4

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?

Improve this question
1
  • 4
    You go slower than the WAF threshold is set. Or you don't use those tools on sites with a WAF that bans like that.
    – schroeder ♦
    Jan 11, 2020 at 20:16

1 Answer 1

Reset to default
0

It isn't possible to simply just "avoid the WAF" it is doing its job. Well, with the exception of specific payload bypasses. But that isn't what your question is asking.

In terms of "bypassing" the WAF in relation to something like directory brute-forcing the best course of action you can take is as suggested by Schroeder, set your scanning speed lower than the threshold the WAF is set. For example, if the WAF is configured to start dropping packets when a single IP sends 100 requests or more in a 5 minute window. Then you would need to set your scanning to send no more than that amount.

To find the sweet spot you simply start your scanning quite aggressively (depending on the environment) and lower it gradually until the point where your requests go through. I should note that these days, WAFs can have some pretty granular rules so this really only applies to the classic scenario of dropping traffic when it is too frequent.

Improve this answer
1
  • "and lower it gradually until the point where your requests go through" your advice is highly infeasible. When WAF banned your IP, it is a manual process to re-enable the IP again, and sometimes a few days of turnaround is needed. More realistic way is to slowly increase in speed, until the point it is not too much faster than a normal human interaction speed, else WAF may flag it non-human and terminate your IP.
    – Peter Teoh
    Mar 17 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .