BestHub
Sign in
Tagged articles

WAF Bypass

6 articles · Page 1 of 1
Black & White Path
Black & White Path
Aug 24, 2026 · Information Security

No‑Credentials RCE: One POST request grants root on Pakistan’s largest bank

A security analysis reveals that an unauthenticated Java deserialization flaw (CVE‑2017‑10271) in Oracle WebLogic's WS‑AT endpoint lets an attacker obtain a root shell on HBL’s internet‑facing banking nodes with a single POST request, then harvest credentials, hijack sessions, persist, and move laterally, while additional related bugs amplify the risk.

CVE-2017-10271Java DeserializationRemote Code Execution
0 likes · 10 min read
No‑Credentials RCE: One POST request grants root on Pakistan’s largest bank
Black & White Path
Black & White Path
May 24, 2026 · Information Security

AI‑Driven DeepSeek XML Error Injection Bypasses WAF, Dumps 19 DBs in 2 Hours

In a production‑environment penetration test, the researcher leveraged DeepSeek V4 Pro via a custom Claude Code bridge to craft an XML‑parsing‑error‑based Boolean blind SQL injection that evaded WAF keyword filters, allowing character‑by‑character extraction of all 19 database names within two hours at a cost of only ¥1.4.

DeepSeekPenetration TestingSQL injection
0 likes · 10 min read
AI‑Driven DeepSeek XML Error Injection Bypasses WAF, Dumps 19 DBs in 2 Hours
Black & White Path
Black & White Path
Apr 25, 2026 · Information Security

How I Bypassed a WAF with SQL Injection: A Step‑by‑Step Walkthrough

The article details a hands‑on investigation of a web application firewall that strips SQL keywords, shows how order‑by and CASE‑WHEN payloads can be used to probe column limits, construct blind injection strings, and ultimately achieve data extraction despite multiple filtering layers.

CASE WHEN payloadSQL injectionWAF Bypass
0 likes · 7 min read
How I Bypassed a WAF with SQL Injection: A Step‑by‑Step Walkthrough
Black & White Path
Black & White Path
Mar 11, 2026 · Information Security

ByPassTamperPlus: Enhanced SQLMap Tamper Scripts for Advanced WAF Bypass

ByPassTamperPlus is a Python‑based collection of SQLMap tamper scripts tailored for MSSQL, MySQL and Oracle across multiple versions, employing version‑specific syntax, functions and obfuscation techniques to improve payload survivability against modern Web Application Firewalls, while acknowledging inherent limitations.

MSSQLMySQLOracle
0 likes · 6 min read
ByPassTamperPlus: Enhanced SQLMap Tamper Scripts for Advanced WAF Bypass
Black & White Path
Black & White Path
Feb 16, 2026 · Cloud Computing

Distributed IP Proxy Pool on Tencent SCF to Bypass WAF Limits

The article introduces Cloud ProxyPool, a Go‑based distributed IP proxy pool built on Tencent Cloud Functions (SCF) that bypasses WAF IP restrictions, provides step‑by‑step deployment, client configuration, CA certificate installation, proxy settings, a monitoring dashboard, and outlines supported use cases such as crawler IP rotation, IP testing, HTTPS interception, and integration with tools like Burp Suite.

GoIP ProxySCF
0 likes · 4 min read
Distributed IP Proxy Pool on Tencent SCF to Bypass WAF Limits
MaGe Linux Operations
MaGe Linux Operations
Jul 6, 2022 · Information Security

How to Bypass a WAF and Capture the Flag on Minu-1 – A Complete Pen‑Test Walkthrough

This step‑by‑step guide demonstrates how to enumerate a vulnerable host, identify and fingerprint its Web Application Firewall, apply multiple WAF‑bypass techniques—including fuzzing, command injection, binary abuse and URL‑encoding tricks—to obtain a stable shell, perform privilege escalation, decode a JWT token and finally retrieve the root flag.txt.

JWT crackingLinux exploitationPenetration Testing
0 likes · 16 min read
How to Bypass a WAF and Capture the Flag on Minu-1 – A Complete Pen‑Test Walkthrough