This tweet discusses a technique to bypass a Web Application Firewall (WAF) by accepting any parameters. The idea is to bypass the WAF's regex rules that scan incoming requests for malicious patterns. By allowing any parameters, the WAF's regex-based detection can be circumvented, potentially enabling various attacks such as XSS, SQLi, or other injection vulnerabilities to go undetected.
Beneran param apa aja diterima, tujuannya buat bypass regex rule-nya WAF.
— Novran. (@xchopath) September 20, 2025