2019-01-26 08:07:07 -05:00
# Awesome WAF 
2019-01-26 12:39:49 -05:00
> A curated list of awesome WAF stuff.
2019-01-08 00:37:17 -05:00
2019-01-08 00:36:28 -05:00
2019-01-08 00:20:12 -05:00
__A Concise Definition:__ A web application firewall is a form of firewall with a set of configured rules that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. *(Source [Wikipedia](https://en.wikipedia.org/wiki/Application_firewall))*
Feel free to [contribute]().
### Contents:
2019-01-26 08:07:07 -05:00
- [Awesome WAFs List ](#awesome-waf-list )
2019-01-26 02:37:22 -05:00
- [Awesome Testing Methodology ](#testing-methodology )
2019-01-29 08:27:54 -05:00
- [Awesome WAF Detection ](#waf-detection )
- [Awesome Evasion Techniques ](#evasion-techniques )
2019-01-26 02:37:22 -05:00
- [Awesome Tools ](#awesome-tools )
- [Awesome Blogs & Writeups ](#blogs-and-writeups )
- [Awesome Presentations & Papers ](#presentations--research-papers )
## Awesome WAFs List
2019-01-28 00:27:14 -05:00
< table >
2019-01-29 08:27:54 -05:00
< tr >
< td >
< a href = "http://360.cn" > 360 WangZhanBao< / a >
< / td >
< td >
A WAF solution from 360 Security Team.
< / td >
< / tr >
< tr >
< td >
< a href = "https://www.airlock.com/products/airlock-waf/" > Airlock< / a >
< / td >
< td >
The Airlock Web Application Firewall offers a unique combination of protective mechanisms for web applications. Each access is systematically monitored and filtered at every level. It features reverse proxy, central checkpoint, filtering, API security and dynamic whitelisting.
< / td >
< / tr >
< tr >
< td >
< a href = "http://www.anquanbao.com" > Anquanbao< / a >
< / td >
< td >
A cloud based WAF solution for enterprises featuring big data analysis, clustering solutions, content optimisations, and access accelerations.
< / td >
< / tr >
< tr >
< td >
< a href = "https://www.armor.com/armor-web-application-firewall-service" > Armor< / a >
< / td >
< td >
2019-01-29 10:50:58 -05:00
A virtual WAF solution by Armor technologies which protects web-applications from OWASP top 10 attacks and features accurate response and remediation via applied intelligence from their threat centre.
2019-01-29 08:27:54 -05:00
< / td >
< / tr >
< tr >
< td >
2019-01-29 10:50:58 -05:00
< a href = "https://f5.com/products/big-ip/application-security-manager-asm" > Application Security Manager< / a >
2019-01-29 08:27:54 -05:00
< / td >
< td >
A comprehensive web application firewall from F5 Networks that protects apps and data from known and unknown threats, defends against bots that bypass standard protections, and virtually patches app vulnerabilities.
< / td >
< / tr >
< tr >
< td >
< a href = "https://aws.amazon.com/waf/" > Amazon AWS WAF< / a >
< / td >
< td >
A WAF solution from Amazon AWS that features full time web-traffic filtering, virtual patching, traffic visibility, attack transparency integrated with customisable rules.
< / td >
< / tr >
< tr >
< td >
< a href = "https://cloud.baidu.com" > Baidu Cloud WAF< / a >
< / td >
< td >
A cloud based protection system from Baidu to effectively defend against web application attacks. It features cloud based real-time protections, load balancing, DDoS protection and its own content-delivery network.
< / td >
< / tr >
< tr >
< td >
< a href = "https://www.barracuda.com/products/webapplicationfirewall" > Barracuda< / a >
< / td >
< td >
A WAF solution from Barracuda Networks featuring web aplication, API, and mobile apps against various attacks. Beside it provides DDoS protections, automated attack and bot protections, access controls and authentication protections.
< / td >
< / tr >
< tr >
< td >
2019-01-29 10:50:58 -05:00
< a href = "http://binarysec.org" > BinarySEC< / a >
< / td >
< td > A solution from BinarySec which provides all round security protections from many kinds of threats. BinarySec WAF allows active whitelisting while peotecting your site from major known threats and malware.
< / td >
< / tr >
< tr >
< td >
< a href = "https://www.blockdos.net > BlockDoS< / a >
< / td >
< td > A WAF solution which features high performance in-built content delivery systems, custom SSL, DNS protection, dynamic caching and stable DDoS protection.
< / td >
< / tr >
< tr >
< td >
< a href = "https://en.chinacache.com/managed-web-application-firewall/" > ChinaCache< / a >
< / td >
< td > A featured firewall for China which features its own content-delivery network, virtual patching and constant threat discovery transparency report.
2019-01-29 08:27:54 -05:00
< / td >
< / tr >
< tr >
< td >
< a href = "" > Kona Site Defender< / a >
< / td >
< td >
A cloud based WAF solution from Akamai technologies that feaures a proprietary WAF rule set, created and automatically updated based on visibility into the latest attacks with protections. It provides API security integrated with DevOps security, report visibility, etc.
< / td >
< / tr >
2019-01-28 00:27:14 -05:00
< / table >
2019-01-26 02:37:22 -05:00
## Testing Methodology
Alright, now lets see the approach of testing WAFs. Wait, before that we need to know how they work right? Here you go.
### How WAFs Work:
- Using a set of rules to distinguish between normal requests and malicious requests.
- Sometimes they use a learning mode to add rules automatically through learning about user behaviour.
### Operation Modes:
- __Negative Model (Blacklist based)__ -
One that defines what is not allowed. Eg. Block all `<script>*</script>` inputs.
- __Positive Model (Whitelist based)__ -
One that defines what is allowed and rejects everything else.
- __Mixed/Hybrid Model (Inclusive model)__ -
One that uses a mixed concept of blacklisting and whitelisting stuff.
### Where To Look:
- Always look out for common ports that expose that a WAF `80` , `443` , `8000` , `8008` , `8080` , `8088` .
> __Tip:__ You can use automate this easily by commandline using a screenshot taker like [WebScreenShot](https://github.com/maaaaz/webscreenshot).
- Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
- Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
- Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, Big IP WAF).
- Some WAFs expose themselves in the response content (eg. DotDefender, Armor, truShield Sitelock).
- Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight).
### Detection Techniques:
1. Make a normal GET request from a browser, intercept and test response headers (specifically cookies).
2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
3. If there is a login page somewhere, try some common (easily detectable) payloads like `' or 1 = 1 --` .
4. If there is some search box or input field somewhere, try detecting payloads like `<script>alert()</script>` .
5. Make GET requests with outdated protocols like `HTTP/0.9` (`HTTP/0.9` does not support POST type queries).
6. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.
2019-01-26 08:07:07 -05:00
> __Tip:__ This method could be easily achieved with tools like [HPing3](http://www.hping.org) or [Scapy](https://scapy.net).
2019-01-26 02:37:22 -05:00
7. Side Channel Attacks - Examine the timing behaviour of the request and response content.
## WAF Detection
Wanna detect WAFs? Lets see how.
> __NOTE__: This section contains manual WAF detection techniques. You might want to switch over to [next section](#awesome-tools).
2019-01-28 07:55:38 -05:00
< table >
2019-01-29 08:27:54 -05:00
< tr >
< td >
360 Firewall
< / td >
< td >
< ul >
< li > < b > Detectability:< / b > Easy < / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Returns status code < code > 493< / code > upon unusual requests.< / li >
< li > On viewing source-code of error page, you will find reference to < code > wzws-waf-cgi/< / code > directory.< / li >
< li > Source code may contain reference to < code > wangshan.360.cn< / code > URL.< / li >
< li > Response headers contain < code > X-Powered-By-360WZB< / code > Header.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
aeSecure
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains < code > aesecure_denied.png< / code > image (view source to see).< / li >
< li > Response headers contain < code > aeSecure-code< / code > value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Airlock (Phion/Ergon)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate/Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > < code > Set-Cookie< / code > headers may contain < code > AL-SESS={some value}< / code > value (case insensitive).< / li >
< li > Response headers may contain < code > AL-LB={some value}< / code > value (case insensitive).< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Anquanbao WAF
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Returns blocked HTTP response code < code > 405< / code > upon malicious requests.< / li >
< li > Blocked response content may contain < code > /aqb_cc/error/< / code > or < code > hidden_intercept_time< / code > .< / li >
< li > Response headers contain < code > X-Powered-by-Anquanbao< / code > header field.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Armor Defense
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains warning< br >
< code > This request has been blocked by website protection from Armor.< / code >
< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Application Security Manager (F5 Networks)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains warning< br >
< code > The requested URL was rejected. Please consult with your administrator.< / code >
< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Amazon AWS WAF
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain < code > AWS< / code > value.< / li >
< li > Blocked response status code return < code > 403 Forbidden< / code > response.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Yunjiasu WAF (Baidu)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain < code > Yunjiasu-ngnix< / code > value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Barracuda WAF
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response cookies may contain < code > barra_counter_session< / code > value.< / li >
< li > Response headers may contain < code > barracude_< / code > keyword.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
BIG-IP ASM (F5 Networks)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers may contain < code > BigIP< / code > or < code > F5< / code > keyword value.< / li >
< li > Response header fields may contain < code > X-WA-Info< / code > header.< / li >
< li > Response headers might have jumbled < code > X-Cnection< / code > field value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
BinarySec WAF
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain < code > binarysec< / code > keyword value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
BlockDos
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers may contain reference to < code > BlockDos.net< / code > URL.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
ChinaCache Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain < code > Powered-by-ChinaCache< / code > field.< / li >
< li > Blocked response codes contain < code > 400 Bad Request< / code > error upon malicious request.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
ACE XML Gateway (Cisco)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers have < code > ACE XML Gateway< / code > value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Cloudbric
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response content has< code > Cloudbric< / code > and < code > Malicious Code Detected< / code > values.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Cloudflare
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers might have < code > cf-ray< / code > field value.< / li >
< li > < code > Server< / code > header field has value < code > cloudflare< / code > .< / li >
< li > < code > Set-Cookie< / code > response headers have < code > __cfuid=< / code > cookie field.< / li >
< li > Page content might have < code > Attention Required!< / code > or < code > Cloudflare Ray ID:< / code > .< / li >
< li > You may encounter < code > CLOUDFLARE_ERROR_500S_BOX< / code > upon hitting invalid URLs.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Cloudfront (Amazon)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains < code > Error from cloudfront< / code > error upon malicious request.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Comodo Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain < code > Protected by COMODO WAF< / code > value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
CrawlProtect (Jean-Denis Brun)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response content contains value< br > < code > This site is protected by CrawlProtect< / code > .< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
IBM WebSphere DataPower
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contains field value value < code > X-Backside-Transport< / code > with value < code > OK< / code > or < code > FAIL< / code > .< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Deny-All Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response content contains value < code > Condition Intercepted< / code > .< / li >
