{JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF

Team82 details a novel, generic web application firewall (WAF) bypass that exploits mismatched JSON-in-SQL parsing between modern database engines and WAFs. By prepending or embedding JSON syntax in SQL injection payloads (using JSON operators/functions supported by PostgreSQL, MySQL, SQLite, etc.), attackers can evade detection by multiple major WAF products (Palo Alto, AWS, Cloudflare, F5, Imperva) and exfiltrate data; Team82 demonstrates payload construction, automation (SQLMap integration), and notes vendor fixes following disclosure.