full-disclosure - [FD] Web Application Firewall bypass via F5 Big-IP partial URI decoding

Open Source and information security mailing list archives

Date: Mon, 20 Apr 2020 13:53:56 +0200 (CEST)
From: RedTimmy Security <redazione@...fault.it>
To: fulldisclosure@...lists.org
Subject: [FD] Web Application Firewall bypass via F5 Big-IP partial URI
	decoding

Hi
we have published a new post in our blog titled "How to hack a company by circumventing its WAF for fun and profit – part 2".

We basically shows how the absence of URI decondig or partial URI decoding can both be abused to circumvent custom iRules.

Full story is here: https://www.redtimmy.com/web-application-hacking/how-to-hack-a-company-by-circumventing-its-waf-for-fun-and-profit-part-2/

regards
RedTimmy Security

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives