SlideShare a Scribd company logo

Blind WAF identification

•
•
Miroslav Stampar
Miroslav Stampar

These are the slides from a talk "Blind WAF identification" held at Sh3llCON 2019 (Santander / Spain)

Internet
1 of 36
Download to read offline
Blind WAF identificationBlind WAF identification Miroslav Stampar (@stamparm) Blind WAF identificationBlind WAF identification Miroslav Stampar (@stamparm)
Sh3llCON, Santander (Spain) January 26th, 2019 2 Who am I?Who am I? FOSS programmer, Croatian Government CERT (daily), #infosec researcher (nightly), CTF enthusiast (sporadically)
Sh3llCON, Santander (Spain) January 26th, 2019 3 Talk overviewTalk overview What is WAF? How to (dummy) provoke it? Typical reactions Real-life examples WAF detection Non-blind WAF identification Blind WAF identification identYwaf (https://github.com/stamparm/identYwaf)
Sh3llCON, Santander (Spain) January 26th, 2019 4 What is WAF? (I)What is WAF? (I) WAF (Web Application Firewall) Protects web applications by monitoring and filtering (HTTP/S) traffic Security hardening by making more difficult exploitation of web application security flaws Does not replace the network firewall Deployed between the network firewall and the web server infrastructure (inspects unencrypted traffic) To (potentially) bypass it, penetration tester (first) needs to recognize the type (!)
Sh3llCON, Santander (Spain) January 26th, 2019 5 What is WAF? (II)What is WAF? (II) Source: avinetworks.com
Sh3llCON, Santander (Spain) January 26th, 2019 6 What is WAF? (III)What is WAF? (III) Prevents exploitation of common web security vulnerabilities (flaws): SQL Injection (SQLi) Cross-Site Scripting (XSS) File Inclusion (FI) Cross-Site Request Forgery (CSRF) XML External Entity (XXE) Local / Remote Code Execution (LCE / RCE) Directory Traversal … Note: OWASP Top 10
Sh3llCON, Santander (Spain) January 26th, 2019 7 How to (dummy) provoke it?How to (dummy) provoke it?
Sh3llCON, Santander (Spain) January 26th, 2019 8 Typical reactionsTypical reactions “Bad request” “Access denied” “Not acceptable” “Request denied” “URL was rejected” “Forbidden” “Request could not be satisfied” “Attempt has been blocked” “Blocked your request” etc.
Sh3llCON, Santander (Spain) January 26th, 2019 9 Real-life examples (360)Real-life examples (360)
Sh3llCON, Santander (Spain) January 26th, 2019 10 Real-life examples (Cloudflare)Real-life examples (Cloudflare)
Sh3llCON, Santander (Spain) January 26th, 2019 11 Real-life examples (dotDefender)Real-life examples (dotDefender)
Sh3llCON, Santander (Spain) January 26th, 2019 12 Real-life examples (Incapsula)Real-life examples (Incapsula)
Sh3llCON, Santander (Spain) January 26th, 2019 13 Real-life examples (ModSecurity)Real-life examples (ModSecurity)
Sh3llCON, Santander (Spain) January 26th, 2019 14 Real-life examples (Sucuri)Real-life examples (Sucuri)
Sh3llCON, Santander (Spain) January 26th, 2019 15 Real-life examples (Virusdie)Real-life examples (Virusdie)
Sh3llCON, Santander (Spain) January 26th, 2019 16 Real-life examples (Wordfence)Real-life examples (Wordfence)
Sh3llCON, Santander (Spain) January 26th, 2019 17 WAF detection (I)WAF detection (I) Sending dummy payload(s) (deliberate, provocative, not dangerous): <script>alert('XSS')</script> ' OR SLEEP(5) OR ' (etc.) Usage of random-generated GET/POST parameter names (e.g. ?oFx=...) Detection of any kind of response changes compared to the original: HTTP code (200 OK → 403 Forbidden) HTML title (Homepage → Attention Required!) Occurrence(s) of rejection specific keywords (- → ...you have been blocked...)
Sh3llCON, Santander (Spain) January 26th, 2019 18 WAF detection (II)WAF detection (II) Original WAF provoked
