SafeLine WAF Review Finds Protection Gaps and Demonstrates Mythic C2 Proxying

Summary

A sponsored hands-on review tests SafeLine WAF against SQL injection, XSS, directory traversal, command injection and HTML injection, then demonstrates proxying Mythic C2 traffic and protecting file access with authentication. The tester reports several protection gaps.

Key points

• In lab testing, the WAF blocked more than 6,000 sqlmap requests; the tester reported no successful SQL injection and no bypass of the protections tested.
• Directory traversal to system directories was not blocked in defense mode, while a file-inclusion attempt involving /etc/passwd was blocked.
• Command injection worked in the default balanced mode but was blocked after switching to strict mode.
• HTML injection rendered injected H1 content, including with XSS protection set to strict mode.
• The video demonstrates routing Mythic beacon traffic through a VPS-hosted SafeLine WAF reverse proxy to a C2 listener.
• A file-serving demonstration shows the WAF requiring authentication and user authorization before granting access.
• The presenter discusses bot protection and HTML/JavaScript encryption for phishing pages but does not show a practical phishing demonstration.

MITRE ATT&CK

Vendors

Products

Tools

Related Articles

• CrowdStrike 2026 Threat Hunting Report Highlights Faster Exploitation and Rising Identity Attacksgithub.com/jacobdjwilsonBurp Suite · Mythic C2 · T1190
• Dataminr’s 2026 Threat Report Highlights Identity Attacks and Larger Cyber Lossesgithub.com/jacobdjwilsonBurp Suite · T1071.001 · T1190
• BlackCrypt Malware Uses Signed RMM Agent to Hide Phishing Luresrogueauthority.orgOpenSSL · T1059.001 · T1071.001
• Recorded Future Reports 34% Rise in Actively Exploited CVEs in H1 2026github.com/jacobdjwilsonT1059.001 · T1071.001 · T1190
• Attackers Exploit AhsayCBS Flaws to Deploy Webshells and XMRig Minershuntress.comT1059.001 · T1071.001 · T1190