SQL Injections in Headers

[Azareal]

https://blog.cloudflare.com/the-sleepy-user-agent/
This one is kind of interesting, although not entirely unexpected or shocking.

They're trying to do a SQL Injection via the user agent header, most likely for a site that does some sort of analytics without parametrising the inputs from headers (maybe because they think Apache / Nginx magically clean them?).

 

[Page]

That was back 2016 and I like the sleepy part blog

 

[Azareal]

That was back 2016 and I like the sleepy part blog

I think part of the problem here is that it's easy for people to overlook and a lot of servers don't log headers, so webmasters sometimes assume there's nothing wrong lol

 

[TopSilver]

That was back 2016 and I like the sleepy part blog

I like it too. Funny how they call it that just because it's a test to see if it works. Also interesting to me that they would tell you how to do it as well haha as if waiting for someone to try and learn how.