Sh3llCON, Santander (Spain) January 26th, 2019 19 Non-blind WAF identification (I)Non-blind WAF identification (I) After the (successful) detection phase, in identification phase we are trying to identify the web application security product (i.e. WAF) In best case (non-blind) provoked WAF will respond with specific response trails which distinguishes it from other products Keywords / sentences (e.g. dotDefender Blocked Your Request) HTTP codes (e.g. 999 No Hacking) HTTP headers (e.g. Server: BinarySec) HTTP cookies (e.g. jsl_tracking=….) File paths (e.g. .../wzws-waf-cgi/...)
Sh3llCON, Santander (Spain) January 26th, 2019 20 Non-blind WAF identification (II)Non-blind WAF identification (II) @sqlmap (case) / --identify-waf WAF scripts (currently 77) Each covers one specific WAF (protection system) 4 (+1 NIL) dummy payloads / attack vectors Checking page content, headers and (HTTP) code after each payloads
Sh3llCON, Santander (Spain) January 26th, 2019 21 Non-blind WAF identification (III)Non-blind WAF identification (III)
Sh3llCON, Santander (Spain) January 26th, 2019 22 Non-blind WAF identification (IV)Non-blind WAF identification (IV)
Sh3llCON, Santander (Spain) January 26th, 2019 23 Blind WAF identification (I)Blind WAF identification (I) How to distinguish different WAF types when there are only TRUE (generic rejected) and FALSE (original) responses? Similar problem like in boolean-based blind SQL injection, though, with more constraints (i.e. there is no data source to pull data from) In theory, different WAFs should have different protection engines with different set of rules Hence, different WAFs should answer differently to a predefined list of dummy payloads (“battery of tests”) Final goal: characteristic vectors (signatures)
Sh3llCON, Santander (Spain) January 26th, 2019 24 Blind WAF identification (II)Blind WAF identification (II)
Sh3llCON, Santander (Spain) January 26th, 2019 25 Blind WAF identification (III)Blind WAF identification (III)
Sh3llCON, Santander (Spain) January 26th, 2019 26 identYwaf (I)identYwaf (I) WAF detection and identification tool Non-blind support for 70 WAFs and blind support for 64 WAFs (74 WAFs in total) Non-blind recognition implemented by usage of regular expressions over raw HTTP response (including HTTP headers) Blind recognition implemented by usage of inference based on response(s) comparison with predefined characteristic vectors (signatures) of size 45 (payloads) Based on extensive (empirical?) study
Sh3llCON, Santander (Spain) January 26th, 2019 27 identYwaf (II)identYwaf (II)
Sh3llCON, Santander (Spain) January 26th, 2019 28 identYwaf (III)identYwaf (III)
Sh3llCON, Santander (Spain) January 26th, 2019 29 identYwaf (IV)identYwaf (IV) Calculating difference (distance) between response vector and WAF characteristic vectors (signatures) Smaller the difference, greater the match Periodic safe-checking for potential complete blocking (dummy digit payload) Detection of WAF “chaining” based on different rejection HTTP codes (e.g. 403 and 500) or Server headers (e.g. nginx and imunify360-webshield/1.5) Auxiliary “hardness” score (i.e. strictness)
Sh3llCON, Santander (Spain) January 26th, 2019 30 identYwaf (V)identYwaf (V)
Sh3llCON, Santander (Spain) January 26th, 2019 31 identYwaf (VI)identYwaf (VI)
Sh3llCON, Santander (Spain) January 26th, 2019 32 identYwaf (VII)identYwaf (VII)
Sh3llCON, Santander (Spain) January 26th, 2019 33 identYwaf (VIII)identYwaf (VIII)
Sh3llCON, Santander (Spain) January 26th, 2019 34 Future workFuture work Dealing with strict (rate-limiting) WAFs (e.g. usage of proxy list) Extensive testing of WAF capabilities (e.g. POST body, different encodings, etc.) Detailed reporting for the sake of bypassing (e.g. only FI payloads are blocked, POST body is not being processed, only characters < and > are being blocked, etc.) Collaborative sharing of unknown signatures (e.g. automatic Github issue) Bypass “recommendations”
Sh3llCON, Santander (Spain) January 26th, 2019 35 p.s. “Hardness” (not WAF scoring!)p.s. “Hardness” (not WAF scoring!)
Sh3llCON, Santander (Spain) January 26th, 2019 36 Questions?Questions?

Recommended

Siem solutions R&E
Siem solutions R&ESiem solutions R&E
Siem solutions R&E
Owais Ahmad
 
Six Steps to SIEM Success
Six Steps to SIEM SuccessSix Steps to SIEM Success
Six Steps to SIEM Success
AlienVault
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)
Osama Ellahi
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 
Cisco ASA Firepower
Cisco ASA FirepowerCisco ASA Firepower
Cisco ASA Firepower
Anwesh Dixit
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 

Recommended

Siem solutions R&E
Siem solutions R&ESiem solutions R&E
Siem solutions R&E
Owais Ahmad
 
Six Steps to SIEM Success
Six Steps to SIEM SuccessSix Steps to SIEM Success
Six Steps to SIEM Success
AlienVault
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)
Osama Ellahi
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 
Cisco ASA Firepower
Cisco ASA FirepowerCisco ASA Firepower
Cisco ASA Firepower
Anwesh Dixit
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)
Deivid Toledo
 
Présentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhPrésentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo Wazuh
Aurélie Henriot
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
Prashant Gupta
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEye
Prime Infoserv
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
Jason Lang
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
Kangaroot
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Defend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK FrameworkDefend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK Framework
Tripwire
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
Arpan Raval
 
Data Loss Prevention
Data Loss PreventionData Loss Prevention
Data Loss Prevention
Reza Kopaee
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
Ross Wolf
 
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Florian Roth
 
Data Breaches
Data BreachesData Breaches
Data Breaches
Vassilios K. (Basil) Manoussos, Computer Forensics Expert
 
SCADA hacking industrial-scale fun
SCADA hacking industrial-scale funSCADA hacking industrial-scale fun
SCADA hacking industrial-scale fun
Jan Seidl
 

More Related Content

What's hot

Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)
Deivid Toledo
 
Présentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhPrésentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo Wazuh
Aurélie Henriot
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
Prashant Gupta
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEye
Prime Infoserv
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
Jason Lang
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
Kangaroot
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Defend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK FrameworkDefend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK Framework
Tripwire
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
Arpan Raval
 
Data Loss Prevention
Data Loss PreventionData Loss Prevention
Data Loss Prevention
Reza Kopaee
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
Ross Wolf
 
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Florian Roth
 

What's hot (20)

Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)Radware - WAF (Web Application Firewall)
Radware - WAF (Web Application Firewall)
 
Présentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo WazuhPrésentation ELK/SIEM et démo Wazuh
Présentation ELK/SIEM et démo Wazuh
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEye
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
Red Team Methodology - A Naked Look
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
Defend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK FrameworkDefend Your Data Now with the MITRE ATT&CK Framework
Defend Your Data Now with the MITRE ATT&CK Framework
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
 
Data Loss Prevention
Data Loss PreventionData Loss Prevention
Data Loss Prevention
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
 
The Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query LanguageThe Hunter Games: How to Find the Adversary with Event Query Language
The Hunter Games: How to Find the Adversary with Event Query Language
 
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
 

Similar to Blind WAF identification

Data Breaches
Data BreachesData Breaches
Data Breaches
Vassilios K. (Basil) Manoussos, Computer Forensics Expert
 
SCADA hacking industrial-scale fun
SCADA hacking industrial-scale funSCADA hacking industrial-scale fun
SCADA hacking industrial-scale fun
Jan Seidl
 
Sandiflux Report - June 2019
Sandiflux Report - June 2019Sandiflux Report - June 2019
Sandiflux Report - June 2019
Salvatore Saeli
 
RFID Smart Tags for Controlling Belonging in Shelters
RFID Smart Tags for Controlling Belonging in SheltersRFID Smart Tags for Controlling Belonging in Shelters
RFID Smart Tags for Controlling Belonging in Shelters
IJERA Editor
 
CYBER SECURITY WORKSHOP (Only For Educational Purpose)
CYBER SECURITY WORKSHOP (Only For Educational Purpose)CYBER SECURITY WORKSHOP (Only For Educational Purpose)
CYBER SECURITY WORKSHOP (Only For Educational Purpose)
Chanaka Lasantha
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 

Similar to Blind WAF identification (6)

Data Breaches
Data BreachesData Breaches
Data Breaches
 
SCADA hacking industrial-scale fun
SCADA hacking industrial-scale funSCADA hacking industrial-scale fun
SCADA hacking industrial-scale fun
 
Sandiflux Report - June 2019
Sandiflux Report - June 2019Sandiflux Report - June 2019
Sandiflux Report - June 2019
 
RFID Smart Tags for Controlling Belonging in Shelters
RFID Smart Tags for Controlling Belonging in SheltersRFID Smart Tags for Controlling Belonging in Shelters
RFID Smart Tags for Controlling Belonging in Shelters
 
