- [Narrator] There are different ways
that an attacker can bypass different types of protections,
including web application firewalls,
different type of filtering capabilities
in different frameworks, and so on,
by introducing different evasion techniques.
Now, in the website that I'm highlighting here,
which is basically a section of the owasp.org website,
it includes different examples
on how to perform different methods of evasion
for bypassing security controls,
like web application firewalls.
I am not gonna go over every single example here,
but in short, you know, this list includes
the concatenation of different SQL statements
that can be sent to a web application
for the purpose of evasion
and also different types of encoded mechanisms
that you can use for performing this type of attacks.
Now, a few of them
are using HTTP parameter pollution attacks, or HPP,
and there are a few examples in here,
Using that HTTP parameter pollution,
or where you see the vulnerable code,
and the actual request from that hacker, right?
Now, there's also using parameter fragmentation.
So, fragmenting the different parameters
of the SQL statements
that the attacker can actually send to a web application,
and you see a few examples down below as well.
So, I strongly recommend for you
to become familiar with these techniques.
They go beyond what the scope of the exam is.
What you need to know
is the different encoding and evasion mechanisms
that an attacker can use to bypass security controls
and security tools, like a web application firewall.