< li > < code > Set-Cookie< / code > header contains cookie field < code > sessioncookie< / code > .< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Distil Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain field value < code > X-Distil-CS< / code > in all requests.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
DoSArrest Internet Security
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Response headers contain field value < code > X-DIS-Request-ID< / code > .< / li >
< li > Response headers might contain < code > DOSarrest< / code > keyword.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
dotDefender
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains value< br > < code > dotDefender Blocked Your Request< / code > .< / li >
< li > Blocked response headers contain < code > X-dotDefender-denied< / code > field value.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
EdgeCast (Verizon)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains value< br > < code > Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon)< / code > .< / li >
< li > Blocked response code returns < code > 400 Bad Request< / code > on malicious requests.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Expression Engine (EllisLab)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains value < code > Invalid GET Request< / code > upon malicious GET queries.< / li >
< li > Blocked POST type queries contain < code > Invalid POST Request< / code > in response content.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
FortiWeb Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response content contains value < code > .fgd_icon< / code > keyword.< / li >
< li > Response headers contain < code > FORTIWAFSID=< / code > on malicious requests.< / li >
< li > < code > Set-Cookie< / code > header has cookie field < code > cookiesession1=< / code > .< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
HyperGuard Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > < code > Set-Cookie< / code > header has cookie field < code > ODSESSION=< / code > in response headers.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Imperva Incapsula
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response page content may contain:< / li >
< ul >
< li > < code > Incapsula incident ID< / code > keyword.< / li >
< li > < code > _Incapsula_Resource< / code > keyword.< / li >
< li > < code > subject=WAF Block Page< / code > keyword.< / li >
< / ul >
< li > Normal GET request headers contain < code > visid_incap< / code > value.< / li >
< li > Response headers may contain < code > X-Iinfo< / code > header field name.< / li >
< li > < code > Set-Cookie< / code > header has cookie field < code > incap_ses< / code > in response headers.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
Jiasule Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response page contains reference to < code > static.jiasule.com/static/js/http_error.js< / code > URL.< / li >
< li > < code > Set-Cookie< / code > header has cookie field < code > __jsluid=< / code > in response headers.< / li >
< li > Response headers have < code > jiasule-WAF< / code > or < code > jsl_tracking< / code > keywords.< / li >
< li > Blocked response content has < code > notice-jiasule< / code > keyword.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
KnownSec Firewall
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response page displays < code > ks-waf-error.png< / code > image (view source to see).< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
KONA Site Defender (Akamai)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Easy< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Headers contain < code > AkamaiGHost< / code > keyword.< / li >
< / ul >
< / ul >
< / td >
< / tr >
< tr >
< td >
ModSecurity (Trustwave)
< / td >
< td >
< ul >
< li > < b > Detectability: < / b > Moderate/Difficult< / li >
< li > < b > Detection Methodology:< / b > < / li >
< ul >
< li > Blocked response page contains:< / li >
< ul >
< li > < code > This error was generated by Mod_Security< / code > text.< / li >
< li > < code > One or more things in your request were suspicious< / code > text.< / li >
< li > < code > rules of the mod_security module< / code > text.< / li >
< / ul >
< li > Response headers may contain < code > Mod_Security< / code > or < code > NYOB< / code > keywords.< / li >
< / ul >
< / ul >
< / td >
< / tr >
2019-01-28 07:55:38 -05:00
< / table >
2019-01-29 08:27:54 -05:00
## Evasion Techniques
2019-01-26 02:37:22 -05:00
Lets look at some methods of bypassing and evading WAFs.
## Awesome Tools
### WAF Fingerprinting:
__1. Fingerprinting with [NMap ](https://nmap.org )__:
2019-01-26 12:39:49 -05:00
2019-01-26 08:07:07 -05:00
__Source:__ [GitHub ](https://github.com/nmap/nmap ) | [SVN ](http://svn.nmap.org )
2019-01-26 02:37:22 -05:00
- Normal WAF Fingerprinting
2019-01-28 00:27:14 -05:00
2019-01-26 02:37:22 -05:00
```
nmap --script=http-waf-fingerprint < target >
```
- Intensive WAF Fingerprinting
```
2019-01-26 12:39:49 -05:00
nmap --script=http-waf-fingerprint --script-args http-waf-fingerprint.intensive=1 < target >
2019-01-26 02:37:22 -05:00
```
- Generic Detection
2019-01-29 08:27:54 -05:00
```
2019-01-28 00:27:14 -05:00
nmap --script=http-waf-detect < target >
2019-01-26 02:37:22 -05:00
```
__2. Fingerprinting with [WafW00f ](https://github.com/EnableSecurity/wafw00f )__:
2019-01-28 00:27:14 -05:00
__Source:__ [GitHub ](https://github.com/enablesecurity/wafw00f ) | [Pypi ](https://pypi.org/project/wafw00f )
2019-01-26 02:37:22 -05:00
```
wafw00f < target >
```
### WAF Testing:
2019-01-26 08:07:07 -05:00
- [WAFBench ](https://github.com/microsoft/wafbench ) - A WAF performance testing suite by [Microsoft ](https://github.com/microsoft ).
- [WAF Testing Framework ](https://www.imperva.com/lg/lgw_trial.asp?pid=483 ) - A free WAF testing tool by [Imperva ](https://imperva.com ).
