HPP Lab 3 - WAF Evasion via HPP


Product Search

A WAF is protecting this search endpoint. It blocks any request containing <script in the search parameter.

Can you bypass the WAF and get your XSS payload through?

Hint: Try sending ?search[]=<scri&search[]=pt>alert(1)</script>


Hint (click to reveal)

Use the URL: ?search[]=<scri&search[]=pt>alert(1)</script>
The WAF checks each value separately. Neither contains the full <script string, so it passes. The backend concatenates them into the full payload.


Back to HPP Labs  |  More web challenges at RatCTF →  |  Get certified: Web App Pentesting (CxWAP) →