Collected research
Bypassing Web-Application Firewalls by abusing SSL/TLS
A web application firewall can only inspect traffic in the cipher suites it is able to decrypt. Comparing the vendor's supported cipher list against an sslscan of the origin server reveals ciphers the backend accepts but the WAF does not, and forcing one of them with curl --ciphers makes the request opaque, so blocked paths and payloads pass straight through.
Record
- Published by
- 0x09AL Security blog
- Date
- Topic
- Crypto
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of 0x09AL Security blog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .