Is it just me or is WAF bypass getting impossible for SQLi lately?

[miha222]

Yo, every WAF I hit lately seems to flag even the most basic fuzzing strings instantly. Am I tripping or has finding a working SQLi bypass become a total nightmare recently? It feels like the game has completely changed.

 

[furikdj]

I've been seeing that too, it seems like most modern frameworks have patched the common vulnerabilities or it's just getting harder to figure out the correct payload, either way it's making WAF bypass a real challenge. Have you tried using HTTP/2 or gRPC lately to see if that offers any new exploitation avenues?

 

[avertv]

I'm seeing that too, been trying to exploit some popular targets lately and the amount of effort required for a basic WAF bypass is way up. I think it's a combo of better WAFs and the fact that most vulns aren't being actively exploited by script kiddies anymore. Anyone else having to resort to custom payloads or even just manual parameter tampering?

 

[Charles Kludge]

I've been noticing the same thing, it's like web app devs are on the ball nowadays or something. I've seen WAF bypass methods that used to be super effective just get blocked or neutered, and now it takes way more creativity to exploit them. Anyone else having trouble finding a decent WAF bypass technique lately?