GCP BigQuery LeakyLooker CHR Concat Bypass

Tim Peck@timpeck

•updated Mar 10, 2026•1•0•105

Detects BigQuery queries using CONCAT with CHR functions to dynamically build cross-project paths, bypassing dot filters. High-fidelity indicator of LeakyLooker-style SQL injection.