Collected research

New Evasions for Web Application Firewalls

Mazin Ahmed · mazinahmed.net

A test of the cross-site scripting rule sets of eight web application firewalls, among them F5 Big-IP, Imperva Incapsula, WebKnight, PHP-IDS, ModSecurity, Sucuri, QuickDefense and Barracuda. Every product was evaded with crafted XSS payloads, showing that filtering in front of an application does not substitute for fixing the underlying flaw.

Record

Researcher

Mazin Ahmed

Published by

mazinahmed.net

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2015 research round

Tags

• waf-bypass
• xss
• filter-bypass
• sanitizer-bypass
• waf
• http
• measurement-study
• case-study
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Mazin Ahmed, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.