{"id":221,"date":"2024-01-24T19:06:00","date_gmt":"2024-01-24T12:06:00","guid":{"rendered":"https:\/\/n45ht.or.id\/blog\/?p=221"},"modified":"2025-10-14T22:53:24","modified_gmt":"2025-10-14T15:53:24","slug":"bypassing-razers-waf-for-xss","status":"publish","type":"post","link":"https:\/\/n45ht.or.id\/blog\/bypassing-razers-waf-for-xss\/","title":{"rendered":"Bypassing Razer’s WAF for XSS"},"content":{"rendered":"\n

While testing Razer\u2019s web application, I identified an XSS vulnerability<\/strong> in their \/ajax<\/code> endpoint. The issue arises due to insufficient validation of the URL<\/code> parameter, allowing JavaScript execution despite filtering attempts. This write-up outlines how I discovered the parameter using Arjun, crafted a bypass for their filters and successfully executed a proof of concept (PoC).<\/p>\n\n\n\n

To begin, I used Arjun<\/strong>, a tool designed to identify query parameters that web applications accept and process. Running the following command revealed the presence of the URL<\/code> parameter:<\/p>\n\n\n\n

arjun -u https:\/\/www2.razer.com\/ajax<\/code><\/pre>\n\n\n\n
Arjun reported that the URL<\/code> parameter was being processed by the server. Further testing revealed that its value was reflected in the response.<\/p>\n\n\n\n
When passing a value to the URL<\/code> parameter, the application rendered the following HTML response:<\/p>\n\n\n\n
Request:<\/strong><\/p>\n\n\n\n
https:\/\/www2.razer.com\/ajax?URL=https:\/\/google.com<\/code><\/pre>\n\n\n\n
Response:<\/strong><\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span>