Deteact Blog Bitrix WAF bypass

In Russian: https://blog.deteact.com/ru/bitrix-waf-bypass/ Sometimes when exploiting reflected XSS the input parameters get injected directly into the body of the <script> tag. Typically, this means that the exploit is trivial: HTML entity encoding will not prevent it, and many firewalls (including now obsolete Chrome XSS Auditor) won’t either. But CMS Bitrix has its own built-in proactive continue reading The post Bitrix WAF bypass appeared first on Deteact - continuous information security services.