1

The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community.
But it detects words like "information_schema" and drops the connection request.
It also detected the method database() but when introducing a space between (), like ( ), the WAF no longer blocked me.
It also detects -- . Because of that I had to use # for commenting the rest of the query.
I need to bypass this countermeasure to enumerate the tables.

closed as off-topic by Serge Ballesta, TheJulyPlot, Xander, Steve, Bacon Brad Jul 12 '17 at 0:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Serge Ballesta, Steve, Bacon Brad
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    check this out forum.bugcrowd.com/t/… – Soufiane Tahiri Jul 11 '17 at 12:43
  • Have you tried to see what kind of input the WAF is blocking? – Florian Jul 11 '17 at 14:14
  • SQLMAP has a variety of tampering scripts ( /sqlmap/tamper/ ), see @Soufiane Tahiri's comment. – t.m.adam Jul 11 '17 at 16:38
0

It is impossible to answer your question, as you did not provide any additional details. There are known WAF bypass techniques, which work with certain firewalls. It also depends on the place in the query, where SQL injection occurs. Try to fingerprint your WAF.

Btw, the behavior you have described, looks like WAF reacts to the information_schema and other standard keywords in your request and drops the connection. What makes you think there is an actual SQL injection?

  • I was able to guess the database name to be apps_community with boolean SQL injection but when I try to enumerate the infomation_schema the WAF blocks my connection. – Aayush Jul 14 '17 at 6:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.