Anomaly 12-15 - While My WAF Gently Weeps - All Parts

Anomaly 12

One of the coloumbs has this interesting alert attached to it. Sorting by that revals a couple ip addresses

Sorting and removing dupicates plus combing leaves me with

Anomaly 13

So we know the return method was a 200 se lets sort by that first. Then we see that it is using a site called MeterWise analytics lets try filtering that down

My coloumb i filter for Meterwise analystics and see a few options but one stands out. Having to readd the one to the user agent gets us the flag

Anomaly 14

So we need to filter bassed on sql injection so I am looking for the word OR in the uri

There is the latest one excel, have to put in other time format

Anomaly 15

We are looking for path transversal so we need to filter based on ../

One line doesnt have a snort alert attached to it