDate>
  396. <category><![CDATA[Uncategorized]]></category>
  397. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-machinarecord/</guid>
  398.  
  399. <description><![CDATA[A vulnerability in React Router exposes web applications to cache poisoning and WAF bypass attacks. For more technical details, visit https://exampleblog.com/react-router-waf-bypass For more insights, check out the original tweet here: https://twitter.com/MachinaRecord/status/1907657510988976315]]></description>
  400. <content:encoded><![CDATA[<p>A vulnerability in React Router exposes web applications to cache poisoning and WAF bypass attacks. For more technical details, visit https://exampleblog.com/react-router-waf-bypass<br />
  401. For more insights, check out the original tweet here: https://twitter.com/MachinaRecord/status/1907657510988976315</p>
  402. ]]></content:encoded>
  404. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-machinarecord/feed/</wfw:commentRss>
  405. <slash:comments>0</slash:comments>
  408. </item>
  409. <item>
  410. <title>WAF bypass by zoomeye_team</title>
  411. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-zoomeye_team/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-zoomeye_team</link>
  412. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-zoomeye_team/#respond</comments>
  414. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  415. <pubDate>Fri, 04 Apr 2025 10:00:02 +0000</pubDate>
  416. <category><![CDATA[Uncategorized]]></category>
  417. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-zoomeye_team/</guid>
  418.  
  419. <description><![CDATA[A vulnerability CVE-2025-31137 in React Router is leaving Remix 2 and React Router 7 apps vulnerable to cache poisoning and WAF bypass attacks. Users running the Express adapter are at risk. For more technical details, visit: https://t.co/Ems1GIh4fL ??The vulnerability details are now available: https://t.co/Ems1GIh4fL ??CVE-2025-31137 (CVSS 7.5): React Router’s latest vuln is leaving Remix 2 [&#8230;]]]></description>
  420. <content:encoded><![CDATA[<p>A vulnerability CVE-2025-31137 in React Router is leaving Remix 2 and React Router 7 apps vulnerable to cache poisoning and WAF bypass attacks. Users running the Express adapter are at risk. For more technical details, visit: https://t.co/Ems1GIh4fL</p>
  421. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  422. <p lang="en" dir="ltr">??The vulnerability details are now available: <a href="https://t.co/Ems1GIh4fL">https://t.co/Ems1GIh4fL</a></p>
  423. <p>??CVE-2025-31137 (CVSS 7.5): React Router’s latest vuln is leaving Remix 2 &amp; React Router 7 apps WIDE OPEN to cache poisoning and WAF bypass attacks. If you’re running the Express adapter, you’re in the… <a href="https://t.co/w9C3GIVm83">https://t.co/w9C3GIVm83</a> <a href="https://t.co/hBSmxSN9A2">pic.twitter.com/hBSmxSN9A2</a></p>
  424. <p>&mdash; ZoomEye (@zoomeye_team) <a href="https://twitter.com/zoomeye_team/status/1907711011840569695?ref_src=twsrc%5Etfw">April 3, 2025</a></p></blockquote>
  425. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  426. ]]></content:encoded>
  428. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-zoomeye_team/feed/</wfw:commentRss>
  429. <slash:comments>0</slash:comments>
  432. </item>
  433. <item>
  434. <title>WAF bypass by Vecoyenka</title>
  435. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka-2/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-vecoyenka-2</link>
  436. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka-2/#respond</comments>
  438. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  439. <pubDate>Fri, 04 Apr 2025 09:00:03 +0000</pubDate>
  440. <category><![CDATA[Uncategorized]]></category>
  441. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka-2/</guid>
  442.  
  443. <description><![CDATA[The tweet suggests studying the triggers for the 403 error and experimenting with encoding techniques to bypass the WAF. This approach indicates an attempt to evade the WAF&#039;s security mechanisms by manipulating the request data. It is important to understand the vulnerabilities and weaknesses in the WAF&#039;s configuration to effectively bypass it. Further analysis and [&#8230;]]]></description>
  444. <content:encoded><![CDATA[<p>The tweet suggests studying the triggers for the 403 error and experimenting with encoding techniques to bypass the WAF. This approach indicates an attempt to evade the WAF&#039;s security mechanisms by manipulating the request data. It is important to understand the vulnerabilities and weaknesses in the WAF&#039;s configuration to effectively bypass it. Further analysis and testing are necessary to identify the specific bypass technique used in this scenario.<br />
  445. For more details, check out the original tweet here: https://twitter.com/Vecoyenka/status/1907825513294422031</p>
  446. ]]></content:encoded>
  448. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka-2/feed/</wfw:commentRss>
  449. <slash:comments>0</slash:comments>
  452. </item>
  453. <item>
  454. <title>WAF bypass by cyb3rf034r3ss</title>
  455. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyb3rf034r3ss-4/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-cyb3rf034r3ss-4</link>
  456. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyb3rf034r3ss-4/#respond</comments>
  458. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  459. <pubDate>Fri, 04 Apr 2025 08:00:02 +0000</pubDate>
  460. <category><![CDATA[Uncategorized]]></category>
  461. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-cyb3rf034r3ss-4/</guid>
  462.  
  463. <description><![CDATA[AkamaiGhost WAF is known for being too strict, making it difficult to bypass. Users have expressed frustration with its strict rules on security. If you have any guides or proof of concepts on how to bypass AkamaiGhost WAF, please share them to help others navigate through its restrictions. For more insights, check out the original [&#8230;]]]></description>
  464. <content:encoded><![CDATA[<p>AkamaiGhost WAF is known for being too strict, making it difficult to bypass. Users have expressed frustration with its strict rules on security. If you have any guides or proof of concepts on how to bypass AkamaiGhost WAF, please share them to help others navigate through its restrictions.<br />
  465. For more insights, check out the original tweet here: https://twitter.com/cyb3rf034r3ss/status/1907839005971952078</p>
  466. ]]></content:encoded>
  468. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyb3rf034r3ss-4/feed/</wfw:commentRss>
  469. <slash:comments>0</slash:comments>
  472. </item>
  473. <item>
  474. <title>WAF bypass by Vecoyenka</title>
  475. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-vecoyenka</link>
  476. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka/#respond</comments>
  478. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  479. <pubDate>Fri, 04 Apr 2025 07:00:02 +0000</pubDate>
  480. <category><![CDATA[Uncategorized]]></category>
  481. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka/</guid>
  482.  
  483. <description><![CDATA[A new XSS bypass was discovered affecting AWS WAF. The payload &#60;script&#62;alert(1)&#60;/script&#62; was successfully used to bypass the protection. Detailed technical information can be found in the blogpost. For more insights, check out the original tweet here: https://twitter.com/Vecoyenka/status/1907840135921631240. And don’t forget to follow @Vecoyenka for more exciting updates in the world of cybersecurity.]]></description>
  484. <content:encoded><![CDATA[<p>A new XSS bypass was discovered affecting AWS WAF. The payload &lt;script&gt;alert(1)&lt;/script&gt; was successfully used to bypass the protection. Detailed technical information can be found in the blogpost.<br />
  485. For more insights, check out the original tweet here: https://twitter.com/Vecoyenka/status/1907840135921631240. And don’t forget to follow @Vecoyenka for more exciting updates in the world of cybersecurity.</p>
  486. ]]></content:encoded>
  488. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-vecoyenka/feed/</wfw:commentRss>
  489. <slash:comments>0</slash:comments>
  492. </item>
  493. <item>
  494. <title>WAF bypass by cyberartisan_</title>
  495. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyberartisan_-2/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-cyberartisan_-2</link>
  496. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyberartisan_-2/#respond</comments>
  498. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  499. <pubDate>Fri, 04 Apr 2025 06:00:02 +0000</pubDate>
  500. <category><![CDATA[Uncategorized]]></category>
  501. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-cyberartisan_-2/</guid>
  502.  
