Collected research
Exploring Javascript events & Bypassing WAFs via character normalization
Catalogues JavaScript event handlers that fire with no user interaction, then reaches arbitrary script execution from them without parentheses or backticks by overwriting toString or an Error name. It bypasses eight major WAFs by prefixing a payload with encodings the WAF normalises but the application does not.
Record
- Researcher
- 0x999 and @_0x999
- Published by
- 0x999
- Date
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of 0x999 and @_0x999, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .