--- type: Whitepaper title: New Evasions for Web Application Firewalls description: A test of the cross-site scripting rule sets of eight web application firewalls, among them F5 Big-IP, Imperva Incapsula, WebKnight, PHP-IDS, ModSecurity, Sucuri, QuickDefense and Barracuda. Every product was evaded with crafted XSS payloads, showing that filtering in front of an application does not substitute for fixing the underlying flaw. resource: "https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf" tags: [whitepaper, webseclist-reference, waf-bypass, xss, filter-bypass, sanitizer-bypass, waf, http, measurement-study, case-study, owasp-a03-2021, owasp-a05-2021] generated: by: webseclist-refs/1 at: "2026-08-09T10:09:03+00:00" status: deprecated stale_after: 2027-08-09 sources: - id: original resource: "https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf" title: New Evasions for Web Application Firewalls author: Mazin Ahmed - id: capture resource: "https://web.archive.org/web/20150914101711/https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf" also_at: [] authors: - Mazin Ahmed canonical_url: "" cited_by: - "2015.md:38" commit: "" content_sha256: e94e75ea169300ec3b024d3b05804144e8a0d36cba3015d1f951a044cff7cf12 depth: full depth_reason: default kind: whitepaper language: "" licence: unknown original_url: "https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf" published: "" publisher: "" publisher_english: "" raw_sha256: c38f62eb042bf845f286dc56c557e0a4422de464a3d9658b8fd2d013a1a708c2 retrieved_from: "https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf" retrieved_kind: stored retrieved_utc: "2026-08-09T10:09:03+00:00" slug: new-evasions-web-application-firewalls snapshot: 20150914101711 title_english: "" translation_file: "" translation_of: "" --- # New Evasions for Web Application Firewalls **New Evasions for Web Application Firewalls** - Mazin Ahmed, Publisher not stated. - Published: date not stated - Original: - Preserved from: https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf (stored) on 2026-08-09 - Capture timestamp: 20150914101711 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. # New Evasions for Web Application Firewalls --- page 1 --- D D ouble UDbRRDLoE n bccRedbieg D +eHoLbRRTDMTTD+eRioH T D D D D Tocio(EoH D ArBw D (bse D b)(olD JD (bse S (bse b)(ol- oi D JD S (bso BFr D D --- page 2 --- Doublel l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l i*KPaDyhDdy1,a1,2 D D Doubl eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee eeeeeeeeeeee URLeEncdLi e bK2,3*0, D o D e1,3y~t0,xy1 D o D ia2,x1fDo1.x3y1va1, D u D c3y~t0,2 D b D Ha2tP,2 D l D ua1~y3DHa2Gy12a2 D e D dy10Pt2xy1 D el D b0C1ymPa~fava1,2 D eU D Haha3a10a2 D eU D D D --- page 3 --- Doublel l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l B-DbK2,3*0, D RLEDncDndEDig+HETMig(D LMED cADrEB w s))Ji+TnicgDSiHE-TJJMFD*D +cgKL+nEKDTDHEMETH+dDcg D TJJD-EJJ w Pgc-gDrEB w s))Ji+TnicgDSiHE-TJJMDncD+dE+PD ndEiH D EAAi+iEg+aD ig D )HcnE+nig(DT(TigMnD+HcMM w MinEDM+Hi)nig(D TnnT+PMyDhdED 1cni,EDBEdigKDndiMDHEMETH+d D -TMDncD+cgAiH1DndTnDndEHE D iM D gcDEAAE+ni,ED-TaDncD)HcnE+nD T(TigMnDTD,LJgEHTBiJinaDcndEHDndTgDAi2ig(DinMDHccnD+TLMEyD D hdEDnEMnMD-EHED+cgKL+nEKD T(TigMnD)c)LJTHDrEB w s))Ji+TnicgDS iHE-TJJMFDML+dDTMDSb D 3i(D*0FD*1)EH,T D *g+T)MLJTFDs~htxf*.DrEBvgi(dnFD0G0 w *RCFDmcK w CE+LHinaFDCL+LHiFD~Li+PREAEg MEFD3THHT+LKTDrsSFDTgKD ndEaD-EHEDTJJDE,TKEKD-indigDndEDHEMETH+dy D D A-De1,3y~t0,xy1 D sD-EBDT))Ji+TnicgDAiHE-TJJDOrsSzDiMDTgDT))JiTg+EFDMEH,EHD)JL(igFDcH D AiJnEHDndTnDT))JiEMDTDMEnDcAD HLJEMDncDTg D Ghh0D+cg,EHMTnicgyDpMLTJJaFDndc M E D HLJEMD)HcnE+nDT(TigMnD+c11cgDndHETnMFDML+dDTMD+HcMM w MinED M+Hi)nig(DO.CCzFDC~&DigIE+nicgDOC~&*zFDTgKDcndEHD+c11cgD-EB w T))Ji+TnicgDHEJTnEKD,LJgEHTBiJiniEMyD*gD1aD nEMnMFD*DAc+LMEKDcgD AigKig(D1EndcKMDncDBa)TMMDrsSMD)HcnE+nicgDT(TigMnD+HcMM w MinEDM+Hi)nig(D ,LJgEHTBiJiniEMy D N ;HcMM w CinEDC+Hi)nig(DO.CCzDTnnT+PMDTHEDTDna)EDcADigIE+nicgFDigD-di+dD1TJi+icLMDM+Hi)nMDTHEDigIE+nEKD igncDcndEH-iMEDBEgi(gDTgKDnHLMnEKD-EBDMinEMyD.CCDTnnT+PMDc++LHD-dEgD TgDTnnT+PEHDLMEMDTD-EBD T))Ji+TnicgDncDMEgKD1TJi+icLMD+cKEFD(EgEHTJJaDigDndEDAcH1DcADTDBHc-MEHDMiKEDM+Hi)nFDncDTDKiAAEHEgnDEgKD LMEHyDSJT-MDndTnDTJJc-DndEMEDTnnT+PMDncDML++EEKDTHED6LinED-iKEM)HETKDTgKDc++LHDTga-dEHEDTD-EBD T))Ji+TnicgDLMEMDig)LnDAHc1DTDLMEHD- indigDndEDcLn)LnDinD(EgEHTnEMD-indcLnD,TJiKTnig(DcHDEg+cKig(DinyDsgD TnnT+PEHD+TgDLMED.CCDncDMEgKDTD1TJi+icLMDM+Hi)nDncDTgDLgMLM)E+nig(DLMEHyDhdEDEgKDLMEH 7 MDBHc-MEHDdTMDgcD -TaDncDPgc-DndTnDndEDM+Hi)nDMdcLJKDgcnDBEDnHLMnEKFDTgKD-iJJDE2E+LnEDndEDM+Hi)nyD3E+TL MEDinDndigPMDndED M+Hi)nD+T1EDAHc1DTDnHLMnEKDMcLH+EFDndED1TJi+icLMDM+Hi)nD+TgDT++EMMDTgaD+ccPiEMFDMEMMicgDncPEgMFDcHD