Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.

share|improve this question
add comment

3 Answers

up vote 10 down vote accepted

Check out Ivan Ristić's research. Snippets below from his post on the Qualys blog:

Today at Black Hat [2012] we are announcing a new research project on protocol-level evasion of web application firewalls. This type of evasion focuses on the low level operation of WAFs, aiming to exploit little differences in how WAFs see traffic and how backend web servers and applications see it. If you get the WAF to see something different from what the backend is seeing, you have an evasion opportunity that could possibly be used to execute any attack type, without detection.
[...]
Attached to this post is our research paper that focuses on request path, parameter, and multipart/form-data evasion. Also attached are the Black Hat talk slides that introduce the research. The testing suite (a sort of a research toolkit) is in the IronBee WAF Research repository on GitHub.

Protocol-Level Evasion of Web Application Firewalls v1.1 (18 July 2012).pdf
Protocol-Level Evasion of Web Application Firewalls (Ivan Ristic, Qualys, Black Hat USA 2012) SLIDES.pdf

share|improve this answer
add comment

It can be difficult to predict how a WAF will inspect traffic because WAF rules and methods are not standardized and work so high up the stack. Basically, you are looking for weaknesses in detection and/or to make it as difficult as possible for a WAF to properly interpret the communication sent to the target.

Some techniques that can be used:

  • mixed case in attack strings (used to by-pass WAF regex configurations)
  • random comments in SQL commands
  • URI encoding
  • packet fragmentation

In one simple home-grown WAF system I tested, I defeated the SQL injection protection by switching from

' OR 1=1 --

to

' OR foo=foo --

On the topic of tools, SQLMap and Havij are well-known. The SQLMap evasion scripts may also provide deeper insight into specific WAF evasion techniques.

Any IPS evasion technique can also be potentially applied to WAF.

share|improve this answer
add comment

You could play with sqlmap:

http://www.websec.ca/blog/view/Bypassing_WAFs_with_SQLMap

Regards, Piotr Bratkowski

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.