Preliminary research

ROP for the Web: Smuggling XSS, SQLi and Web Shells Past Every WAF Using Compression Dictionaries

Lenin Alevski · AppSec Village

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Conference presentation introducing controlled Compression Dictionary Transport experiments. Companion labs compare visible responses with dictionary-compressed responses under WAF and IDS inspection. The work demonstrates bounded response-inspection gaps and a synthetic compression oracle, rather than every WAF or arbitrary request-injection bypass.

Record

Researcher

Lenin Alevski

Published by

AppSec Village

Topic

XSS

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• ROP for the Web — Compression Dictionary Transport Research Labs Code
• ROP for the Web Whitepaper
• ROP for the Web trainer runbook Code
• ROP for the Web research log Code
• ROP for the Web blog write-up Code

Tags

• encoding
• http
• waf
• waf-bypass
• side-channel
• tooling
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Lenin Alevski, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.