cndEHDMEgMini,EDigAcH1TnicgDHEnTigEKDBaDndED BHc-MEHDTgKDLMEKD-indDndTnDMinE N + e4 y D D D D D D D --- page 4 --- Doublel K l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l O-Dia2,x1fDo1.x3y1va1, D D hdEDEg,iHcg1EgnD LMEKDigDndiMDH EMETH+dD-TM D BTMEKDcgD ME,EHTJD,iHnLTJD 1T+digEMDndTnDHLgMD KiAAEHEgnD 1cKEHgDBHc-MEHMyDRLEDncDndEDHEMETH+dD1cni,TnicgDTgKD(cTJMD*DAc+LMEKDcgDndEDAcJJc-ig(D-EBDBHc-MEHMf D D D jcc(JED;dHc1E D D D x)EHTD3Hc-MEH D D D mc&iJJTDSiHEAc2 D D D *gnEHgEnDN2)JcHEH D D D --- page 5 --- Doublel P l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l z-Dc3y~t0,2 D hdEDHEMETH +dD Ac+LMEKDcgDndEDAcJJc-ig(DrEB w s))Ji+TnicgDS iHE-TJJMy D uyeDSbD3*jD*0DrsS D N SbDfEn-cHPMFD*g+yDiMDTD1LJnigTnicgTJDs1EHi+TgD+c1)TgaD-di+dDM)E+iTJi&EMDigDs))Ji+TnicgD REJi,EHaDfEn-cHPig(DOsRfzDnE+dgcJc(aDndTnDc)ni1i&EMDndEDKEJi,EHaDcADgEn-cHP w BTMEKDT))Ji+TnicgMDTgK D ndEDME+LHinaFD)EHAcH1Tg+EFDT,TiJTBiJinaDcADMEH,EHMFDKTnTDMncHT(EDKE,i+EMFDTgKDcndEHDgEn-cHPDHEMcLH+EMyD SbDiMDdETK6LTHnEHEKDigDCETnnJEFDrTMdig(ncgDTgKDdTMDKE,EJc)1EgnFD1TgLAT+nLHig(FDTgKD MTJEML1THPEnig(DcAAi+EMD-cHJK-iKEyDSbDcHi(igTJJaD1TgLAT+nLHEKDTgKDMcJ KDMc1EDcADndEDigKLMnHaXMDAiHMnD JcTK w BTJTg+ig(D)HcKL+nMyD*gD¼¾e¾DTgKD¼¾eeFDSbDfEn-cHPMD-TMDcgDScHnLgEXMDJiMnDcADe¾¾DSTMnEMn w jHc-ig(D ;c1)TgiEMD-cHJK-iKEyDhdED+c1)TgaD-TMDTJMcDHTnEKDcgEDcADndEDnc)DnEgDBEMn w )EHAcH1ig(DMnc+PMDBaDC¢0D b¾¾DigD¼¾e¾ N D + ¼4 y D N hdEDSbD3* j w *0\Ds))Ji+TnicgDCE+LHinaDmTgT(EHDiMDTDrEBDT))Ji+TnicgDAiHE-TJJDndTnDLMEMDBcndD )cMini,EDTgKDgE(Tni,EDME+LHinaD1cKEJMDncDiKEgniAaFDiMcJTnEDTgKDBJc+PDMc)diMni+TnEKDTnnT+PMD-indcLnD i1)T+nig(DJE(i ni1TnEDT))Ji+TnicgDnHTgMT+nicgM N +o4 y D D uy¼DCL+LHi D N CL+LHiDiMDTD+ c1)TgaD -di+d D cAAEHMDTDME+LHinaDMEH,i+EDndTnDKEnE+nMDLgTLndcHi&EKD+dTg(EMDncD gEn-cHPDO+JcLKzDTMMEnMFDig+JLKig(D-EBDMinEMFDRfCFDrdciMDHE+cHKMFDCC&D+EHniAi+TnEMDTgKDcndEHMyD*nDiMDTJMcD dET,iJaDLMEKDTMDTgDETHJaD-THgig(DMaMnE1DncDKEnE+nD1TJ-THEFDM)T1DTgKDcndEHDM E+LHinaDiMMLEM D cgD-EBD MinEMDTgKDRfCDdiIT+Pig( N + u4 yD *nDTJMcD)HcnE+nMDT(TigMnD1cMnD+c11cgD-EB w T))Ji+TnicgD,LJgEHTBiJiniEMFDML+dD TMDC~&DigIE+nicgFD+HcMM w MinEDM+Hi)nig(FDAiJEDig+JLMicgDTnnT+PMFDTgKD1TgaDcndEHD,LJgEHTBiJiniEM y D D uyoDmcKCE+LHina D N mcKCE+LHinaDiM D TgDc)EgDMcLH+EFD+HcMM w )JTnAcH1D-EBDT))Ji+TnicgDAiHE-TJJDOrsSzD1cKLJEyDvgc-gDTMDndED “ C-iMMDsH1aDvgiAE ” D cADrsSMFDinDEgTBJEMD-EBDT))Ji+TnicgDKEAEgKEHMDncD(TigD,iMiBiJinaDigncDGhh0OCzDnHTAAi+D TgKD)Hc,iKEMDTD)c-EHDHLJEMDJTg(LT(EDTgKDs0*DncDi1)JE1EgnDTK,Tg+EKD) HcnE+nicgM N +b4 y D D D D D D --- page 6 --- Doublel a l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l uyuD*1)EH,T D *g+T)MLJT D N *1)EH,TDiMDTD)Hc,iKEHDcAD+aB EHDTgKDKTnTDME+LHinaD)HcKL+nMyDr indDTgDignE(HTnEKDME+LHinaD )JTnAcH1FD*1)EH,TDKTnTD+EgnEHDME+LHinaD)Hc,iKEMDnccJMDncD+c1BTnDTnnT+PFDndEAnFDTgKDAHTLKFD1ini(TnEDHiMPFD TgKDMnHET1JigEDHE( LJTncHaD+c1)JiTg+EyD*1)EH,TDiMDdETK6LTHnEHEKDigDtEK-ccKDCdcHEMFD;TJiAcHgiT N + 64 y D N *g+T)MLJTDrsSD)Hc,iKEMDMcJLnicgMDncD)HcnE+nD-EBMinEMDT(TigMnDC~&D*gIE+nicgMFD+HcMMDMinED M+Hi)nig(FDiJJE(TJDHEMcLH+EDT++EMMDxrsC0Dnc)DnEgDndHETnMFDTgKD-EBD¼y¾DndHETnMDig+JLKig(D+c11EgnD M)T1FDATPEDHE(iMnHTnicgMFD MinE D M+HT)ig(DTgKD1TJi+icLMDBcnMyD*nD-cHPMDBa D +dTg(ig(DTD-EBMinEXMDRc1TigD fT1EDCaMnE1DORfCzDncDHcLnEDndED-EBMinEDnHTAAi+DndHcL(dD*g+T)MLJT y D *g+T)MLJTDndEgDAiJnEHMDcLnD1TJi+icLMD TnnT+PMDAHc 1DBcnMDTgKD-EBMinEDM+HT))EHMy D *g+T)MLJT D TJMcDdTMDTD+cgnEgnDKEJi,EHaDgEn-cHPDndTnD+T+dEMD -EBMinEMDcgDndEiH D MEH,EHDgEn-cHPDncDM)EEKDL)D-EBMinEDJcTKDni1EyDhdED+T+dEKDigAcH1TnicgDiMDHEnLHgEKD AHc1DTDMEH,EHD+JcMEMnDncDndEDEgKDLMEHDigDcHKEHDncD)Hc,iKEDATMnD)T(EDJcTKMyDhdiMDTJMcDEJi1igTnEMDMJc-D HEM)cgMEDAHc1D+EgnHTJDMEH,EHMDKLEDncDdET,aDMEH,EHDnHTAAi+ N D + 4 y D D uybD0G0 w *RC D N 0G0*RCDO0G0D*gnHLMicgDREnE+nicgDCaMnE1zDiMDTgDc)EgDMcLH+ED0G0DrEBDs))Ji+TnicgD*gnHLMicgD REnE+nicgDCaMnE1yD*nD-TMD-HinnEgDBaDmTHicDGEiKEHi+dFD;dHiMniTgDmTnndiEMFD&THMDGyDCnHcIgaDT gKDME,EHTJD cndEHMDigDmTH+dD¼¾¾ N +l4 y D N 0G0*RCDKEnE+nMD;HcMM w MinEDM+Hi)nig (DO.CCzFDC~&DigIE+nicgFDdETKEHDigIE+nicgFD TgKDRiHE+ncHa D nHT,EHMTJFDtE1cnEDSiJEDN2E+LnicgFD&c+TJDSiJED*g+JLMicgFD TgKD REgiTJDcADCEH,i+EDORcCzyD*nDiMDMi1)JEDncDLMED TgKD-EJJDMnHL+nLHEKyD*nD)Hc,iKEMDi1)T+nDcADE,EHaDTnnT+PDBaDTgTJa&ig(DTgaD+dcMEgDig)LnD,THiTBJEMDTMD 0xChFDjNhFDCNCC*xfFD;xxv*N N D + l4 y D 0G0 w *RCDdTMDTDJTH(EDHLJEM D MEnDncD)HE,EgnD.CCDTnnT+PMFD TgK D +TgDBEDKc-gJcTKEKDndHcL(dDndED )HcIE+nD-EBMinEFD)d) w iKMycH(y D D uy6D~Li+PREAEgME D N ~Li+PREAEgME D iMDTgDf(ig2DTgKD<DBTMEKDETMaDncDMEnL)DTgKD+cgAi(LHED-E BDT))Ji+TnicgDAiHE-TJJyD*nD TJJc-MDLMEHMDncD-HinEDc-gDHLJEMDigD,EHaDMi1)JEDJTg(LT(E N D + U 4 y D D D D D --- page 7 --- Doublel y l lllllll lllllllll lllll URoLEnulcddlibg + oHHdEToME(nlAErbBoddwls))lAEdMbrw lllllll llll lllll llll JoSEnlc-FbL l l uy Ds~htxf*. D rEBvgi(dn D N s~htxf*.DrEBvgi(dnDiMDTgDT))Ji+TnicgDAiHE-TJJDAcHD**CDTgKDcndEHD-EBDMEH,EHMDTgKDiMDHEJETMEKD LgKEHDndEDjfpDjEgEHTJD0LBJi+D&i+EgMEyDmcHED)THni+LJTHJaDinDiMDTgD*Cs0*DAiJnEHDndTnDME+LHEMDacLHD-EBD MEH,EHDBaDBJc+Pig(D+EHnTigDHE6LEMnMyD*ADTgDTJEHnDiMDnHi((EHEKDr EBvgi(dnD-iJJDnTPEDc,EHDTgKD)HcnE+nDndED -EBDMEH,EHyD*nDKcEMDndiMDBaDM+Tggig(DTJJDHE6LEMnMDTgKD)Hc+EMMig(DndE1DBTMEKDcgDAiJnEHDHLJEMFDMEnDBaDndED TK1igiMnHTncHyDhdEMEDHLJEMDTHEDgcnDBTMEKDcgDTDKTnTBTMEDcADTnnT+PDMi(gTnLHEMDndTnDHE6LiHEDHE(LJTHD L)KTnEMyD *gMnE TKDrEBvgi(dnDLMEMDME+LHinaDAiJnEHMDTMDBLAAEHDc,EHAJc-FDC~&DigIE+nicgFDKiHE+ncHaDnHT,EHMTJFD +dTHT+nEHDEg+cKig(DTgKDcndEHDTnnT+PMyDhdiMD-TaDrEBvgi(dnD+TgD)HcnE+nDacLHDMEH,EHDT(TigMnDTJJDPgc-gD TgKDLgPgc-gDTnnT+PMyD3E+TLMEDrEBvgi(dnDiMDTgD*Cs0*DAiJnEHDinDdTMDn dEDTK,TgnT(EDcAD-cHPig(D+JcMEJaD -indDndED-EBDMEH,EHFDndiMD-TaDinD+TgDKcD1cHEDndTgDcndEHDAiHE-TJJMDTgKDignHLMicgDKEnE+nicgDMaMnE1MFD JiPED M+Tggig(DEg+Ha)nEKDnHTAAi+ N + e¾ 4 y D D uylD3THHT+LKTDrsS D N 3THHT+LKTDfEn-cHPMFD*g+yDiMDTD+c1)TgaD)Hc,iKig(DME+LHinaFDgEn-cHPi g(DTgKDMncHT(ED)HcKL+nMD BTMEKDcgDgEn-cHPDT))JiTg+EMDTgKD+JcLKDMEH,i+EMyDhdED+c1)Tga 7 MDME+LHinaD)HcKL+nMDig+JLKED)HcKL+nMD AcHD)HcnE+nicgDT(TigMnDE1TiJFD-EBDMLHAig(FD-EBDdT+PEHMDTgKDigMnTgnD1EMMT(ig(DndHETnMDML+dDTMDM)T1FD M)a-THEFD hHcITgM FDTgKD,iHLMEMyDhdED+ c1)TgaXMDgEn-cHPig(DTgKDMncHT(ED)HcKL+nMDig+JLKED-EBDAiJnEHig(FD JcTKDBTJTg+ig(FDT))Ji+TnicgDKEJi,EHaD+cgnHcJJEHMFD1EMMT(EDTH+di,ig(FDfjDAiHE-TJJMFDBT+P L)DMEH,i+EMDTgKD KTnTD)HcnE+nicg N + ee 4 y D N hdED3THHT+LKTDrEBDs))Ji+TnicgDSiHE-TJJD)Hc,iKEMDHcBLMnDME+LHinaDT(TigMn D nTH(EnEKDTgKD TLnc1TnEKDTnnT+PMyDxrsC0Dhc)De¾DTnnT+PMDJiPEDC~&D*gIE+nicgMDTgKD;HcMM w CinEDC+Hi)nig(DO.CCzDTHED TLnc1 Tni+TJJaDiKEgniAiEKDTgKDJc((EK N + e¼ 4 y D N 3THHT+LKTDrEBDs))Ji+TnicgDSiHE-TJJD+cgnTigMD+c1)HEdEgMi,EDHLJEDMEnMDncDKEnE+nD)JTigDcHD cBALM+TnEKD.CCDTnnT+P MDigDig+c1ig(DHE6LEMnMyD3THHT+LKTDrEBDs))Ji+TnicgDSiHE-TJJMD)HcnE+nMDT(TigMnD.CCD -indcLnDHE6LiHig(DTgaDTKKinicgTJD+cgAi(LHTnicgDcHD+dTg(EMDncD-EBDT))Ji+TnicgD +cKEyDCi(gTnLHEM D THED TLnc1Tni+TJJaDL)KTnEKDncD+c,EHDndEDJTnEMnDndHETnM N D + eo 4 y D D D D D D --- page 8 --- >0 `g<_''?0! �,“ž–ˆ2