{JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries
summary
Finds that JSON-in-SQL payloads let simple SQL injection reach databases despite WAFs, demonstrates a real CN Maestro SQLi that exfiltrates tokens, SSH keys and fully controls access points, and shows AWS, Cloudflare, F5, Imperva and Palo Alto initially accept the malformed requests. Builds a modified sqlmap module that injects JSON-based operators and returns integers reassembled into text, tests the technique across vendors, and confirms a generic WAF bypass that works in practice and prompts vendors to add JSON parsing.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:07AWS WAF blockage
- 8:10JSON in SQL bypass
- 12:27JSON injection payloads
- 14:59Exploiting the vulnerability
- 17:32Testing WAF vendors
- 18:57Automating with SQLmap
- 20:19Disclosure and implications
- 21:45Summary and future research
- 23:11Q&A
related talks
22mSecure Your Code — Injections and Logging
28mXSS, CSRF, CSP, JWT, Wtf? Idk
22mIntegrating Security Measures Throughout Development
47mEsoteric Web Application Vulnerabilities
34mJS Security - A Pentesters Perspective
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
28mOffensive and Defensive Strategies for Client-Side JS Security