gskourou

amen

I have also seen backend application which strip out certain "bad" tags (i.e. <script>).

I remember being able to perform an XSS attack by sending a payload that looked like:

<sc<script>ript>alert(/XSS/)</sc<script>ript>

This passed the WAF inspection, but then got trimmed by the backend application and this is what was left:

<script>alert(/XSS/)</script>

written in the page source.

Maybe I'll write about that case too if I find where I put the attack evidence. You can anyway see that bad validation by the actual application programmers can disable the WAF's capabilities.