The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community.
But it detects words like "information_schema" and drops the connection request.
It also detected the method database() but when introducing a space between (), like ( ), the WAF no longer blocked me.
It also detects -- . Because of that I had to use # for commenting the rest of the query.
I need to bypass this countermeasure to enumerate the tables.
-
1check this out forum.bugcrowd.com/t/…– Soufiane TahiriJul 11, 2017 at 12:43
-
Have you tried to see what kind of input the WAF is blocking?– FlorianJul 11, 2017 at 14:14
-
SQLMAP has a variety of tampering scripts ( /sqlmap/tamper/ ), see @Soufiane Tahiri's comment.– t.m.adamJul 11, 2017 at 16:38
Add a comment
|
1 Answer
It is impossible to answer your question, as you did not provide any additional details. There are known WAF bypass techniques, which work with certain firewalls. It also depends on the place in the query, where SQL injection occurs. Try to fingerprint your WAF.
Btw, the behavior you have described, looks like WAF reacts to the information_schema and other standard keywords in your request and drops the connection. What makes you think there is an actual SQL injection?
-
I was able to guess the database name to be apps_community with boolean SQL injection but when I try to enumerate the infomation_schema the WAF blocks my connection.– AayushJul 14, 2017 at 6:23