Cloudflare WAF bypass via agent trust in telemetry data

While researching recent web attack trends, I came across an interesting mass-scanning campaign targeting exposed Vite development servers. What caught my attention wasn’t just the vulnerability, but the behaviour behind the attack. Attackers were systematically searching internet-facing applications for sensitive resources such as .env, .git/config, Terraform state files, cloud credentials, configuration files and backups. At first glance, these may look like simple HTTP requests. There may be no obvious SQL injection, XSS or RCE payload. But consider requests like: /.env /.git/config /terraform.tfstate /backup.zip /.aws/credentials One request may not tell us much. But when the same source starts enumerating multiple sensitive paths within a short period, the behaviour itself becomes a security signal. The more important question is: Did the attacker actually get anything? A request to /.env returning 403 or 404 is very different from one returning 200. If a sensitive file was successfully exposed, simply blocking the source IP doesn’t close the incident. We need to understand what information was exposed, whether credentials or tokens need to be rotated, what those credentials could access, and whether there was any follow-on activity. This was my biggest takeaway from looking into this attack: Modern WAF monitoring isn’t only about identifying malicious payloads. Behaviour, context and correlation can sometimes reveal much more than an individual request. A WAF shouldn’t be viewed only as a block/allow control. It can also provide valuable telemetry for understanding what an attacker is attempting and determining the appropriate response. #CyberSecurity #WAF #ApplicationSecurity #IncidentResponse #ThreatDetection #WebSecurity

𝐔𝐍𝐃𝐄𝐑𝐒𝐓𝐀𝐍𝐃 𝐃𝐍𝐒 𝐓𝐔𝐍𝐍𝐄𝐋𝐈𝐍𝐆 𝐓𝐇𝐄 𝐂𝐎𝐍𝐂𝐑𝐄𝐓𝐄 𝐖𝐀𝐘 😎 DNS Tunneling sounds very technical, but once you understand what is actually happening, it becomes hard to unsee. Your company blocks all outbound traffic. No HTTP, no HTTPS. Locked down. But DNS is still open. Without DNS, nothing works. So the firewall almost always lets DNS traffic through. An attacker knows this. Instead of sending data through a normal channel, they encode it inside DNS queries. Your infected machine asks: "Where is the server for aGVsbG8gd29ybGQ=.evil-c2.com?" That weird subdomain is not a real hostname. It is stolen data, encoded in Base64, disguised as a DNS lookup. The attacker controls the authoritative DNS server for evil-c2.com. They decode the subdomain, extract the data, and send commands back inside the DNS response. Your firewall sees nothing suspicious. Just DNS traffic. That is the tunnel. So what can you actually do about it? 1. Monitor DNS query volume per host. A machine making 10,000 queries per hour is not browsing the web. 2. Look at subdomain length and entropy. Encoded payloads are long and random-looking. Tools like Zeek can flag this automatically. 3. Use a DNS security layer. Cloudflare Gateway or Cisco Umbrella can detect tunneling patterns based on query frequency and entropy scoring. 4. Restrict which resolvers your endpoints can use. If a machine only queries your internal resolver, you control what gets logged. 5. Audit DNS logs regularly. A simple query for subdomains longer than 50 characters will surface suspicious activity fast. DNS was designed to translate names into addresses. Attackers turned it into a covert communication channel. Understanding how the tunnel works is the first step to closing it. Follow Me for more concrete breakdowns of real attack techniques. #Cybersecurity #dns

Until now, proving that CDN-based DDoS protection worked, particularly at Layer 7, could be complex, disruptive and heavily dependent on network infrastructure. In some cases, the only real test came when an actual attack occurred. With MazeBolt RADAR’s newly released native Cloudflare integration, teams can quickly identify which attack vectors were mitigated and which may have reached the origin. No mirror ports. No network taps. No packet payloads. No maintenance window. Within hours, security teams can find the gaps, get actionable remediation guidance and revalidate the changes. It turns DDoS readiness from a slow, one-time testing exercise into a continuous cycle: Validate. Remediate. Revalidate. https://lnkd.in/ey4_EUec MazeBolt #DDoS #CyberSecurity #Cloudflare #SecurityValidation #CyberResilience

