wafwafwaf
Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud Platform WAF
on Monday March 14, 2022 @02:45AM (#30669201)
https://docs.aws.amazon.com/waf/latest/developerguide/limits...
Pad your POST query by 8k and you are through!
Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud Platform WAF
on Sunday March 13, 2022 @07:53PM (#30667005)
It's fair to say that they are waf for the mass! Basic modsec provides much better security...
AWS has the same bypass (documented). The WAF provided by cloud providers is more to protect their infrastructure from noise than clients. Unfortunately this type of restrictions are never evaluated. You can really tell if a WAF provider is serious when reviewing the whitelisting. (i.e. not just a on/off).