Re: Protection for new WAF bypass for SQL injection json based payload

--===============6979552765274582663==
Content-Type: multipart/alternative; boundary="0000000000007ebe0405efb7db87"

--0000000000007ebe0405efb7db87
Content-Type: text/plain; charset="UTF-8"

Hi All,

for simplified version of the method refer
https://www.imperva.com/blog/abusing-json-based-sql/

Thanks,
Homesh


On Tue, Dec 13, 2022 at 9:30 PM homesh joshi <[email protected]> wrote:

> Hi All,
>
> Has any one tested the new method mentioned here https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf
>
>
> any successfully block the same with modsec ?
>
> Thanks,
> Homesh
>
>

--0000000000007ebe0405efb7db87
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi All,</div><div><br></div><div>for simplified versi=
on of the method refer <a href=3D"https://www.imperva.com/blog/abusing-json=
-based-sql/">https://www.imperva.com/blog/abusing-json-based-sql/</a></div>=
<div><br></div><div>Thanks,</div><div>Homesh<br></div><div><br></div></div>=
<br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue=
, Dec 13, 2022 at 9:30 PM homesh joshi &lt;<a href=3D"mailto:homeshj@gmail.=
com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex"><div dir=3D"ltr"><div>Hi All,</div><div><br></div><di=
v>Has any one tested the new method mentioned here <a href=3D"https://claro=
ty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-=
waf" target=3D"_blank">https://claroty.com/team82/research/js-on-security-o=
ff-abusing-json-based-sql-to-bypass-waf <br></a></div><div><br></div><div>a=
ny successfully block the same with modsec ?</div><div><br></div><div>Thank=
s,</div><div>Homesh<br></div><br></div>
</blockquote></div>

--0000000000007ebe0405efb7db87--


--===============6979552765274582663==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============6979552765274582663==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============6979552765274582663==--