Seclists/Fuzzing

.

Fuzz-DB/Attack

Dictionary of attack patterns and primitives for black-box application testing Polyglot Challenge with submitted solutions

Other Payloads

Collection of web attack payloads

Standard:

Obfuscated: http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\

Standard:

union select 1,2,3 Standard: http://test.com/test?id=1%09union%23%0A%0Dselect%2D%2D%0A%0D1,2,3

Sample Payload: 1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS Sample Query URL:

JSFuck

JJEncode

XChars.JS

SQLi Bypass

by @enkaskal

XSS Bypass

by @kmkz

XSS Bypass

by [Daniele Linguaglossa]

Barracuda WAF 8.0.1 - Remote Command Execution (Metasploit)

by @xort

Barracuda Spam & Virus Firewall 5.1.3 - Remote Command Execution (Metasploit)

by @xort

generic_api_call.pl XSS

by @NNPoster

XSS Bypass

by @@SalahHasoneh1

XSS Bypass

by @c0d3g33k

XSS Bypasses

by @Bohdan Korzhynskyi

XSS Bypass

by @RakeshMane10

XSS Bypass

by @ArbazKiraak

XSS Bypass

by @Shiva Krishna

XSS Bypass

by @Brute Logic

XSS Bypass

by @RenwaX23 (Chrome only)

RCE Payload Detection Bypass

by @theMiddle

XSS Bypass

by @0xInfection

report_type XSS

by @NNPoster

XSS Bypass for CRS 3.2

by @brutelogic

RCE Payload Detection Bypass

by @theMiddle

RCE Payloads for PL1 and PL2

by @theMiddle (v3.0)

SQLi Bypass

by @Johannes Dahse (v2.2)

XSS Bypass

by @smaury92

XSS Bypass

by @0xInfection

XSS Bypass

by @0xInfection

XSS Bypass

by @0xInfection

XSS Bypass

by @ugurercan

Imperva SecureSphere 13 - Remote Command Execution

by @rsp3ar

Imperva SecureSphere <= v13 - Privilege Escalation

by @0x09AL

XSS Bypass

by @SaadAhmed

XSS Bypass

by @h1_kenan

HTML Injection

by @sp1d3rs

XSS Bypass

by @Jonathan Bouman

XSS Bypass

by @zseano

XSS Bypass

by @Frans Rosén

XSS Bypass

by @Ishaq Mohammed

GET Type CSRF Attack

by @Michael Brooks (>= v.2.6.2)

XSS Bypass

by @EnableSecurity (>= v2.4)

XSS Bypass for CRS 3.2

by @brutelogic

RCE Payloads for PL1 and PL2

by @theMiddle (v3.0)

Obfuscating RCE Payloads

by @theMiddle

XSS Bypass

by @Luka

XSS Bypass

by @Brute Logic

XSS Bypass

by @0xInfection

Bypassing All Protections Using A Whitelist String

by @Osanda Malith; XSS PoC; LFI PoC; SQLi PoC

HTML Injection

by @Voxel

XSS Exploit

by @MustLive (>= v3.3.5)

Other XSS Bypasses

WAFW00F

The ultimate WAF fingerprinting tool with the largest fingerprint database from @EnableSecurity.

IdentYwaf

A blind WAF detection tool which utlises a unique method of identifying WAFs based upon previously collected fingerprints by @stamparm.

GoTestWAF

A tool to test a WAF's detection logic and bypasses from @wallarm.

Lightbulb Framework

A WAF testing suite written in Python.

WAFBench

A WAF performance testing suite by Microsoft.

WAF Testing Framework

A WAF testing tool by Imperva.

Framework for Testing WAFs (FTW)

A framework by the OWASP CRS team that helps to provide rigorous tests for WAF rules by using the OWASP Core Ruleset V3 as a baseline.

WAFtester

A WAF security testing CLI that fingerprints 197+ WAF vendors, benchmarks rule coverage with quantitative scoring (F1/MCC), and automates bypass discovery with 70+ evasion techniques. Supports SARIF, SonarQube, and GitLab SAST output for CI/CD integration.

WAFNinja

A smart tool which fuzzes and can suggest bypasses for a given WAF by @khalilbijjou.

WAFTester

Another tool which can obfuscate payloads to bypass WAFs by @Raz0r.

libinjection-fuzzer

A fuzzer intended for finding libinjection bypasses but can be probably used universally.

bypass-firewalls-by-DNS-history

A tool which searches for old DNS records for finding actual site behind the WAF.

abuse-ssl-bypass-waf

A tool which finds out supported SSL/TLS ciphers and helps in evading WAFs.

SQLMap Tamper Scripts

Tamper scripts in SQLMap obfuscate payloads which might evade some WAFs.

Bypass WAF BurpSuite Plugin

A plugin for Burp Suite which adds some request headers so that the requests seem from the internal network.

enumXFF

Eumerating IPs in X-Forwarded-Headers to bypass 403 restrictions

WAF Bypass Tool

WAF bypass Tool from Nemesida is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads.

nowafpls

Burp Plugin to Bypass WAFs through the insertion of Junk Data.

impersonate-proxy

A local MITM proxy that spoofs TLS (JA3/JA4), HTTP/2, and header fingerprints per connection to test WAF bot-detection, with a Chrome extension for live profile switching, by @ytkoka.

AWS Firewall Factory

Deploy, update, and stage your WAFs while managing them centrally via FMS.

RCE Payloads for PL1 and PL2

by @theMiddle (v3.0)

Obfuscating RCE Payloads

by @theMiddle

RCE Payload Detection Bypass

by @theMiddle

How To Exploit PHP Remotely To Bypass Filters & WAF Rules

By @Secjuice

SQLi Bypass

by @Johannes Dahse (v2.2)

XXE that can Bypass WAF

By @WallArm.

SQL Injection Bypassing WAF

By @OWASP.

How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing

By @SunnyHoi.

Bypassing Web-Application Firewalls by abusing SSL/TLS

By @0x09AL.

Request Encoding to Bypass WAFs

By @Soroush Dalili

WAF Bypass Techniques Using HTTP Standard and Web Servers Behavior

from @OWASP.

Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls

from BlackHat USA 12.

Web Application Firewall - Analysis of Detection Logic

from BlackHat.

Bypassing Browser Security Policies for Fun & Profit

from BlackHat.

Web Application Firewall Bypassing

from Positive Technologies.

Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks

from @UseNix.

Evading Deep Inspection Systems for Fun and Shell

from BlackHat US 13.

Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload)

from Fools of Security.

WAFs FTW! A modern devops approach to security testing your WAF

from AppSec USA 17.

Web Application Firewall Bypassing WorkShop

from OWASP.

Bypassing Modern WAF's Exemplified At XSS by Rafay Baloch

from Rafay Bloch.

WTF - WAF Testing Framework

from AppSecUSA 13.

The Death of a Web App Firewall

from Brian McHenry.

Adventures with the WAF

from BSides Manchester.

Bypassing Intrusion Detection Systems

from BlackHat.

Building Your Own WAF as a Service and Forgetting about False Positives

from Auscert.