Re:How I bypassed Cloudflare's SQL Injection filter
by nexuist on Friday September 18, 2020 @09:32PM
(#24524004)
This makes a lot of assumptions, for example:
1) You are the only one working on this project and there are no other people who may have varying experience levels or development schedules
2) You are in charge of all the software running on the machine and have the time to audit all of it
3) You are capable of writing software like this and didn't just contract it out to some firm
4) You are capable of writing software at all
WAFs are not perfect but there is clearly a market for them. It's not useful to high end tech companies because they have the in-house expertise (including red team/blue team staff) to avoid these pitfalls, which is expertise most small businesses and town/city-level govt agencies can't afford.
1) You are the only one working on this project and there are no other people who may have varying experience levels or development schedules
2) You are in charge of all the software running on the machine and have the time to audit all of it
3) You are capable of writing software like this and didn't just contract it out to some firm
4) You are capable of writing software at all
WAFs are not perfect but there is clearly a market for them. It's not useful to high end tech companies because they have the in-house expertise (including red team/blue team staff) to avoid these pitfalls, which is expertise most small businesses and town/city-level govt agencies can't afford.