  503. <description><![CDATA[WAFs may catch basic Host Header attacks, but often miss SSRF, cache poisoning, or auth bypass. Proper server-side validation is key—don’t rely on WAF alone. #WebSecurity #BugBounty #CyberSecurity Original tweet: https://twitter.com/cyberartisan_/status/1907880360416858414]]></description>
  504. <content:encoded><![CDATA[<p>WAFs may catch basic Host Header attacks, but often miss SSRF, cache poisoning, or auth bypass. Proper server-side validation is key—don’t rely on WAF alone. #WebSecurity #BugBounty #CyberSecurity<br />
  505. Original tweet: https://twitter.com/cyberartisan_/status/1907880360416858414</p>
  506. ]]></content:encoded>
  508. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-cyberartisan_-2/feed/</wfw:commentRss>
  509. <slash:comments>0</slash:comments>
  512. </item>
  513. <item>
  514. <title>WAF bypass by securityLab_jp</title>
  515. <link>https://waf-bypass.com/2025/04/04/waf-bypass-by-securitylab_jp/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-securitylab_jp</link>
  516. <comments>https://waf-bypass.com/2025/04/04/waf-bypass-by-securitylab_jp/#respond</comments>
  518. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  519. <pubDate>Fri, 04 Apr 2025 05:00:04 +0000</pubDate>
  520. <category><![CDATA[Uncategorized]]></category>
  521. <guid isPermaLink="false">http://waf-bypass.com/2025/04/04/waf-bypass-by-securitylab_jp/</guid>
  522.  
  523. <description><![CDATA[This tweet mentions a vulnerability in React Router (CVE-2025-31137) that can be exploited for cache poisoning and WAF bypass attacks. The specific details of the bypass are not provided in the tweet. It is important to analyze the vulnerability further and take necessary security measures to protect against potential attacks. #Security #WAFBypass For more details, [&#8230;]]]></description>
  524. <content:encoded><![CDATA[<p>This tweet mentions a vulnerability in React Router (CVE-2025-31137) that can be exploited for cache poisoning and WAF bypass attacks. The specific details of the bypass are not provided in the tweet. It is important to analyze the vulnerability further and take necessary security measures to protect against potential attacks. #Security #WAFBypass<br />
  525. For more details, check out the original tweet here: https://twitter.com/securityLab_jp/status/1907950003341111354</p>
  526. ]]></content:encoded>
  528. <wfw:commentRss>https://waf-bypass.com/2025/04/04/waf-bypass-by-securitylab_jp/feed/</wfw:commentRss>
  529. <slash:comments>0</slash:comments>
  532. </item>
  533. <item>
  534. <title>WAF bypass by _doesnotcompute</title>
  535. <link>https://waf-bypass.com/2025/04/03/waf-bypass-by-_doesnotcompute/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-_doesnotcompute</link>
  536. <comments>https://waf-bypass.com/2025/04/03/waf-bypass-by-_doesnotcompute/#respond</comments>
  538. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  539. <pubDate>Thu, 03 Apr 2025 07:00:02 +0000</pubDate>
  540. <category><![CDATA[Uncategorized]]></category>
  541. <guid isPermaLink="false">http://waf-bypass.com/2025/04/03/waf-bypass-by-_doesnotcompute/</guid>
  542.  
  543. <description><![CDATA[When bypassing a WAF, trying different event handlers can be effective. In this case, attempting &#34;ontest&#34; can reveal if the WAF block starts with &#039;on&#039;. If unsuccessful, further evasion techniques may be necessary. For more insights, check out the original tweet here: https://twitter.com/_doesnotcompute/status/1907528172897185899. And don’t forget to follow @_doesnotcompute for more exciting updates in the [&#8230;]]]></description>
  544. <content:encoded><![CDATA[<p>When bypassing a WAF, trying different event handlers can be effective. In this case, attempting &quot;ontest&quot; can reveal if the WAF block starts with &#039;on&#039;. If unsuccessful, further evasion techniques may be necessary.<br />
  545. For more insights, check out the original tweet here: https://twitter.com/_doesnotcompute/status/1907528172897185899. And don’t forget to follow @_doesnotcompute for more exciting updates in the world of cybersecurity.</p>
  546. ]]></content:encoded>
  548. <wfw:commentRss>https://waf-bypass.com/2025/04/03/waf-bypass-by-_doesnotcompute/feed/</wfw:commentRss>
  549. <slash:comments>0</slash:comments>
  552. </item>
  553. <item>
  554. <title>WAF bypass by the_yellow_fall</title>
  555. <link>https://waf-bypass.com/2025/04/03/waf-bypass-by-the_yellow_fall-4/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-the_yellow_fall-4</link>
  556. <comments>https://waf-bypass.com/2025/04/03/waf-bypass-by-the_yellow_fall-4/#respond</comments>
  558. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  559. <pubDate>Thu, 03 Apr 2025 06:00:02 +0000</pubDate>
  560. <category><![CDATA[Uncategorized]]></category>
  561. <guid isPermaLink="false">http://waf-bypass.com/2025/04/03/waf-bypass-by-the_yellow_fall-4/</guid>
  562.  
