I have also seen backend application which strip out certain "bad" tags (i.e. <script>).
I remember being able to perform an XSS attack by sending a payload that looked like:
<sc<script>ript>alert(/XSS/)</sc<script>ript>
This passed the WAF inspection, but then got trimmed by the backend application and this is what was left:
<script>alert(/XSS/)</script>
written in the page source.
Maybe I'll write about that case too if I find where I put the attack evidence.
You can anyway see that bad validation by the actual application programmers can disable the WAF's capabilities.
I remember being able to perform an XSS attack by sending a payload that looked like:
<sc<script>ript>alert(/XSS/)</sc<script>ript>
This passed the WAF inspection, but then got trimmed by the backend application and this is what was left:
<script>alert(/XSS/)</script>
written in the page source.
Maybe I'll write about that case too if I find where I put the attack evidence. You can anyway see that bad validation by the actual application programmers can disable the WAF's capabilities.