How I bypassed Cloudflare's SQL Injection filter

Re:How I bypassed Cloudflare's SQL Injection filter by gskourou on Friday September 18, 2020 @04:47PM (#24521745)

I have also seen backend application which strip out certain "bad" tags (i.e. <script>).

I remember being able to perform an XSS attack by sending a payload that looked like:

<sc<script>ript>alert(/XSS/)</sc<script>ript>

This passed the WAF inspection, but then got trimmed by the backend application and this is what was left:

written in the page source.

Maybe I'll write about that case too if I find where I put the attack evidence. You can anyway see that bad validation by the actual application programmers can disable the WAF's capabilities.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by colejohnson66 on Friday September 18, 2020 @06:11PM (#24522377)

Isn’t the correct solution to replace '<' and '>' with '<' and '>'?

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by yyyk on Saturday September 19, 2020 @02:45PM (#24529594)

The correct solution is to apply Content-Security-Policy plus character escaping as needed.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by krapp on Friday September 18, 2020 @06:14PM (#24522397)

Yeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by tannhaeuser on Saturday September 19, 2020 @02:33AM (#24525623)

Or, you know, using ordinary SGML validation which has the capability to block disallowed elements since 1986.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by gskourou on Friday September 18, 2020 @06:25PM (#24522458)

amen

[ Parent | on HN ]