From 42ff9fdbc3f7c3ab75f49d9cfd0f5ba386ad4ec2 Mon Sep 17 00:00:00 2001 From: 0xInfection Date: Wed, 13 Feb 2019 18:55:39 +0530 Subject: [PATCH] Added stuff --- README.md | 137 ++++++++++++++++++++---------------------------------- 1 file changed, 51 insertions(+), 86 deletions(-) diff --git a/README.md b/README.md index cd65d5b..f2e53fd 100644 --- a/README.md +++ b/README.md @@ -18,85 +18,25 @@ Feel free to [contribute](CONTRIBUTING.md). - [Awesome Blogs & Writeups](#blogs-and-writeups) - [Awesome Presentations & Papers](#presentations--research-papers) -## Awesome WAFs List -Here are all commonly known WAFs: - - - - - - - - - - - - - - - - - - - - - - - - - - -
- 360 WangZhanBao - - Airlock -
- Anquanbao - - Armor -
- Application Security Manager - - Amazon AWS WAF -
- Baidu Cloud WAF - - Barracuda -
- BinarySec - - BlockDoS -
- ChinaCache - - -
- - -## Testing Methodology -Alright, now lets see the approach of testing WAFs. Wait, before that we need to know how they work right? Here you go. - -### How WAFs Work: +## How WAFs Work: - Using a set of rules to distinguish between normal requests and malicious requests. - Sometimes they use a learning mode to add rules automatically through learning about user behaviour. -### Operation Modes: -- __Negative Model (Blacklist based)__ - -One that defines what is not allowed. Eg. Block all `` inputs. -- __Positive Model (Whitelist based)__ - -One that defines what is allowed and rejects everything else. -- __Mixed/Hybrid Model (Inclusive model)__ - -One that uses a mixed concept of blacklisting and whitelisting stuff. +## Operation Modes: +- __Negative Model (Blacklist based)__ - A blacklisting model uses pre-set signatures to block web traffic that is clearly malicious, and signatures designed to prevent attacks which exploit certain website and web application vulnerabilities. For example, if a number of IP addresses send a lot more packets than is typical for that many IP addresses being used to surf a website, a blacklisting firewall can effectively prevent DDoS attacks. Blacklisting model web application firewalls are a great choice for websites and web applications on the public internet, because those targets can get a lot of legitimate web traffic from unfamiliar client machines. Eg. Block all `` inputs. +- __Positive Model (Whitelist based)__ - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for casting a wide metaphorical fishing net for blocking possible cyber-attacks, but just as fishing nets also catch a lot of matter that a fisherman can't sell, whitelisting will block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees. +- __Mixed/Hybrid Model (Inclusive model)__ - A hybrid security model is one that blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet. +## Testing Methodology: ### Where To Look: - Always look out for common ports that expose that a WAF `80`, `443`, `8000`, `8008`, `8080`, `8088`. > __Tip:__ You can use automate this easily by commandline using a screenshot taker like [WebScreenShot](https://github.com/maaaaz/webscreenshot). - Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF). - Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF). -- Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, Big IP WAF). -- Some (often rare) expose themselves in the `Server` header (eg. Approach WAF). +- Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, F5 Big IP). +- Some (often rare) expose themselves in the `Server` header (eg. Approach, WTS WAF). - Some WAFs expose themselves in the response content (eg. DotDefender, Armor, Sitelock). -- Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight). +- Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight, 360 WAF). ### Detection Techniques: 1. Make a normal GET request from a browser, intercept and test response headers (specifically cookies). @@ -1611,15 +1551,28 @@ script/src="data:text%2Fj\u0061v\u0061script,\u0061lert(1)"> waf bypass` + +##### Step 2: + ## Known Bypasses: -- __Cloudflare__ - Cross Site Scripting _([Source1](https://twitter.com/ArbazKiraak/status/1090654066986823680), [Source2](https://twitter.com/LooseSecurity/status/1094615936223625216?s=20))_ +### __Cloudflare__ +- Cross Site Scripting _([Source1](https://twitter.com/ArbazKiraak/status/1090654066986823680), [Source2](https://twitter.com/LooseSecurity/status/1094615936223625216?s=20))_ ``` X