2

I'm reading someone's slides on bypassing WAFs.

  • &==; : Python Django between parameters;
  • FooBar==POST verb : Apache with PHP;
  • <%I%M%U011e>==<IMG> : IIS ASP Classic;
  • ;/path1 ;foo/path2;bar/;==/path1/path2/ : Apache Tomcat;

On one page he mentions the string &==;-. Does anyone know the meaning of "between parameters"?

8

Read it as: & == ;

This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a given URL.

Consequently, the following URLs would be treated identically:

https://example.com/foo/bar?x=y&name=peter&debug=1
https://example.com/foo/bar?x=y;name=peter;debug=1

This is remarkable because other frameworks might not recognize the semicolon as a separator and read the second query string as a single parameter x with the value y;name=peter;debug=1. This behavior might in turn confuse WAFs which is likely why it's listed on your slides.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.