CYBER SECURITY WORKSHOP (Only For Educational Purpose)
CYBER SECURITY WORKSHOP (Only For Educational Purpose)CYBER SECURITY WORKSHOP (Only For Educational Purpose)
CYBER SECURITY WORKSHOP (Only For Educational Purpose)
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 

More from Miroslav Stampar

sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"
Miroslav Stampar
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
Miroslav Stampar
 
Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?
Miroslav Stampar
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
Miroslav Stampar
 
Improving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic DenoiseImproving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic Denoise
Miroslav Stampar
 
APT Attacks on Critical Infrastructure
APT Attacks on Critical InfrastructureAPT Attacks on Critical Infrastructure
APT Attacks on Critical Infrastructure
Miroslav Stampar
 
WARNING: Do Not Feed the Bears
WARNING: Do Not Feed the BearsWARNING: Do Not Feed the Bears
WARNING: Do Not Feed the Bears
Miroslav Stampar
 
Non-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & TricksNon-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & Tricks
Miroslav Stampar
 
sqlmap - why (not how) it works?
sqlmap - why (not how) it works?sqlmap - why (not how) it works?
sqlmap - why (not how) it works?
Miroslav Stampar
 
2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)
Miroslav Stampar
 
Smashing the Buffer
Smashing the BufferSmashing the Buffer
Smashing the Buffer
Miroslav Stampar
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
Miroslav Stampar
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
Miroslav Stampar
 
Hash DoS Attack
Hash DoS AttackHash DoS Attack
Hash DoS Attack
Miroslav Stampar
 
Curious Case of SQLi
Curious Case of SQLiCurious Case of SQLi
Curious Case of SQLi
Miroslav Stampar
 
Heuristic methods used in sqlmap
Heuristic methods used in sqlmapHeuristic methods used in sqlmap
Heuristic methods used in sqlmap
Miroslav Stampar
 
sqlmap - Under the Hood
sqlmap - Under the Hoodsqlmap - Under the Hood
sqlmap - Under the Hood
Miroslav Stampar
 
Spot the Web Vulnerability
Spot the Web VulnerabilitySpot the Web Vulnerability
Spot the Web Vulnerability
Miroslav Stampar
 
Analysis of mass SQL injection attacks
Analysis of mass SQL injection attacksAnalysis of mass SQL injection attacks
Analysis of mass SQL injection attacks
Miroslav Stampar
 
Data Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection AttacksData Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection Attacks
Miroslav Stampar
 

More from Miroslav Stampar (20)

sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
 
Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
 
Improving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic DenoiseImproving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic Denoise
 
APT Attacks on Critical Infrastructure
APT Attacks on Critical InfrastructureAPT Attacks on Critical Infrastructure
APT Attacks on Critical Infrastructure
 
WARNING: Do Not Feed the Bears
WARNING: Do Not Feed the BearsWARNING: Do Not Feed the Bears
WARNING: Do Not Feed the Bears
 
Non-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & TricksNon-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & Tricks
 
sqlmap - why (not how) it works?
sqlmap - why (not how) it works?sqlmap - why (not how) it works?
sqlmap - why (not how) it works?
 
2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)
 
Smashing the Buffer
Smashing the BufferSmashing the Buffer
Smashing the Buffer
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
 
Hash DoS Attack
Hash DoS AttackHash DoS Attack
Hash DoS Attack
 
Curious Case of SQLi
Curious Case of SQLiCurious Case of SQLi
Curious Case of SQLi
 
Heuristic methods used in sqlmap
Heuristic methods used in sqlmapHeuristic methods used in sqlmap
Heuristic methods used in sqlmap
 
sqlmap - Under the Hood
sqlmap - Under the Hoodsqlmap - Under the Hood
sqlmap - Under the Hood
 
Spot the Web Vulnerability
Spot the Web VulnerabilitySpot the Web Vulnerability
Spot the Web Vulnerability
 
Analysis of mass SQL injection attacks
Analysis of mass SQL injection attacksAnalysis of mass SQL injection attacks
Analysis of mass SQL injection attacks
 
Data Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection AttacksData Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection Attacks
 

Recently uploaded

怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
rtunex8r
 
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
k4ncd0z
 
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
thezot
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
davidjhones387
 
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
3a0sd7z3
 
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process HollowingHijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
Donato Onofri
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
Paul Walk
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
xjq03c34
 
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
APNIC
 
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
APNIC
 
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
3a0sd7z3
 
Bengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal BrandingBengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal Branding
Tarandeep Singh
 

Recently uploaded (12)

怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
 
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
 
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
 
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
 
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process HollowingHijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
 
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
 
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
 
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
 
Bengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal BrandingBengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal Branding
 

Blind WAF identification

  • 1. Blind WAF identificationBlind WAF identification Miroslav Stampar (@stamparm) Blind WAF identificationBlind WAF identification Miroslav Stampar (@stamparm)
  • 2. Sh3llCON, Santander (Spain) January 26th, 2019 2 Who am I?Who am I? FOSS programmer, Croatian Government CERT (daily), #infosec researcher (nightly), CTF enthusiast (sporadically)
  • 3. Sh3llCON, Santander (Spain) January 26th, 2019 3 Talk overviewTalk overview What is WAF? How to (dummy) provoke it? Typical reactions Real-life examples WAF detection Non-blind WAF identification Blind WAF identification identYwaf (https://github.com/stamparm/identYwaf)
  • 4. Sh3llCON, Santander (Spain) January 26th, 2019 4 What is WAF? (I)What is WAF? (I) WAF (Web Application Firewall) Protects web applications by monitoring and filtering (HTTP/S) traffic Security hardening by making more difficult exploitation of web application security flaws Does not replace the network firewall Deployed between the network firewall and the web server infrastructure (inspects unencrypted traffic) To (potentially) bypass it, penetration tester (first) needs to recognize the type (!)
  • 5. Sh3llCON, Santander (Spain) January 26th, 2019 5 What is WAF? (II)What is WAF? (II) Source: avinetworks.com
  • 6. Sh3llCON, Santander (Spain) January 26th, 2019 6 What is WAF? (III)What is WAF? (III) Prevents exploitation of common web security vulnerabilities (flaws): SQL Injection (SQLi) Cross-Site Scripting (XSS) File Inclusion (FI) Cross-Site Request Forgery (CSRF) XML External Entity (XXE) Local / Remote Code Execution (LCE / RCE) Directory Traversal … Note: OWASP Top 10
  • 7. Sh3llCON, Santander (Spain) January 26th, 2019 7 How to (dummy) provoke it?How to (dummy) provoke it?
  • 8. Sh3llCON, Santander (Spain) January 26th, 2019 8 Typical reactionsTypical reactions “Bad request” “Access denied” “Not acceptable” “Request denied” “URL was rejected” “Forbidden” “Request could not be satisfied” “Attempt has been blocked” “Blocked your request” etc.
  • 9. Sh3llCON, Santander (Spain) January 26th, 2019 9 Real-life examples (360)Real-life examples (360)
  • 10. Sh3llCON, Santander (Spain) January 26th, 2019 10 Real-life examples (Cloudflare)Real-life examples (Cloudflare)
  • 11. Sh3llCON, Santander (Spain) January 26th, 2019 11 Real-life examples (dotDefender)Real-life examples (dotDefender)
  • 12. Sh3llCON, Santander (Spain) January 26th, 2019 12 Real-life examples (Incapsula)Real-life examples (Incapsula)
  • 13. Sh3llCON, Santander (Spain) January 26th, 2019 13 Real-life examples (ModSecurity)Real-life examples (ModSecurity)
  • 14. Sh3llCON, Santander (Spain) January 26th, 2019 14 Real-life examples (Sucuri)Real-life examples (Sucuri)
  • 15. Sh3llCON, Santander (Spain) January 26th, 2019 15 Real-life examples (Virusdie)Real-life examples (Virusdie)
  • 16. Sh3llCON, Santander (Spain) January 26th, 2019 16 Real-life examples (Wordfence)Real-life examples (Wordfence)
  • 17. Sh3llCON, Santander (Spain) January 26th, 2019 17 WAF detection (I)WAF detection (I) Sending dummy payload(s) (deliberate, provocative, not dangerous): <script>alert('XSS')</script> ' OR SLEEP(5) OR ' (etc.) Usage of random-generated GET/POST parameter names (e.g. ?oFx=...) Detection of any kind of response changes compared to the original: HTTP code (200 OK → 403 Forbidden) HTML title (Homepage → Attention Required!) Occurrence(s) of rejection specific keywords (- → ...you have been blocked...)
  • 18. Sh3llCON, Santander (Spain) January 26th, 2019 18 WAF detection (II)WAF detection (II) Original WAF provoked
