theMiddle·Jan 6, 2019How To Exploit PHP Remotely To Bypass Filters & WAF RulesIn the last three articles, I’ve been focused on how to bypass WAF rule set in order to exploit a remote command execution. In this…
theMiddle·Jan 6, 2019Web Application Firewall (WAF) Evasion Techniques #3This article explores how to use an uninitialized Bash variable to bypass WAF regular expression based filters and pattern matching. Let’s…
theMiddle·Aug 12, 2018DNSBL: Not just for spamUsing DNS in order to block botnet, spammers and Tor with Nginx, Lua, ModSecurity and FakeDNS
theMiddle·Jul 3, 2018AppArmor: Say Goodbye to Remote Command Execution.How to kill RCE and RFI directly on the php-fpm process. Let’s do a test exploiting Drupalgeddon2.
theMiddle·Mar 1, 2018PHP SSRF TechniquesHow to bypass filter_var(), preg_match() and parse_url()A response icon8A response icon8
theMiddle·Jan 3, 2018Web Application Firewall (WAF) Evasion Techniques #2String concatenation in a Remote Command Execution payload makes you able to bypass firewall rules (Sucuri, ModSecurity)A response icon6A response icon6
theMiddle·Dec 27, 2017Detecting human users: Is there a way to block enumeration, fuzz or web scan?No, you won’t be able to totally block them, but you would be surprised how stupid some bots are! Nginx + Lua FTW.
theMiddle·Dec 8, 2017Web Application Firewall (WAF) Evasion TechniquesI can read your passwd file with: “/???/??t /???/??ss??”. Having fun with Sucuri WAF, ModSecurity, Paranoia Level and more…A response icon3A response icon3
theMiddle·Nov 14, 2017ModSecurity + Elasticsearch + KibanaHow to store ModSecurity Audit Logs in Elasticsearch and how to make searches and reports using KibanaA response icon7A response icon7