2019-01-26 02:37:22 -05:00
### WAF Evading:
__1. Evading WAFs with [SQLMap Tamper Scripts ](https://medium.com/@drag0n/sqlmap-tamper-scripts-sql-injection-and-waf-bypass-c5a3f5764cb3 )__:
- General Tamper Testing
```
2019-01-29 08:27:54 -05:00
sqlmap -u < target > --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
2019-01-26 02:37:22 -05:00
```
- MSSQL Tamper Testing
```
2019-01-29 08:27:54 -05:00
sqlmap -u < target > --level=5 --risk=3 -p 'item1' --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
2019-01-26 02:37:22 -05:00
```
- MySQL Tamper Testing
```
2019-01-29 08:27:54 -05:00
sqlmap -u < target > --level=5 --risk=3 -p 'item1' --tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
2019-01-26 02:37:22 -05:00
```
- Generic Tamper Testing
```
sqlmap -u < target > --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
```
2019-01-26 12:39:49 -05:00
2019-01-26 13:01:24 -05:00
__2. Evading WAFs with [WAFNinja ](https://waf.ninja/ )__
2019-01-28 00:27:14 -05:00
__Source:__ [GitHub ](https://github.com/khalilbijjou/wafninja )
2019-01-26 12:39:49 -05:00
- Fuzzing
```
python wafninja.py fuzz -u < target > -t xss
```
- Bypassing
```
python wafninja.py bypass -u < target > -p "name=< payload > & Submit=Submit" -t xss
```
- Insert Fuzzing
```
python wafninja.py insert-fuzz -i select -e select -t sql
```
__3. Evading WAFs with [WhatWaf ](https://github.com/ekultek/whatwaf )__:
Source: [GitHub ](https://github.com/ekultek/whatwaf )
2019-01-26 02:37:22 -05:00
```
whatwaf -u < target > --ra --throttle 2
```
2019-01-08 00:36:28 -05:00
2019-01-25 20:20:21 -05:00
## Presentations & Research Papers
### Presentations:
2019-01-25 23:13:33 -05:00
- [WAF Profiling & Evasion Techniques ](presentations/OWASP%20WAF%20Profiling%20&%20Evasion.pdf ) - A WAF testing and evasion guide from [OWASP ](https://www.owasp.org ).
- [Protocol Level WAF Evasion Techniques ](presentations/BlackHat%20US%2012%20-%20Protocol%20Level%20WAF%20Evasion%20(Slides ).pdf) - A presentation at about efficiently evading WAFs at protocol level from [BlackHat US 12 ](https://www.blackhat.com/html/bh-us-12/ ).
2019-01-25 23:30:12 -05:00
- [Analysing Attacking Detection Logic Mechanisms ](presentations/BlackHat%20US%2016%20-%20Analysis%20of%20Attack%20Detection%20Logic.pdf ) - A presentation about WAF logic applied to detecting attacks from [BlackHat US 16 ](https://www.blackhat.com/html/bh-us-16/ ).
- [WAF Bypasses and PHP Exploits ](presentations/WAF%20Bypasses%20and%20PHP%20Exploits%20(Slides ).pdf) - A presentation about evading WAFs and developing related PHP exploits.
2019-01-25 23:54:19 -05:00
- [Playing Around with WAFs ](presentations/Playing%20Around%20with%20WAFs.pdf ) - A small presentation about WAF profiling and playing around with them from [Defcon 16 ](http://www.defcon.org/html/defcon-16/dc-16-post.html ).
2019-01-25 20:20:21 -05:00
### Research Papers:
2019-01-25 23:01:08 -05:00
- [WASC WAF Evaluation Criteria ](papers/WASC%20WAF%20Evaluation%20Criteria.pdf ) - A guide for WAF Evaluation from [Web Application Security Consortium ](http://www.webappsec.org )
- [Protocol Level WAF Evasion ](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf ) - A protocol level WAF evasion techniques and analysis by [Qualys ](https://www.qualys.com ).
2019-01-25 20:24:34 -05:00
- [WAF Evasion Testing ](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf ) - A WAF evasion testing guide from [SANS ](https://www.sans.org ).
2019-01-28 07:55:38 -05:00
- [WAF Evaluation and Analysis ](papers/Web%20Application%20Firewalls%20-%20Evaluation%20and%20Analysis ) - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from [University of Amsterdam ](http://www.uva.nl ).
2019-01-26 12:39:49 -05:00
- [Bypassing all WAF XSS Filters ](papers/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf ) - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
2019-01-29 10:50:58 -05:00
- [Neural Network based WAF for SQLi ](papers/Artificial%20Neural%20Network%20based%20WAF%20for%20SQL%20Injection ) - A paper about building a neural network based WAF for detecting SQLi attacks.