  563. <description><![CDATA[A newly discovered flaw, CVE-2025-31137, has been identified in React Router, a popular library used for managing routing in React applications. React Router is a widely used library with over 13.2 million weekly downloads. Stay updated with security patches and updates from the React Router team to mitigate any potential risks. A newly discovered flaw, [&#8230;]]]></description>
  564. <content:encoded><![CDATA[<p>A newly discovered flaw, CVE-2025-31137, has been identified in React Router, a popular library used for managing routing in React applications. React Router is a widely used library with over 13.2 million weekly downloads. Stay updated with security patches and updates from the React Router team to mitigate any potential risks.</p>
  565. <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
  566. <p lang="en" dir="ltr">A newly discovered flaw, CVE-2025-31137, has been identified in React Router, a popular library used for managing routing in React applications</p>
  567. <p>React Router is a widely used library, with one report stating it has over 13.2 million weekly downloads<a href="https://t.co/ODjeOlgdm6">https://t.co/ODjeOlgdm6</a></p>
  568. <p>&mdash; Gray Hats (@the_yellow_fall) <a href="https://twitter.com/the_yellow_fall/status/1907612557445312618?ref_src=twsrc%5Etfw">April 3, 2025</a></p></blockquote>
  569. <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
  570. ]]></content:encoded>
  572. <wfw:commentRss>https://waf-bypass.com/2025/04/03/waf-bypass-by-the_yellow_fall-4/feed/</wfw:commentRss>
  573. <slash:comments>0</slash:comments>
  576. </item>
  577. <item>
  578. <title>WAF bypass by HunterMapping</title>
  579. <link>https://waf-bypass.com/2025/04/03/waf-bypass-by-huntermapping/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-huntermapping</link>
  580. <comments>https://waf-bypass.com/2025/04/03/waf-bypass-by-huntermapping/#respond</comments>
  582. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  583. <pubDate>Thu, 03 Apr 2025 05:00:03 +0000</pubDate>
  584. <category><![CDATA[Uncategorized]]></category>
  585. <guid isPermaLink="false">http://waf-bypass.com/2025/04/03/waf-bypass-by-huntermapping/</guid>
  586.  
  587. <description><![CDATA[A vulnerability (CVE-2025-31137) in React Router exposes web apps to cache poisoning and WAF bypass attacks. This can impact 11K+ services yearly. Detailed analysis by @zhero___ &#38; @inzo____. Learn more at the provided link. #Security #Cybersecurity For more insights, check out the original tweet here: https://twitter.com/HunterMapping/status/1907637252509041071. And don’t forget to follow @HunterMapping for more exciting [&#8230;]]]></description>
  588. <content:encoded><![CDATA[<p>A vulnerability (CVE-2025-31137) in React Router exposes web apps to cache poisoning and WAF bypass attacks. This can impact 11K+ services yearly. Detailed analysis by @zhero___ &amp; @inzo____. Learn more at the provided link. #Security #Cybersecurity<br />
  589. For more insights, check out the original tweet here: https://twitter.com/HunterMapping/status/1907637252509041071. And don’t forget to follow @HunterMapping for more exciting updates in the world of cybersecurity.</p>
  590. ]]></content:encoded>
  592. <wfw:commentRss>https://waf-bypass.com/2025/04/03/waf-bypass-by-huntermapping/feed/</wfw:commentRss>
  593. <slash:comments>0</slash:comments>
  596. </item>
  597. <item>
  598. <title>WAF bypass by thelilnix</title>
  599. <link>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix-2/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-thelilnix-2</link>
  600. <comments>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix-2/#respond</comments>
  602. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  603. <pubDate>Wed, 02 Apr 2025 07:00:02 +0000</pubDate>
  604. <category><![CDATA[Uncategorized]]></category>
  605. <guid isPermaLink="false">http://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix-2/</guid>
  606.  
