Browse / Bypasses / Web application firewalls

Getting past web application firewalls

Cloudflare, Akamai, ModSecurity and other request filters in front of the app. 87 disclosed reports got past one.

1. SQL Injection in report_xml.php through countryFilter[] parameterSQL Injection · critical · Valve
   $25,000410 votes
2. [www.zomato.com] SQLi - /php/██████████ - item_idSQL Injection · critical · Eternal
   $4,500326 votes
3. Reflected XSS on www.hackerone.com via Wistia embed codeCross-site Scripting (XSS) - Reflected · low · HackerOne
   $500236 votes
4. Blind SQL Injection on starbucks.com.gt and WAF Bypass :*SQL Injection · high · Starbucks
   210 votes
5. MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypassDeserialization of Untrusted Data · QIWI
   148 votes
6. Cloudflare WAF Bypass - Origin IP ExposureImproper Access Control - Generic · medium · Hemi VDP
   118 votes
7. Stored XSS in Snapmatic + R★Editor commentsCross-site Scripting (XSS) - Stored · high · Rockstar Games
   118 votes
8. Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)Cross-site Scripting (XSS) - Stored · high · Expedia Group Bug Bounty
   117 votes
9. HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionHTTP Request Smuggling · critical · Cloudflare Public Bug Bounty
   $6,000116 votes
10. Using special IPv4-mapped IPv6 addresses to bypass local IP banImproper Access Control - Generic · critical · Cloudflare Public Bug Bounty
    $7,50078 votes
11. Bypass of Cloudflare's Cache Keys and WAF via header overflowImproper Access Control - Generic · high · Cloudflare Public Bug Bounty
    77 votes
12. Reflected cross-site scripting on multiple Starbucks assets.Cross-site Scripting (XSS) - Reflected · low · Starbucks
    72 votes
13. Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Misconfiguration · critical · Essity
    68 votes
14. reflected XSS on panther.comImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium · Panther Labs
    65 votes
15. Reflected XSS Via origCity Parameter (UPPER Case + WAF Protection Bypass)Cross-site Scripting (XSS) - Reflected · medium · Expedia Group Bug Bounty
    63 votes
16. [www.zomato.com] Union SQLi + Waf BypassSQL Injection · Eternal
    $1,00061 votes
17. XSS at TikTok Ads EndpointCross-site Scripting (XSS) - Reflected · high · TikTok
    60 votes
18. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)Cross-site Scripting (XSS) - Reflected · low · Starbucks
    58 votes
19. Bypass R2 payment screenImproper Restriction of Authentication Attempts · medium · Cloudflare Public Bug Bounty
    $35057 votes
20. Circular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphqlUncontrolled Resource Consumption · medium · Sorare
    57 votes
21. Origin IP found, WAF Cloudflare BypassImproper Access Control - Generic · low · SMTP2GO BBP
    $10053 votes
22. XXE on ██████████ by bypassing WAF ████XML External Entities (XXE) · QIWI
    53 votes
23. Stored xssCross-site Scripting (XSS) - Stored · high · Shopify
    $1,00052 votes
24. Stored XSS in '' Section and WAF BypassCross-site Scripting (XSS) - Stored · medium · Semrush
    50 votes
25. HTTP request smuggling with Origin Rules using newlines in the host_header action parameterHTTP Request Smuggling · critical · Cloudflare Public Bug Bounty
    $3,10046 votes
26. CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93)CRLF Injection · curl
    42 votes
27. HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attributeCross-site Scripting (XSS) - Reflected · medium · GSA Bounty
    41 votes
28. XML External Entity (XXE) in qiwi.com + waf bypassXML External Entities (XXE) · QIWI
    41 votes
29. SQL Injection Detection Bypass in AWS WAF Managed Rules (AWSManagedRulesSQLiRuleSet)SQL Injection · AWS VDP
    40 votes
30. WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xssImproper Access Control - Generic · Doppler
    36 votes
31. Bypassing Cache Deception Armor using .avif extension fileInformation Disclosure · medium · Cloudflare Public Bug Bounty
    36 votes
32. GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Open Redirect · low · Logitech
    $10034 votes
33. Origin IP found, Cloudflare bypassedImproper Access Control - Generic · medium · Liberapay
    34 votes
34. Sign in with Apple works on existing accounts, bypasses 2FAImproper Authentication - Generic · high · Cloudflare Public Bug Bounty
    $1,00032 votes
35. Self-Stored XSS - Chained with login/logout CSRFCross-site Scripting (XSS) - Stored · medium · Eternal
    $30031 votes
36. Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers)Cross-site Scripting (XSS) - Reflected · medium · GSA Bounty
    28 votes
37. Basic XSS [WAF Bypasses]Cross-site Scripting (XSS) - Generic · Cloudflare Public Bug Bounty
    $5027 votes
38. XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)Cross-site Scripting (XSS) - Generic · high · Starbucks
    27 votes
39. HTML injection leads to reflected XSSCode Injection · low · Eternal
    $15026 votes
40. Non-Cloudflare IPs allowed to access origin serversViolation of Secure Design Principles · low · Coalition, Inc.
    26 votes
41. HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversionCRLF Injection · critical · curl
    24 votes
42. HTTP Request Smuggling Vulnerability Analysis - cURL Security ReportHTTP Request Smuggling · medium · curl
    23 votes
43. Open TURN relay abuse is possible due to lack of peer access control (Critical)Server-Side Request Forgery (SSRF) · high · 8x8
