The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community.
But it detects words like "information_schema" and drops the connection request.
It also detected the method database() but when introducing a space between (), like ( ), the WAF no longer blocked me.
It also detects -- . Because of that I had to use # for commenting the rest of the query.
I need to bypass this countermeasure to enumerate the tables.

  • 1
    check this out forum.bugcrowd.com/t/… – Soufiane Tahiri Jul 11 '17 at 12:43
  • Have you tried to see what kind of input the WAF is blocking? – Florian Jul 11 '17 at 14:14
  • SQLMAP has a variety of tampering scripts ( /sqlmap/tamper/ ), see @Soufiane Tahiri's comment. – t.m.adam Jul 11 '17 at 16:38

It is impossible to answer your question, as you did not provide any additional details. There are known WAF bypass techniques, which work with certain firewalls. It also depends on the place in the query, where SQL injection occurs. Try to fingerprint your WAF.

Btw, the behavior you have described, looks like WAF reacts to the information_schema and other standard keywords in your request and drops the connection. What makes you think there is an actual SQL injection?

| improve this answer | |
  • I was able to guess the database name to be apps_community with boolean SQL injection but when I try to enumerate the infomation_schema the WAF blocks my connection. – Aayush Jul 14 '17 at 6:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.