Collected research
Bypassing WAFs with the phantom $Version cookie
A leading $Version=1 makes Tomcat and Spring fall back to RFC2109 cookie parsing, where values may be quoted and backslash escapes are unescaped, and Python's SimpleCookie decodes octal escapes inside quotes. Writing eval('test') as \e\v\a\l\('\t\e\s\t'\) or \145\166\141\154 therefore slips past AWS WAF signatures and reaches the app decoded. Commas also separate cookies, and duplicate Cookie headers are joined with a comma, hiding a cookie name inside a value.
Record
- Researcher
- Zakhar Fedotkin
- Published by
- PortSwigger Research
- Date
- Topic
- Identity
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Zakhar Fedotkin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .