Light

Episode #902 Quiz

A Generic WAF Bypass
Date: 2022-12-20 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Team82 found a generic WAF bypass across Palo Alto, F5, AWS, Cloudflare, and Imperva by exploiting JSON support mismatch: modern SQL engines parse JSON by default, but WAFs often do not. Crafted JSON syntax hid malicious SQL, enabling injection and database exfiltration. Vendors patched their SQL inspection logic.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the key parsing mismatch that made Team82’s generic WAF bypass work against multiple vendors’ products?

Question 1

According to the episode, what was the key parsing mismatch that made Team82’s generic WAF bypass work against multiple vendors’ products?

URL-encoded SQL was normalized by WAF parsers but rejected by database engines XML fragments were stripped by database engines but preserved by WAF parsers GraphQL syntax was recognized by WAF parsers but not by database engines JSON syntax was recognized by database engines but not by the WAF parsers

Question 2: Which specific JSON operator did Team82 say threw the WAFs into loops and enabled the bypass?

Question 2

Which specific JSON operator did Team82 say threw the WAFs into loops and enabled the bypass?

The JSON operator @> The JSON operator ?| The JSON operator #>> The JSON operator ->>

Question 3: Which set of vendors was explicitly named as having WAF products affected by Team82’s discovery?

Question 3

Which set of vendors was explicitly named as having WAF products affected by Team82’s discovery?

Oracle, Juniper, SonicWall, Trend Micro, and McAfee Palo Alto Networks, F5, Amazon Web Services, Cloudflare, and Imperva Cisco, Check Point, Akamai, Zscaler, and Barracuda Citrix, Fortinet, Microsoft, Mozilla, and SAP

Question 4: What did the episode say Elon’s attempt to block all the bots did to Twitter’s legitimate users?

Question 4

What did the episode say Elon’s attempt to block all the bots did to Twitter’s legitimate users?

It disabled all direct messages for verified accounts worldwide It forced all users to rotate their passwords before logging in It rate-limited only bot-detection endpoints on the web app It blocked entire IP blocks used by mobile carriers across Asia

Question 5: According to the episode, what was the end-of-next-year deadline associated with GitHub submitters?

Question 5

According to the episode, what was the end-of-next-year deadline associated with GitHub submitters?

They must migrate all code-signing keys before the end of 2024 They must submit updated modules before the end of 2030 They must delete all public repositories before the end of 2026 They must move all issue tracking to an approved federal platform

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.