  • 19. Sh3llCON, Santander (Spain) January 26th, 2019 19 Non-blind WAF identification (I)Non-blind WAF identification (I) After the (successful) detection phase, in identification phase we are trying to identify the web application security product (i.e. WAF) In best case (non-blind) provoked WAF will respond with specific response trails which distinguishes it from other products Keywords / sentences (e.g. dotDefender Blocked Your Request) HTTP codes (e.g. 999 No Hacking) HTTP headers (e.g. Server: BinarySec) HTTP cookies (e.g. jsl_tracking=….) File paths (e.g. .../wzws-waf-cgi/...)
  • 20. Sh3llCON, Santander (Spain) January 26th, 2019 20 Non-blind WAF identification (II)Non-blind WAF identification (II) @sqlmap (case) / --identify-waf WAF scripts (currently 77) Each covers one specific WAF (protection system) 4 (+1 NIL) dummy payloads / attack vectors Checking page content, headers and (HTTP) code after each payloads
  • 21. Sh3llCON, Santander (Spain) January 26th, 2019 21 Non-blind WAF identification (III)Non-blind WAF identification (III)
  • 22. Sh3llCON, Santander (Spain) January 26th, 2019 22 Non-blind WAF identification (IV)Non-blind WAF identification (IV)
  • 23. Sh3llCON, Santander (Spain) January 26th, 2019 23 Blind WAF identification (I)Blind WAF identification (I) How to distinguish different WAF types when there are only TRUE (generic rejected) and FALSE (original) responses? Similar problem like in boolean-based blind SQL injection, though, with more constraints (i.e. there is no data source to pull data from) In theory, different WAFs should have different protection engines with different set of rules Hence, different WAFs should answer differently to a predefined list of dummy payloads (“battery of tests”) Final goal: characteristic vectors (signatures)
  • 24. Sh3llCON, Santander (Spain) January 26th, 2019 24 Blind WAF identification (II)Blind WAF identification (II)
  • 25. Sh3llCON, Santander (Spain) January 26th, 2019 25 Blind WAF identification (III)Blind WAF identification (III)
  • 26. Sh3llCON, Santander (Spain) January 26th, 2019 26 identYwaf (I)identYwaf (I) WAF detection and identification tool Non-blind support for 70 WAFs and blind support for 64 WAFs (74 WAFs in total) Non-blind recognition implemented by usage of regular expressions over raw HTTP response (including HTTP headers) Blind recognition implemented by usage of inference based on response(s) comparison with predefined characteristic vectors (signatures) of size 45 (payloads) Based on extensive (empirical?) study
  • 27. Sh3llCON, Santander (Spain) January 26th, 2019 27 identYwaf (II)identYwaf (II)
  • 28. Sh3llCON, Santander (Spain) January 26th, 2019 28 identYwaf (III)identYwaf (III)
  • 29. Sh3llCON, Santander (Spain) January 26th, 2019 29 identYwaf (IV)identYwaf (IV) Calculating difference (distance) between response vector and WAF characteristic vectors (signatures) Smaller the difference, greater the match Periodic safe-checking for potential complete blocking (dummy digit payload) Detection of WAF “chaining” based on different rejection HTTP codes (e.g. 403 and 500) or Server headers (e.g. nginx and imunify360-webshield/1.5) Auxiliary “hardness” score (i.e. strictness)
  • 30. Sh3llCON, Santander (Spain) January 26th, 2019 30 identYwaf (V)identYwaf (V)
  • 31. Sh3llCON, Santander (Spain) January 26th, 2019 31 identYwaf (VI)identYwaf (VI)
  • 32. Sh3llCON, Santander (Spain) January 26th, 2019 32 identYwaf (VII)identYwaf (VII)
  • 33. Sh3llCON, Santander (Spain) January 26th, 2019 33 identYwaf (VIII)identYwaf (VIII)
  • 34. Sh3llCON, Santander (Spain) January 26th, 2019 34 Future workFuture work Dealing with strict (rate-limiting) WAFs (e.g. usage of proxy list) Extensive testing of WAF capabilities (e.g. POST body, different encodings, etc.) Detailed reporting for the sake of bypassing (e.g. only FI payloads are blocked, POST body is not being processed, only characters < and > are being blocked, etc.) Collaborative sharing of unknown signatures (e.g. automatic Github issue) Bypass “recommendations”
  • 35. Sh3llCON, Santander (Spain) January 26th, 2019 35 p.s. “Hardness” (not WAF scoring!)p.s. “Hardness” (not WAF scoring!)
  • 36. Sh3llCON, Santander (Spain) January 26th, 2019 36 Questions?Questions?