    $70023 votes
44. Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfersIncorrect Authorization · curl
    22 votes
45. https://www.wotif.com/vc/blog/info.php script is prone to reflected HTML/CSS injection and COOKIE leakCode Injection · low · Expedia Group Bug Bounty
    22 votes
46. Length extension attack leading to HTML injectionCryptographic Issues - Generic · medium · Eternal
    $10022 votes
47. HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb TunnelingImproper Access Control - Generic · high · curl
    21 votes
48. I found another way to bypass Cloudflare Warp lock!Client-Side Enforcement of Server-Side Security · high · Cloudflare Public Bug Bounty
    $1,00020 votes
49. Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCEOS Command Injection · medium · Starbucks
    19 votes
50. Stored XSS in comments on https://www.starbucks.co.uk/blog/*Cross-site Scripting (XSS) - Stored · high · Starbucks
    19 votes
51. Origin IP found, Cloudflare bypassedInformation Disclosure · People Interactive
    18 votes
52. Reflected XSS on molpay.com with cloudflare bypassCross-site Scripting (XSS) - Reflected · Razer
    $37517 votes
53. [press.razer.com] Origin IP found, Cloudflare bypassedImproper Access Control - Generic · Razer
    $20017 votes
54. Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemptionCross-site Scripting (XSS) - Generic · medium · Rockstar Games
    17 votes
55. Content Injection on api.semrush.com to Reflected XSSCross-site Scripting (XSS) - Reflected · low · Semrush
    16 votes
56. HTML Injection @ /[restaurant]/order endpoint.Cross-site Scripting (XSS) - Generic · low · Eternal
    $15015 votes
57. Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486)Cross-site Scripting (XSS) - Reflected · medium · Starbucks
    14 votes
58. [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameterCross-site Scripting (XSS) - Reflected · medium · Chaturbate
    $35013 votes
59. Path traversal leads to reading of local files on ███████ and ████Path Traversal · high · U.S. Dept Of Defense
    12 votes
60. Ability to bypass locked Cloudflare WARP on wifi networks.Client-Side Enforcement of Server-Side Security · high · Cloudflare Public Bug Bounty
    $1,00012 votes
61. SQL Injection in Login Page: https://█████/█████████/login.phpSQL Injection · high · U.S. Dept Of Defense
    12 votes
62. Password Policy Restriction BypassViolation of Secure Design Principles · low · Cloudflare Public Bug Bounty
    11 votes
63. Origin IP found, Cloudflare bypassedViolation of Secure Design Principles · medium · CS Money
    11 votes
64. MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypassSQL Injection · high · U.S. Dept Of Defense
    11 votes
65. Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter EncodingImproper Input Validation · medium · curl
    10 votes
66. Reflected XSS in ██████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    10 votes
67. Found Origin IP's Lead To Access ████Violation of Secure Design Principles · low · U.S. Dept Of Defense
    10 votes
68. Bypass Cloudflare WARP lock on iOS.Client-Side Enforcement of Server-Side Security · medium · Cloudflare Public Bug Bounty
    $50010 votes
69. Reflected XSS www.█████ search formCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    10 votes
70. Reflected XSS with WAF Bypass https://pw.mail.ruCross-site Scripting (XSS) - Reflected · Mail.ru
    10 votes
71. Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ██████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    9 votes
72. Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ███████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    8 votes
73. Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ████ Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    8 votes
74. Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ███████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    7 votes
75. Cross-Site Scripting (XSS) Vulnerability via parameter c0-id + Akamai Firewall BypassCross-site Scripting (XSS) - DOM · medium · U.S. Dept Of Defense
    7 votes
76. [www.███] Reflected Cross-Site ScriptingCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    7 votes
77. multiple vulnerabilities on your mautic servermedium · Unikrn
    7 votes
78. Object Injection in Woocommerce / Handle PDT Responses from PayPalCode Injection · medium · Automattic
    7 votes
79. Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ██████████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    6 votes
80. Cross-Site Scripting (XSS) Vulnerability via POST Method + Akamai Firewall BypassCross-site Scripting (XSS) - DOM · medium · U.S. Dept Of Defense
    6 votes
81. Found Origin IP's lead to access to gitlabImproper Access Control - Generic · medium · GitLab
    6 votes
82. XSS on https://████/ via ███████ parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    6 votes
83. Reflected XSS | https://████████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    5 votes
84. HTML Injection on ████Cross-site Scripting (XSS) - Generic · medium · U.S. Dept Of Defense
    5 votes
85. Firewall rules for ████████ can be bypassed to leak site authorsInformation Disclosure · medium · U.S. Dept Of Defense
    4 votes
86. Origin IP Disclosure VulnerabilityInformation Disclosure · Sifchain
    3 votes
87. Reflected XSS | https://████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    2 votes