Re:How I bypassed Cloudflare's SQL Injection filter
by gregplaysguitar on Friday September 18, 2020 @09:34PM
(#24524013)
We’ve had a couple of similar issues with AWS WAF recently, in one case it blocked any request body containing :// (i.e. any URL) claiming it was a file system path. In the other we had a 3rd party cookie containing `= null` and the WAF thought it was sqli. I guess I can see the argument about layering multiple imperfect defences, but we wasted hours diagnosing these, neither were real issues, so I’m not sold on the value at this point.
[ Parent
| on HN ]
Re:How I bypassed Cloudflare's SQL Injection filter
by sk5t on Friday September 18, 2020 @09:42PM
(#24524078)
Many of WAF's canned rule sets are ridiculously broad. I'm content to use the low-reputation-IP rules, but almost nothing else is advisable, unless you're intent on exposing (and not fixing?) a badly-written service to the world.
Re:How I bypassed Cloudflare's SQL Injection filter
by azalemeth on Saturday September 19, 2020 @06:02AM
(#24526352)
The low reputation IP rules are a pain in the arse -- and I say that as someone who frequently falls foul of them. I often have to use tor to get around government blocks. The fact that Google and cloudfare hate tor users is just an extra kick in the teeth.
If your web app is vulnerable being brute forced, fix it, don't blame the users...