It is known that over the years, a trend that addresses the information security landscape has emerged, I mean, web applications are under attack, given this perspective, Web Application Firewalls are becoming increasingly popular, which are most commonly used by organizations to protect against various attacks such as SQL Injection, XSS etc.

While WAF's may help preventing application layer attacks up to some extent, however they certainly are not replacements for input validation and secure coding practices due to the fact that they are based upon Blacklists which means rejection of known patterns while allowing everything else. The problem, especially in case of JavaScript is that it's simply not possible to create blacklists capable of blocking all patterns without having to generate false positives due to the dynamic nature of javaScript and infinite ways of obfuscating the payload.

In this webinar, the we will talk about various techniques that can be used to bypass WAF"s such as Brute Forcing, Regular expression reversing and browser bugs. The webinar would mostly discuss

Prerequisite

- Basic knowledge about HTML/JavaScript

- Basic know how about XSS attacks
Webcast 


 

CTF Competition

After the webinar, we had this "CTF" challenge made up by a friend of mine "FileDescriptor", certain parts the first two challenges are based upon characteristics of a real world WAF that I encountered in wild which was combined with FD's ideas to make up the challenge . The last challenge is based upon "@FileDescriptor" unqiue idea and hence, it's not easy to crack and hence we named it as "Hard".

CTF Link :http://92.222.71.224