0

I want to pentest a specific web application with automatic tool like Burp Suite and IBM Security AppScan. However, the website uses a prevention mechanism for attack. When I started automatic tool, it blacklisted my IP address.

In my opinion, I can change my IP address periodically but this method takes long time.

Is there any bypass mechanism for this prevention method?

Improve this question
7
  • 6
    If your penetration test is legitimate then getting your IP white listed should be easy.
    – Scott Helme
    Mar 28, 2014 at 10:00
  • Firstly I want to test like black hat.For example changing ip with proxy or any other method.without adding any information to ip list. After that I can use your suggestion.
    – dgn
    Mar 28, 2014 at 11:45
  • 4
    Umm, your first test proved the control works. Now get your IP whitelisted and continue...
    – CtrlDot
    Mar 28, 2014 at 14:50
  • Why do you know the site is blacklisting your IP? Web sites blacklisting malicious IPs are not usual in my opinion.
    – kinunt
    Mar 28, 2014 at 18:38
  • @kinunt it's not uncommon to have an IPS blacklist an IP address after it's detected activity that deems to be potentially malicious (ie port scanning).
    – DKNUCKLES
    Mar 28, 2014 at 18:49

2 Answers 2

Reset to default
1

Your IP is blacklisted for a reason, not just because you use Burp or Appscan. A possibility is that they have a mechanism to detect:

  1. Too many connections to the site
  2. An offending User-Agent
  3. Too many malicious HTTP requests

Try to discover first how or why it classifies you as malicious and try to circumvent then the protection.

Web sites does not usually blacklist IPs. Usually legitimate users do a lot of requests to a site so blacklisting them should easily would cause DoS events.

An offending User-Agent is a possibility, but I think with a low probability. Try changing the User-Agent to something friendly.

The last possibility, in the case it is really blacklisting your IP, is that they implement a WAF. The WAF is detecting malicious packets. Try WAF bypassing techniques to avoid the WAF blacklisting you.

Improve this answer
0

Use a proxy. Either a webbased one like hidemyass or ixquick.

Or a http/socks based proxy. You can find free ones listed all over the place, including hidemyass.

If you need to run applications that do not provide built in proxy settings then use a wrapper such as proxychains.

Improve this answer
2
  • According to your answer , I can use Proxychain+ (Burp/Ibm Appscan) Right?
    – dgn
    Mar 28, 2014 at 11:22
  • I haven't tried that particular combination but in theory yes.
    – user2675345
    Mar 28, 2014 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .