WAF Bypass Techniques Using HTTP Standard and Web Servers’ Behavior
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 14:15· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Shows concrete WAF bypasses: use HTTP/0.9 delivered via HTTP pipelining, exploit differing server parsing (Apache Tomcat quirks, header folding, semicolon delimiters), and apply request encoding (non‑UTF charsets) to slip attacks past CloudFlare, Akamai and some mod_security setups. Supplies a working Burp Suite extension HTTP smuggler and an http.ninja fuzzing repo, with live demos that bypassed multiple clouds. Recommends disabling HTTP/0.9, reject unknown charsets, and prefer whitelists as effective mitigations.
AI-written summary · about
chapters (14)
- 0:00Introduction to WAF bypass
- 1:31WAF types and limitations
- 4:07Direct IP access dangers
- 5:34Common payload evasion
- 7:02HTTP version 0.9 methods
- 11:30HTTP pipelining techniques
- 15:13Request mutation and tools
- 18:51RFC compliance issues
- 21:42Server specific behavior
- 24:39Content encoding evasion
- 28:52Time-of-check vulnerabilities
- 33:10WAF defense mechanisms
- 34:01Step-by-step bypass demo
- 39:08Final recommendations and Q&A
related talks
37mWeb Application Firewall Bypassing
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
44mCache Me If You Can: Messing with Web Caching
14mWeb Application Firewalls: A False Sense of Security?
50mHTTP Desync Attacks: Smashing into the Cell Next Door
26mBridging the Gap Between Research and Practice in Intelligently Bypassing WAF
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
42mDon’t use a WAF, and when you should, anyway.