FUZZING AND BYPASSING THE AWS WAF

Summary from the TLDR InfoSec newsletter

The Sysdig Threat Research Team discovered a payload that utilizes the onbeforetoggle HTML attribute to bypass the AWS WAF’s Managed Rules’ protection. This post details how they built a fuzzer to fuzz for XSS payloads against the AWS WAF and details the bypass that they discovered. The vulnerability was patched by AWS after it was reported.