AutoSpear: Towards Automatically Bypassing and Inspecting Web Application Firewalls
summary
AutoSpear is an automated framework that generates semantics-preserving SQLi variants by parsing queries into a hierarchical SQL tree and mutating nodes with a context-free grammar plus new mutation operators, guided by a heuristic search. It evaluates candidates against live WAF-as-a-service deployments (Cloudflare, AWS WAF, F5 and others), verifies semantics on multiple runtimes and datasets (100 hand-crafted cases, Kaggle and GitHub corpora), and reports up to 99% success rate against some targets by injecting control characters and comment-based mutations.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:31Web Application Firewall (WAF)
- 5:14WAF Bypass
- 7:14Semi-Auto: SQLMap tamper scripts
- 11:16Challenges
- 12:44Hierarchical Tree Representation
- 15:19Monte-carlo Tree Search Guided Searching
- 16:47Payload Reconstruction
related talks
26mBridging the Gap Between Research and Practice in Intelligently Bypassing WAF
40mWeb Application Firewalls: Analysis of Detection Logic
27mSecuring Applications and Managing WAFs at a large scale
46mAutomating Security Testing with Functional Testing Test Cases
37mWeb Application Firewall Bypassing
14mWeb Application Firewalls: A False Sense of Security?
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
09mAutomated Application Security Testing