## Overview During a private bug bounty program for a large e-commerce platform, I was mapping out the search functionality. Like most modern applications, the search application was protected by a Web Application Firewall (WAF) that aggressively filtered common payloads like ` ">

``` The WAF immediately blocked the request, returning a `403 Forbidden` response. I started fuzzing to determine exactly what characters and strings were blacklisted. * `>` and `<` were permitted. * `script` was blocked. * `on*` event handlers were heavily restricted (e.g., `onerror`, `onload`). * `javascript:` pseudo-protocol was blocked. ## The Bypass Since `on*` event handlers were blocked, I started looking into HTML5 features and specific payload structures that fire without them. One interesting behavior I noticed was how the backend handled Unicode characters *before* passing them to the WAF, compared to how the frontend browser parsed them. I crafted a payload utilizing the `autofocus` attribute coupled with `onfocus`, but obscured the `onfocus` string. My initial attempt: ```html "> ``` *Blocked by WAF (caught `onfocus`).* Then, I started using HTML entities. The backend JSON parser didn't care about HTML entities, but the browser would execute them when the frontend injected the JSON value directly into the DOM using `innerHTML`. I encoded the payload using Decimal HTML Entities: ```html "> ``` *Blocked. WAF was smart enough to decode HTML entities.* Next, I looked at URL encoding mixed with HTML entities, but the breakthrough came when I used an anchor tag with a `data:` URI scheme and Base64 encoding. The WAF didn't inspect the contents of Base64 encoded data URIs within `iframe` or `object` tags. ```html

``` The WAF allowed this through, because it didn't strictly block `