The WAF Blocked My XSS — So I Rotated What It Was Reading

Summary

Member-only story What’s up everyone! Nitin here 👋 Real talk: the WAF is not there to stop you. It’s there to stop the first payload you copy-pasted from a tweet. That’s it. The moment you understand that, half of these “unexploitable” open redirects turn into real, paying XSS bugs. This is the post I wish someone handed me when I was staring at an Akamai block page thinking the bug was dead. It’s not dead — you just knocked on the front door when the whole point is to walk around the back. Why open redirect + XSS live in the same house Most hunters treat these as two separate bugs. That’s the mistake. An open redirect is you controlling where the browser goes next. XSS is you controlling what the browser executes. The bridge between them is the humble javascript: URI scheme. When a redirect param drops your value into Location: or into client-side code like window.location = params.get(‘next’) , you don’t just control a destination — you potentially control a scheme. And javascript:alert(document.domain) is a perfectly valid URL scheme as far as a browser is concerned. Open redirect = “I control the URL.” If I control the URL, I might control the scheme. If I control the scheme, javascript: = XSS.

By Nitin yadav

Original Article