Forum Discussion

NoamRotter's avatar
NoamRotter
Icon for Altostratus rankAltostratus
Dec 31, 2019

How to block Time-Based Blind SQL Injection Attacks

I have a web app and a PT was successful to perform this attack: https://mywebsite/Login.aspx?test=;waitfor delay '0:0:__TIME__'— The VS has ASM profile with server technologies: IIS MSSQL ASP....
application delivery
ASM Advanced WAF
security
NoamRotter's avatar
NoamRotter
Icon for Altostratus rankAltostratus
Dec 31, 2019

I have noticed that Parameter * was in staging

and URL * was in staging.

Enforcing them made the attack to be blocked.