Collected research

x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again

x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again!

Soroush Dalili · soroush.me · 4 May 2019

When the User-Agent starts with UP, ASP.NET takes the request body charset from the non-standard x-up-devcap-post-charset header instead of the Content-Type charset directive. An attacker encodes a POST payload in an exotic codepage such as ibm500, so a WAF that only whitelists Content-Type charsets sees nothing while the application decodes the attack.

Record

Document

x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again!

Researcher

Soroush Dalili

Published by

soroush.me

Date

4 May 2019

Topic

HTTP

In the archive

• Collected in the 2019 research round

Tags

• waf-bypass
• charset
• encoding
• aspnet
• dotnet
• content-type
• filter-bypass
• http
• owasp-a02-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.