Collected research

Exploiting "Google BigQuery" SQL Injection Vulnerability

Akamai Web Application Firewall Bypass Journey: Exploiting “Google BigQuery” SQL Injection Vulnerability

Duc Nguyen The · hackemall.live

A bug bounty target's parameter was injectable into a Google BigQuery SQL query sitting behind Akamai Kona WAF. By profiling which keywords the WAF blocked and then using BigQuery's LENGTH and STRPOS with a division-by-zero error as the true/false oracle, the author read table contents character by character without union, sleep or mid.

Record

Document

Akamai Web Application Firewall Bypass Journey: Exploiting “Google BigQuery” SQL Injection Vulnerability

Researcher

Duc Nguyen The

Published by

hackemall.live

Topic

Injection

In the archive

• Collected in the 2020 research round

Tags

• sqli
• waf-bypass
• filter-bypass
• injection
• waf
• database
• gcp
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Duc Nguyen The, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.