Bypassing a WAF With Autocomplete
A few months ago, I was looking at a popular New Zealand website. I came across their search feature.
and found that when I interacted with the search box, it queried this endpoint to fetch the search results<snip>/ViewSuggestSearch-Suggest&SearchTerm=tshirt<div class="suggest-results-list search-spring">
<button type="button" class="close" title="Close"><span>×</span></button>
<div class="suggest-suggestion-list col-xs-6">
<h3>Search Suggestion</h3>
<ul>
<li class="classic">
<button type="butto...
Read more at jessie.cafe