Preliminary research

ROP for the Web: Smuggling XSS, SQLi and Web Shells Past Every WAF Using Compression Dictionaries

Lenin Alevski · AppSec Village

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Conference presentation introducing controlled Compression Dictionary Transport experiments. Companion labs compare visible responses with dictionary-compressed responses under WAF and IDS inspection. The work demonstrates bounded response-inspection gaps and a synthetic compression oracle, rather than every WAF or arbitrary request-injection bypass.

Record

Researcher

Lenin Alevski

Published by

AppSec Village

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Code
• Full presentation deck
• Lab demonstration runbook
• Research notes
• Companion write-up

Tags

• encoding
• http
• waf
• waf-bypass
• side-channel
• tooling
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Lenin Alevski, first published at the original source. Preserved copies are kept so the citation survives its host.