Talk Intermediate

The Art of WAF Evasion: Techniques That Still Work

Rejected

Session Description

🔥 The Ultimate WAF Slayer’s Guide 🔥

Web Application Firewalls (WAFs) are praised as the ultimate defense against web attacks. Security teams trust them blindly, assuming they can block all malicious traffic. But what if I told you that most WAFs can be outsmarted?

Attackers are constantly evolving, discovering lesser-known weaknesses and creative ways to slip past WAF protections effortlessly. In this session, I will break down the hidden flaws of modern WAFs and demonstrate advanced bypass techniques that aren’t commonly discussed.

🚀 What you'll learn:

✅ How attackers analyze & dismantle WAF defenses like a puzzle

✅ Lesser-known bypass techniques that leave traditional security measures useless

✅ Why conventional filtering methods fail against truly creative attackers

✅ Real-life case studies from my own vulnerability discoveries and the ones that gave me my oracle hall of fame

💀 By the end of this session, you won’t just understand WAF bypassing—you’ll become a WAF Slayer.

Session Categories

FOSS

Speakers

pavitra jha Security Researcher

My name is Pavitra Jha. I am 15 years old and have been in the field of ethical hacking and cyber security for the past 5 years.

About my programming knowledge:

- Python

- JavaScript

- HTML

- CSS

- Perl

- Bash

- Java

- MySQL

- Kotlin

- Solidity

- C/C++

- C#

I am proficient in object-oriented programming concepts as well.

*Don't judge by my age.*

About my expertise:

I specialize in various areas including:

- Web application pentesting

- Blockchain/Web3 Security

- Mobile application pentesting

- IoT pentesting

- API pentesting

- Social engineering

- OSINT (Open Source Intelligence)

- Forensics

- Malware analysis & development

- Reverse engineering

- Binary exploitation

- Code Review

- OSI model security

- Prompt Engineering

About my achievements:

1. I have received hall of fame acknowledgments from Google, Oracle and Moon Pay.

2. I have discovered numerous valid vulnerabilities in Bing, Google, IBM, and Facebook, and have contributed to their resolution.

3. I achieved the 29th rank individually out of 73,000 teams in a national level coding hackathon held by Codingal.

4. I obtained the Google Data Analyst certification.

5. My name has been featured in the Sarasvi Times newspaper.

6. I secured an internship with VIEH group at the age of 13.

7. I am also working with the Thane Cyber Crime department on a contract basis.

8. I hold the Indian Book of Records title for being the youngest ethical hacker in India. Additionally, I am the youngest ethical hacker to secure an internship from a private limited company in India.

9. I secured a scholarship from Nullcon Goa 2023, earning me a free corporate pass to the event.

10. Mentor for IITians.

11. Speaker at THM Mumbai Chapter and NulCon