Webknight web application firewall bypass and Solution

Today, I went to t00ls and found that someone was discussing webknight and I set up an environment locally yesterday. So I 'd like to see if I can skip webknight.

Problem 1. By default, the software does not intercept background logon boxes 'or' = 'or'

Problem 2. This software does not intercept % by default

As we all know, when we often guess tables and fields, we need to enter

And (select count (*) from table) to check whether the table exists

And union select 1, 2, 3, 4, 5 from admin to view several fields,

And 1 = 2 union select 1, username, password, 4, 5 from admin to guess the user and password.

Figure 1. Normally intercepted.


Figure 2. Use % to bypass it perfectly ..


The solution is also relatively simple. Add the corresponding keywords and characters to WebKnight. xml.