  607. <description><![CDATA[The tweet contains an XSS payload used to bypass Akamai WAF. The payload includes JavaScript code for executing an alert function. The payload manipulates the content-visibility property to trigger the XSS. This bypass can potentially be used to execute malicious scripts on the target site. More details can be found in the tweet. #bugbountytips #bugbounty [&#8230;]]]></description>
  608. <content:encoded><![CDATA[<p>The tweet contains an XSS payload used to bypass Akamai WAF. The payload includes JavaScript code for executing an alert function. The payload manipulates the content-visibility property to trigger the XSS. This bypass can potentially be used to execute malicious scripts on the target site. More details can be found in the tweet. #bugbountytips #bugbounty #lil_tips<br />
  609. Check out the original tweet here: https://twitter.com/thelilnix/status/1907183547804438809</p>
  610. ]]></content:encoded>
  612. <wfw:commentRss>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix-2/feed/</wfw:commentRss>
  613. <slash:comments>0</slash:comments>
  616. </item>
  617. <item>
  618. <title>WAF bypass by thelilnix</title>
  619. <link>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-thelilnix</link>
  620. <comments>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix/#respond</comments>
  622. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  623. <pubDate>Wed, 02 Apr 2025 06:00:02 +0000</pubDate>
  624. <category><![CDATA[Uncategorized]]></category>
  625. <guid isPermaLink="false">http://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix/</guid>
  626.  
  627. <description><![CDATA[The tweet highlights a WAF bypass technique for Akamai WAF involving the parsing of unicode and escaped characters. By manually fuzzing the web application, the user discovered that the application is parsing these characters differently from the WAF, leading to a potential bypass. This mismatch in parsing can be exploited to bypass the WAF&#039;s protection. [&#8230;]]]></description>
  628. <content:encoded><![CDATA[<p>The tweet highlights a WAF bypass technique for Akamai WAF involving the parsing of unicode and escaped characters. By manually fuzzing the web application, the user discovered that the application is parsing these characters differently from the WAF, leading to a potential bypass. This mismatch in parsing can be exploited to bypass the WAF&#039;s protection. Further details on the specific payloads used and the technical implications can be found in the tweet.<br />
  629. For more insights, check out the original tweet here: https://twitter.com/thelilnix/status/1907183554884473264. And don’t forget to follow @thelilnix for more exciting updates in the world of cybersecurity.</p>
  630. ]]></content:encoded>
  632. <wfw:commentRss>https://waf-bypass.com/2025/04/02/waf-bypass-by-thelilnix/feed/</wfw:commentRss>
  633. <slash:comments>0</slash:comments>
  636. </item>
  637. <item>
  638. <title>WAF bypass by JosephKanko4</title>
  639. <link>https://waf-bypass.com/2025/04/02/waf-bypass-by-josephkanko4/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=waf-bypass-by-josephkanko4</link>
  640. <comments>https://waf-bypass.com/2025/04/02/waf-bypass-by-josephkanko4/#respond</comments>
  642. <dc:creator><![CDATA[wafbypass]]></dc:creator>
  643. <pubDate>Wed, 02 Apr 2025 05:00:02 +0000</pubDate>
  644. <category><![CDATA[Uncategorized]]></category>
  645. <guid isPermaLink="false">http://waf-bypass.com/2025/04/02/waf-bypass-by-josephkanko4/</guid>
  646.  
  647. <description><![CDATA[The tweet discusses a bypass for Cloudflare WAF to access the origin server while avoiding WAF protection. The bypass method allows circumventing Cloudflare&#039;s WAF and reaching the origin server directly. A detailed blog post should be created covering the product, Cloudflare, the type of bypass used, and the technical details of how the bypass works. [&#8230;]]]></description>
  648. <content:encoded><![CDATA[<p>The tweet discusses a bypass for Cloudflare WAF to access the origin server while avoiding WAF protection. The bypass method allows circumventing Cloudflare&#039;s WAF and reaching the origin server directly. A detailed blog post should be created covering the product, Cloudflare, the type of bypass used, and the technical details of how the bypass works.<br />
  649. For more details, check out the original tweet here: https://twitter.com/JosephKanko4/status/1907193346797265282</p>
  650. ]]></content:encoded>
  652. <wfw:commentRss>https://waf-bypass.com/2025/04/02/waf-bypass-by-josephkanko4/feed/</wfw:commentRss>
  653. <slash:comments>0</slash:comments>
  656. </item>
  657. </channel>
  658. </rss>
  659.  

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

  1. Download the "valid RSS" banner.

  2. Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)

  3. Add this HTML to your page (change the image src attribute if necessary):

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=https%3A//waf-bypass.com/feed/

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda