PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Whitelisting an IP Address for Penetration Testing in Cloudflare

projectblack.io | research | #waf | #penetration-testing | #cloudflare | #rate-limiting | #whitelisting | #web-application
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Why to whitelist a penetration tester's IP in Cloudflare's WAF: rate limits slow testing and the WAF can mask code-level flaws. Includes steps for a skip rule, then re-testing with the WAF enabled.
Published
Collected

Related coverage

blog · bishopfox.com
Are You Giving Out Cheat Codes if You Whitelist Pen Testers?
Brianne Hughes explains why whitelisting pen testers is a scoping decision driven by project goals rather than a cheat code, and when bypassing WAFs better simulates real attackers.
blog · yeswehack.com
Web application firewall bypass
Bypassing web application firewalls after a flaw is found: abusing regex and blacklist weaknesses, normalisation quirks and frontend/backend filter collisions to slip payloads past WAFs.
research · projectblack.io
Free DNS Filtering
DNS-based filtering is a free, low-effort control: using a security resolver like Cloudflare's 1.1.1.3 stops malicious domains resolving. The post covers its limits and how to roll it out via DHCP.
research · portswigger.net
HTTP/1.1 must die: the desync endgame
HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.
research · portswigger.net
When security features collide
James Kettle argues stacked security features can make systems easier to exploit, demonstrating a Cloudflare email obfuscation quirk that bypasses its WAF and all browser XSS filters.
research · portswigger.net
Bypassing Web Cache Poisoning Countermeasures
James Kettle examines and bypasses vendor countermeasures to web cache poisoning from Cloudflare, Akamai and Fastly, flagging pitfalls like cacheable block pages enabling DoS.
Back