If you still think SSRF means simply “make the server send a request for me”, you're missing the interesting part. Just this week, Cloudflare added a new WAF detection for SSRF targeting cloud metadata. And recent vulnerabilities continue to show how SSRF can expose internal services and cloud credentials. https://lnkd.in/dSFTVDrm So I decided to break SSRF down from an attacker + defender perspective: 🔹 How SSRF actually works 🔹 In-band vs Blind SSRF 🔹 Real exploitation scenarios 🔹 Common bypass techniques 🔹 Why simple URL/IP blacklists fail 🔹 Defense-in-depth strategies The question isn't just “Can I block SSRF?” It's: “What happens if my first defense fails?” I explored that in my latest article 👇 🔗 https://lnkd.in/dEFweQuJ AppSec engineers — what's the SSRF defense you see developers get wrong most often? #AppSec #CyberSecurity #SSRF #CloudSecurity #DevSecOps #WebSecurity #OWASP

🔐 SECURITY | ⚡ QUICK 2-MIN READ ONE FLOW. ONE CONCEPT. #26 🚨 Can an Attacker Make Your Server Call Another Internal Server? Yes. And this is the idea behind SSRF — Server-Side Request Forgery. Imagine your application has this feature: “Enter a URL and we’ll generate a preview.” Seems harmless: User → Your API → Requested URL But what if the attacker gives your server a URL pointing to an internal service? Now your server becomes the attacker’s proxy. 😨 ⸻ 🧠 What actually happens? Attacker ↓ Your API ↓ "Fetch this URL" ↓ Internal Service ↓ Sensitive Response The attacker may not be able to directly reach the internal service. But your server can. That’s the dangerous part. 🛒 Real-world example Imagine an e-commerce application that accepts an image URL: POST /profile/photo { "imageUrl": "https://lnkd.in/djTzPxvN" } Backend: String url = request.getImageUrl(); RestClient.create() .get() .uri(url) .retrieve() .body(String.class); The developer thinks: “I’m just downloading an image.” But the server is actually saying: “I’ll make an HTTP request to whatever URL you give me.” 🚨 That’s a security risk. 🔥 Why is SSRF dangerous? An attacker may try to make your server access: Internal APIs Internal admin services Cloud metadata endpoints Private network resources localhost services Potential impact: ❌ Sensitive information exposure ❌ Access to internal services ❌ Credential/token exposure ❌ Network reconnaissance ❌ Further attacks against internal systems 🛡️ How do you prevent it? 1️⃣ Don’t accept arbitrary URLs Prefer an allowlist: Allowed domains ↓ example.com cdn.company.com images.company.com Anything else: ❌ Reject 2️⃣ Validate the destination Don’t rely only on: url.startsWith("https://") Validate: Scheme → Host → Port → Resolved IP Also block requests to private/internal network ranges and loopback addresses. 3️⃣ Restrict outbound network access Your application server shouldn’t be able to connect to everything. Use network controls: Application ↓ Outbound Firewall / Proxy ↓ Only approved destinations 4️⃣ Protect cloud environments Cloud metadata services deserve special attention because they can expose sensitive instance information or credentials if improperly accessible. ☕ Safer design Instead of: User URL ↓ Backend ↓ Any destination ❌ Use: User URL ↓ Validate ↓ Allowlist ↓ Resolve & check destination ↓ Outbound Proxy ↓ Approved destination ✅ ⸻ 🎯 ONE-LINE TAKEAWAY SSRF happens when your server becomes an attacker-controlled HTTP client. Never assume: “The user can’t access the internal server, so it’s safe.” If your backend can access it, an unsafe URL-fetching feature might expose it. Validate the destination. Restrict outbound access. Don’t trust user-controlled URLs. #Security #SSRF #CyberSecurity #WebSecurity #OWASP #SpringBoot #Java #APISecurity #Microservices #Backend #SoftwareEngineering #SecureCoding

Basing a security control on a DNS resolution can be insufficient if the hostname is reused later. DNS rebinding follows a TOCTOU logic, for Time-of-Check to Time-of-Use. The target validated by the application may differ from the one actually used when the connection is established. An application receives a user-controlled URL. It resolves the domain, checks that the resulting IP address does not belong to a private range, then authorises the request. At this point, the domain points to a legitimate public IP address. But if the application later reuses the hostname to establish the connection, a second DNS resolution may occur. With a very short TTL, the attacker can make the same domain point to 127[.]0[.]0[.]1, an RFC 1918 address, a cloud metadata endpoint or a service that is only accessible from authorised networks, such as the vulnerable application’s network. The validation and the connection no longer target the same IP address. This is what makes DNS rebinding particularly dangerous on features such as URL imports, webhooks, application proxies, preview generation or remote resource fetching. The risk is close to SSRF. The application becomes a relay to internal resources or to exposed services that trust the application’s source network. 🛡️ Good practices to reduce the risk: 🔸 Validate the IP address at the exact moment the connection is established 🔸 Use the same DNS resolution for both the security check and the connection 🔸 Block private, loopback, link-local and cloud metadata IP ranges 🔸 Disable automatic redirects or strictly revalidate them The key point is to bind the validation to the effective connection, not only to the hostname provided by the user. The article in the comments details exploitation scenarios and the protections to implement 👇 #cybersecurity #ethicalhacking #pentest #DNS

