1

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server.

Upon investigating, it is determined that a webshell was uploaded through exploiting a vulnerability and the 'hacked by xxxx' html page was 'created' using the web shell.

So technically the html file was created and not uploaded. The only thing uploaded was the web shell.

The website has WAF in place. Possibly a CDN(can't remember details).

Thing is, can WAF block/detect the file creation/upload through the web shell or does it just treat it like any other day to day upload/download activities.

Additionally I understand that WAF can block and detect web shell. But how about obfuscated ones?

Improve this question
3
  • This is a pretty broad question and every WAF implementation is going to vary. Typically, server-side file creation would need to have the directory monitored by the WAF for said action but again this depends on the capabilities of the specific implementation.
    – HashHazard
    Feb 2, 2017 at 18:47
  • A WAF is usually the wrong level to try prevent web shell infection - if you can upload executable files to a server, there will be ways to bypass a WAF through encoding, or splitting data, or using a multi stage payload. It might be difficult, but there are lots of ways to hide data. You're better off preventing the upload of executable files on the server - put uploads in a folder which doesn't allow execution, rename them, etc.
    – Matthew
    Feb 2, 2017 at 19:22
  • Thanks Hollowproc. I'm asking WAF in general not targeting any specific brands. In this context the WAF is a commercial WAF. Matthew so you are saying obfuscated or Encoding webshell can slip thru WAF in general?
    – Lester T.
    Feb 3, 2017 at 7:50

1 Answer 1

Reset to default
1

It all depends on the WAF configuration and the WAF technology. As several web applications have upload features by nature (for example, to upload your CV in a recruitment website), the WAF need to be tuned to ensure only the file types you want are being uploaded. I've seen a lot of system administrators just disabling the file check option instead of fine tuning it, leaving the application vulnerable to malicious file upload.

Most of the WAF solutions are signature based, meaning that if the attacker code it's own reverse shell file or do a very good obfuscation job, probably the WAF will not detect it. For this reason, it is important to not trust only on the WAF, but also adopt secure coding.

If you really need to have file upload features on your website I do recommend you checking this guide which explains how to properly code your application.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .