Thread by @alxbrsn

This would be so cool to read if I wasn't HALFWAY THROUGH DOING MY OWN WRITEUP ABOUT THE EXACT SAME THING.

gosecure.net/2018/04/03/bey…

I am so salty right now

Anyway, just gonna dump any stuff I found that's not covered in that article here

1. Much easier and straight-forward way to bypass XSS auditors and WAFs is by adding <!--esi--> whenever needed:

<scr<!--esi-->ipt>aler<!--esi-->t(1)</sc<!--esi-->ript>

2. If he<!--esi-->llo turns into hello but he<!--esx-->llo isn't modified you have ESI injection

3. Akamai, by design, lets you do some pretty cool stuff. You can modify headers to flip the content-type of the current request to turn any endpoint into XSS. You can also steal cookies even if the victim doesn't have javascript on.

Go read Akamai's developer guide for all the crazy stuff you can do with ESII akamai.com/cn/zh/multimed…

(response code too if you need an external redirect)

4. If you got blind ESII but want to see the "source code" Akamai provides a way to pivot:

<esi:include src="/anypage.html" dca="none" />

(dca=none tells it to ignore ESI directives on the included page)

That's about it. Weeks of research into a couple of tweets

Oh and how could I forget. Akamai and Oracle *both* let you craft POST requests with custom headers and body. CSRF but on the edge server. ESRF.