DNS Tunneling: The Exit Door Very Few Watch Organizations tightly control most outbound traffic. DNS is different. Because nearly everything depends on it, DNS is routinely permitted - and sometimes trusted more than it should be. That makes it a useful covert channel. What is DNS tunneling? An attacker encodes commands or stolen data inside DNS queries and responses. Instead of an infected system obviously connecting to an attacker, traffic can flow through the DNS infrastructure the organization already trusts: Endpoint -> DNS Resolver -> Attacker-controlled DNS server To many security controls, it can look like another DNS lookup. And this isn't theoretical. TrickBot - 2026: FortiGuard identified recent TrickBot variants using DNS tunneling for C2 instead of the malware family's more traditional HTTP channel. Detour Dog - 2025: Infoblox documented compromised websites using specially formatted DNS TXT queries and encoded responses to receive instructions and help deliver malware. SUNBURST - 2020: The SolarWinds backdoor encoded victim information into DNS subdomains, allowing operators to quietly identify and triage compromised organizations before activating higher-level C2. What should defenders look for? • Long or high-entropy subdomains • Abnormal query volume to a single domain • Unusual TXT record activity • Unexpected processes generating DNS queries • Endpoints bypassing approved resolvers • Connections to unauthorized DoH providers • Newly registered or low-reputation domains The challenge isn't that DNS tunneling is invisible. It's that you have to be looking at DNS to see it. Suggested Actions? Log DNS centrally. Force endpoints through approved resolvers. Control unauthorized DNS over HTTPS. Baseline normal DNS behavior. Alert on the outliers. DNS isn't just infrastructure. It's security telemetry.

We treat DNS like the digital phonebook of the internet—essential, trusted, and rarely questioned by firewalls. But what happens when attackers turn that fundamental trust against us? In my latest article, "The Dark Side of DNS: Weaponizing Recursive Resolvers for Stealth Data Exfiltration," I explore how adversaries leverage standard DNS traffic to bypass perimeter security and siphon sensitive data completely undetected. Have a read: https://lnkd.in/disNXnGV

TLS can be cryptographically secure — while the application channel is already out of sync. No broken cipher. No obsolete TLS version. No implementation bug. A USENIX Security ’26 paper shows how supporting both implicit and opportunistic TLS can let a MitM manipulate application-layer communication after a valid TLS handshake. The attack is called Opossum. The problem is protocol composition. Protocols such as HTTP, FTP, POP3 and SMTP were originally designed as plaintext, request/response protocols. TLS was later added in two different ways: → Implicit TLS: start the connection directly with TLS. → Opportunistic TLS: start in plaintext, then upgrade to TLS. Individually, both approaches can work. The problem appears when the same service supports both. The attack has three important pieces: 1. The TLS handshake can succeed while application states differ A client using implicit TLS can be redirected toward a server endpoint expecting an opportunistic TLS upgrade. The TLS layer sees a valid handshake. But the application layer can have a different expectation about what message comes next. 2. The attacker exploits that state mismatch The attacker operates as a MitM and manipulates TCP-level traffic without breaking TLS cryptography. The client and server can therefore establish a valid encrypted channel while disagreeing about the application-layer state. That creates an opportunity to shift or inject application messages. 3. Responses can become associated with the wrong requests For HTTP, the researchers demonstrate desynchronization where subsequent request/response pairs can remain shifted. The important distinction: TLS is still encrypting the traffic. The failure is in what the endpoints believe that encrypted traffic represents. And this isn't merely theoretical. The researchers found more than 3 million servers supporting both implicit and opportunistic TLS across multiple protocols. For HTTP, they identified 20,121 servers supporting opportunistic HTTP, including 2,268 that also supported HTTPS. For security teams, this is a useful reminder that a TLS assessment cannot stop at: → TLS 1.2/1.3 → Strong cipher suites → Valid certificates → HSTS → ALPN/SNI configuration You also need to understand how the application protocol enters TLS and what state it expects after the handshake. The researchers recommend avoiding unnecessary opportunistic TLS where possible and discuss protocol separation mechanisms such as distinct ALPN identifiers. “TLS is enabled” tells you almost nothing about whether the application protocol is correctly composed with TLS. When reviewing an internet-facing service, do you inventory every TLS negotiation path — or simply verify that HTTPS works? (Link to the full research paper is in the comments below 👇)

External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. https://cfl.re/4xSRVjO