# WAF as a weapon and DOS as a bullet

WAF body-size inspection bypass lets attacker plant a WAF-blocked payload in a victim's cookie, causing persistent 403 DoS for the cookie's lifetime.

- Payout: Research
- Severity: low
- Disclosed: 2024-05-28
- Write-up quality: 6/10
- Original: https://zhero-web-sec.github.io/research-and-things/waf-as-a-weapon-and-dos-as-a-bullet
- Library page: https://bugbountylibrary.com/r/blog%3Azhero-web-sec-github-io-research-and-things-waf-as-a-weapon-and-dos-as-a-bullet
- Tags: area:web domain:web impact:dos kind:research platform:research sev:low tech:aws technique:chained vuln:dos vuln:misconfiguration

**Target:** WAF-protected web app with parameter reflected into cookies
**Root cause:** WAFs skip body inspection beyond a default size limit, and response inspection is disabled by default, so a payload placed after an oversized parameter reaches the server and is reflected into a Set-Cookie header uninspected.
**Steps:**
1. Find a parameter whose value is reflected into a cookie, ideally via POST without CSRF protection.
2. Craft an HTML page (CSRF-style) auto-submitting a POST with a first parameter whose value exceeds the WAF's max inspection size, followed by the target parameter set to a WAF-blocked payload like `' OR SLEEP(10);--`.
3. Victim visits attacker page; request bypasses WAF body inspection and server sets the malicious cookie.
4. Subsequent victim requests carry the payload in cookies, are inspected, and get blocked with 403 until the cookie expires.
**How found:** Inspired by Shubs' NahamCon 2024 WAF bypass talk and the nowafpls request-size technique; noticed marketing/tracking parameters reflected into cookies and tested whether a WAF-blocked value could be planted there.
**Exploitation:** Attacker hosts an auto-submitting HTML form; the oversized parameter tanks the WAF inspection, the malicious value is reflected into Set-Cookie (response not inspected), and every later victim request is blocked by the WAF for the cookie lifetime (1 month observed).
**Escalation:** Can be combined with XSS to set the cookie without user interaction.
**Insight:** Look for unauthenticated POST parameters reflected into Set-Cookie (A/B testing, tracking); combine with a body-size WAF bypass to plant a blocked payload that then poisons every subsequent request.