User talk:Vaibhav Khatke - Revision history

Vaibhav Khatke at 09:16, 30 October 2015

2015-10-30T09:16:42Z

Vaibhav Khatke at 10:34, 20 October 2012

2012-10-20T10:34:35Z

Vaibhav Khatke at 10:29, 20 October 2012

2012-10-20T10:29:18Z

Vaibhav Khatke at 10:23, 20 October 2012

2012-10-20T10:23:43Z

Vaibhav Khatke at 10:21, 20 October 2012

2012-10-20T10:21:47Z

Vaibhav Khatke at 10:20, 20 October 2012

2012-10-20T10:20:37Z

Vaibhav Khatke: /* WeB AppLiCaTiOn FiReWaLL ByPaSSiNg to produce XSS using Non-Alphanumeric characters. */ new section

2012-10-20T10:13:41Z

‎WeB AppLiCaTiOn FiReWaLL ByPaSSiNg to produce XSS using Non-Alphanumeric characters.: new section

Show changes

Vaibhav Khatke: Blanked the page

2012-04-12T18:54:39Z

Blanked the page

Vaibhav Khatke at 18:21, 12 April 2012

2012-04-12T18:21:26Z

KateHartmann: Welcome!

2012-04-12T17:20:36Z

Welcome!

New page

'''Welcome to ''OWASP''!'''
We hope you will contribute much and well.
You will probably want to read the [[Help:Contents|help pages]].
Again, welcome and have fun! [[User:KateHartmann|KateHartmann]] 17:20, 12 April 2012 (UTC)

@@ Line 7: / Line 7: @@
 At the beginning we see and compare distinct HTML parsing methods and interpretation approaches used by most common html compilers that can lead to unique attack vectors. Javascript is another way that can be used to obfuscate or de-obfuscate code. We can create a non-alphanumeric Javascript code that is malicious.Sql injection is major flaw in today’s Web-apps.Will try to demonstrate Waf bypass for that as well.
-Abbreviations used:WAF, IPS, IDS, obfuscation, SQL injection, XSS, CSS, CSRF.
+Abbreviations used: WAF, IPS, IDS, obfuscation, SQL injection, XSS, CSS, CSRF.
-'''Assume''':Obfuscated payload=> the vector or string that will bypass WAF/
+'''Assumption''':Obfuscated payload=> the vector or string that will bypass WAF/

@@ Line 58: / Line 58: @@
 Some Waf Bypass:
-[http://i.imgur.com/LM2qy.png]
+<tr>
@@ Line 163: / Line 212: @@
 hard-code it into your memory:
-[http://www.anonmgur.com/up/6a0576c7ffc94efa02bf95e05ecc5a6d.png]
 There are other methods to generate numbers if you dont want to use alphanumeric chars.Just use mathematical operators ‘+’/'-’ to generate 0 or zero.

← Older revision		Revision as of 10:29, 20 October 2012
Line 279:		Line 279:

	The obfuscated way will be=''([],[][([![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([]+{})[++[[]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]])()[(+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]](++[[]][+[]])'' which will show alert(1).		The obfuscated way will be=''([],[][([![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([]+{})[++[[]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]])()[(+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]](++[[]][+[]])'' which will show alert(1).
−
−
−	~~[[File:Http://www.anonmgur.com/up/6a0576c7ffc94efa02bf95e05ecc5a6d.png]]~~

← Older revision		Revision as of 10:23, 20 October 2012
Line 281:		Line 281:


−	[[File:~~http~~://www.anonmgur.com/up/6a0576c7ffc94efa02bf95e05ecc5a6d.png]]	+	[[File:Http://www.anonmgur.com/up/6a0576c7ffc94efa02bf95e05ecc5a6d.png]]

← Older revision		Revision as of 10:21, 20 October 2012
Line 279:		Line 279:

	The obfuscated way will be=''([],[][([![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([]+{})[++[[]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]])()[(+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]](++[[]][+[]])'' which will show alert(1).		The obfuscated way will be=''([],[][([![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([]+{})[++[[]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]])()[(+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]]](++[[]][+[]])'' which will show alert(1).
		+
		+
		+	[[File:http://www.anonmgur.com/up/6a0576c7ffc94efa02bf95e05ecc5a6d.png]]

← Older revision		Revision as of 18:54, 12 April 2012
Line 1:		Line 1:
−	My name is Vaibhav Khatke and I am an open Web security Analyst and Debugger. I usually test Web Apps for loop holes like query Injection,code injection,scripts execution,local/remote file exclusion,Buffer Overflow and lots of others. My field of expertise is penetration testing and especially web application security.	+

← Older revision		Revision as of 18:21, 12 April 2012
Line 1:		Line 1:
−	~~'''Welcome to ''OWASP''!'''~~	+	My name is Vaibhav Khatke and I am an open Web security Analyst and Debugger. I usually test Web Apps for loop holes like query Injection,code injection,scripts execution,local/remote file exclusion,Buffer Overflow and lots of others. My field of expertise is penetration testing and especially web application security.
−	~~We hope you will contribute much~~ and ~~well~~.
−	~~You will probably want to read the [[Help:Contents\|help pages]]~~.
−	~~Again, welcome~~ and ~~have fun! [[User:KateHartmann\|KateHartmann]] 17:20, 12 April 2012 (UTC)~~