Changes between Initial Version and Version 1 of Ticket #33212, comment 5


Ignore:
Timestamp:
Oct 21, 2021, 7:32:41 PM (3 years ago)
Author:
Mr. Glass

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #33212, comment 5

    initial v1  
    55> As far as I'm aware you will first need to convince users to use such a browser.
    66
    7 One common vulnerability from parsing mismatch is a WAF bypass. If the WAF & application have a parsing mismatch, you can trick the WAF into allowing requests through. See the 'Messing around with a WAF parser' section for an example https://blog.isec.pl/waf-evasion-techniques/
     7One common vulnerability from parsing mismatch is a WAF bypass. If the WAF & application have a parsing mismatch, you can trick the WAF into allowing requests through. See the 'Messing around with a WAF parser' section of this article for an example https://blog.isec.pl/waf-evasion-techniques/
    88
    9 Typically this is because WAFS have bad parsers, but the vulnerability works either way. This would be typically used for sql injection  and would not require any user interaction.
     9Typically this is because WAFs have bad parsers, but the vulnerability works either way. This is often used for sql injection  and would not require any user interaction.
    1010
    1111Take this theoretical cookie:
    … …  
    1515
    1616A python based WAF would see the user_id as a non malicious integer, while Django would have the value ";' DROP TABLE important_data" ready to be injected.
    17 This attack would require 0 user interaction.
     17
     18No interaction from the user, just a carefully crafted request from an attacker.
    1819
    1920Thankfully in Django, this attack would require custom authentication that was vulnerable to sql injection, since the ORM protects us.
Back to Top