The Sleepy User Agent
May 17, 2016John Graham-Cumming
Summary
This post details a specific attack vector where SQL injection is attempted via the User-Agent header, demonstrating how blind SQL injection can be used to infer database structure and data by observing response delays. It highlights the vulnerability of unsanitized input in HTTP headers and provides a secure code example using prepared statements in PHP to prevent such attacks. The Cloudflare WAF is mentioned as a mitigation for SQL injection attempts.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack