Hacker News new | ask | show | jobs
by hkr_mag 3642 days ago
4. Another great example is detecting exploitation of Java Unserialize vulnerabilities (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-web...).

WebSphere takes payload in Base64 inside the XML. To parse everything (and do it fast), unfold the structure and detect the attacks is still almost impossible thing for most of the WAFs
1 comments
0xmohit 3642 days ago
A security company citing another security company blog to describe a vulnerability.

I <3 it!

--

BTW, in order to use Wallarm one needs to pay upwards of $1000 pm. In order to pacify themselves that it works, one either need to write poor code that exhibits XEE or pay further to use WebSphere. Nice.

link
hkr_mag 3642 days ago
Pity you get it in this way. Exploit for WebSphere is just an example of a complicated case with Base64 inside XML where Wallarm can detect malicious request other WAF usually fails.

And, no one asked to pay anything until getting proper results while 30 days free pilot (it could be extended). Give it a try

link