Light Bulb WAF Auditing Framework
Summary: LightBulb is an open source Python framework for auditing web application firewalls and filters, built on automata learning algorithms that model a WAF remotely by querying it and observing output. Its authors, George Argyros and Ioannis Stais, presented the approach at BlackHat Europe 2016 and report finding over 10 previously unknown vulnerabilities in WAFs including Mod-Security, PHPIDS and Expose, enabling SQL Injection and XSS attacks that bypassed the firewalls.
What you should know: The framework's premise is that a WAF can be learned from the outside using only query-and-observe access, and it produced over 10 previously unknown bypasses in widely deployed products like Mod-Security - a reminder that a WAF's detection logic is itself an attack surface that can be mapped and evaded.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026