Blacklists are all too commonly seen as a defense against all kinds of attacks. I’ll be discussing the perils of using blacklists and how easily they can be bypassed for attacks such as Cross-Site Scripting (XSS), SQL Injection (SQLi), and File Uploads. I’ll share some of the techniques I’ve used to bypass clients’ blacklists. I will also cover why whitelists should be favored over blacklists and some techniques for proper implementation.