Awesome-WAF/README.md

# Awesome WAF Evasion ![Awesome](https://camo.githubusercontent.com/13c4e50d88df7178ae1882a203ed57b641674f94/68747470733a2f2f63646e2e7261776769742e636f6d2f73696e647265736f726875732f617765736f6d652f643733303566333864323966656437386661383536353265336136336531353464643865383832392f6d656469612f62616467652e737667 "Awesome")
> A curated list of awesome WAF evasion stuff. 🔥

![Main Logo](images/how-wafs-work.png 'How wafs work')

__A Concise Definition:__ A web application firewall is a form of firewall with a set of configured rules that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. *(Source [Wikipedia](https://en.wikipedia.org/wiki/Application_firewall))*

Feel free to [contribute]().

### Contents:
- [Awsome WAFs]()
- [Awesome Methodology]()
- [Awesome WAF Detection]()
- [Awesome Evasion Techniques]()
- [Awesome Blogs & Writeups]()
- [Presentations & Research Papers]()

## Presentations & Research Papers
### Presentations:
- [WAF Profiling & Evasion Techniques](presentations/OWASP%20WAF%20Profiling%20&%20Evasion.pdf) - A WAF testing and evasion guide from [OWASP](https://www.owasp.org).
- [Protocol Level WAF Evasion Techniques](presentations/BlackHat%20US%2012%20-%20Protocol%20Level%20WAF%20Evasion%20(Slides).pdf) - A presentation at about efficiently evading WAFs at protocol level from [BlackHat US 12](https://www.blackhat.com/html/bh-us-12/).
- [WAF: Attacking Detection Logic Mechanisms](presentations/BlackHat%20US%2016%20-%20Analysis%20of%20Attack%20Detection%20Logic.pdf) - A presentation about WAF logic applied to detecting attacks from [BlackHat US 16](https://www.blackhat.com/html/bh-us-16/).

### Research Papers:
- [WASC WAF Evaluation Criteria](papers/WASC%20WAF%20Evaluation%20Criteria.pdf) - A guide for WAF Evaluation from [Web Application Security Consortium](http://www.webappsec.org)
- [Protocol Level WAF Evasion](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf) - A protocol level WAF evasion techniques and analysis by [Qualys](https://www.qualys.com).
- [WAF Evasion Testing](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf) - A WAF evasion testing guide from [SANS](https://www.sans.org).
Update README.md 2019-01-08 00:36:28 -05:00			`# Awesome WAF Evasion ![Awesome](https://camo.githubusercontent.com/13c4e50d88df7178ae1882a203ed57b641674f94/68747470733a2f2f63646e2e7261776769742e636f6d2f73696e647265736f726875732f617765736f6d652f643733303566333864323966656437386661383536353265336136336531353464643865383832392f6d656469612f62616467652e737667 "Awesome")`
Update README.md 2019-01-08 00:26:35 -05:00			`> A curated list of awesome WAF evasion stuff. 🔥`
Update README.md 2019-01-08 00:37:17 -05:00
Update README.md 2019-01-08 00:36:28 -05:00			`![Main Logo](images/how-wafs-work.png 'How wafs work')`
First commit 2019-01-08 00:20:12 -05:00
			`__A Concise Definition:__ A web application firewall is a form of firewall with a set of configured rules that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. (Source [Wikipedia](https://en.wikipedia.org/wiki/Application_firewall))`

			`Feel free to [contribute]().`

			`### Contents:`
Added new definitions for papers. 2019-01-25 20:20:21 -05:00			`- [Awsome WAFs]()`
			`- [Awesome Methodology]()`
			`- [Awesome WAF Detection]()`
			`- [Awesome Evasion Techniques]()`
			`- [Awesome Blogs & Writeups]()`
			`- [Presentations & Research Papers]()`
Update README.md 2019-01-08 00:36:28 -05:00
Added new definitions for papers. 2019-01-25 20:20:21 -05:00			`## Presentations & Research Papers`
			`### Presentations:`
Added a new paper 2019-01-25 23:13:33 -05:00			`- [WAF Profiling & Evasion Techniques](presentations/OWASP%20WAF%20Profiling%20&%20Evasion.pdf) - A WAF testing and evasion guide from [OWASP](https://www.owasp.org).`
			`- [Protocol Level WAF Evasion Techniques](presentations/BlackHat%20US%2012%20-%20Protocol%20Level%20WAF%20Evasion%20(Slides).pdf) - A presentation at about efficiently evading WAFs at protocol level from [BlackHat US 12](https://www.blackhat.com/html/bh-us-12/).`
			`- [WAF: Attacking Detection Logic Mechanisms](presentations/BlackHat%20US%2016%20-%20Analysis%20of%20Attack%20Detection%20Logic.pdf) - A presentation about WAF logic applied to detecting attacks from [BlackHat US 16](https://www.blackhat.com/html/bh-us-16/).`
Added new definitions for papers. 2019-01-25 20:20:21 -05:00
			`### Research Papers:`
Updated and beautified 2019-01-25 23:01:08 -05:00			`- [WASC WAF Evaluation Criteria](papers/WASC%20WAF%20Evaluation%20Criteria.pdf) - A guide for WAF Evaluation from [Web Application Security Consortium](http://www.webappsec.org)`
			`- [Protocol Level WAF Evasion](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf) - A protocol level WAF evasion techniques and analysis by [Qualys](https://www.qualys.com).`
Edited content clearly 2019-01-25 20:24:34 -05:00			`- [WAF Evasion Testing](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf) - A WAF evasion testing guide from [SANS](https://www.sans.org).`