Awesome WAF

A curated list of awesome WAF stuff.

A Concise Definition: A web application firewall is a form of firewall with a set of configured rules that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. (Source Wikipedia)

Feel free to contribute.

Contents:

• Awesome WAFs List
• Awesome Testing Methodology
• Awesome WAF Detection
• Awesome Evasion Techniques
• Awesome Tools
• Awesome Blogs & Writeups
• Awesome Presentations & Papers

Awesome WAFs List

360 WangZhanBao	A WAF solution from 360 Security Team.
Airlock	The Airlock Web Application Firewall offers a unique combination of protective mechanisms for web applications. Each access is systematically monitored and filtered at every level. It features reverse proxy, central checkpoint, filtering, API security and dynamic whitelisting.
Anquanbao	A cloud based WAF solution for enterprises featuring big data analysis, clustering solutions, content optimisations, and access accelerations.
Armor	A virtual WAF solution by Armor technologies which protects web-applications from OWASP top 10 attacks and features accurate response and remediation via applied intelligence from their threat centre.
Application Security Manager	A comprehensive web application firewall from F5 Networks that protects apps and data from known and unknown threats, defends against bots that bypass standard protections, and virtually patches app vulnerabilities.
Amazon AWS WAF	A WAF solution from Amazon AWS that features full time web-traffic filtering, virtual patching, traffic visibility, attack transparency integrated with customisable rules.
Baidu Cloud WAF	A cloud based protection system from Baidu to effectively defend against web application attacks. It features cloud based real-time protections, load balancing, DDoS protection and its own content-delivery network.
Barracuda	A WAF solution from Barracuda Networks featuring web aplication, API, and mobile apps against various attacks. Beside it provides DDoS protections, automated attack and bot protections, access controls and authentication protections.
BinarySEC	A solution from BinarySec which provides all round security protections from many kinds of threats. BinarySec WAF allows active whitelisting while peotecting your site from major known threats and malware.
ChinaCache	A featured firewall for China which features its own content-delivery network, virtual patching and constant threat discovery transparency report.
Kona Site Defender	A cloud based WAF solution from Akamai technologies that feaures a proprietary WAF rule set, created and automatically updated based on visibility into the latest attacks with protections. It provides API security integrated with DevOps security, report visibility, etc.

Testing Methodology

Alright, now lets see the approach of testing WAFs. Wait, before that we need to know how they work right? Here you go.

How WAFs Work:

• Using a set of rules to distinguish between normal requests and malicious requests.
• Sometimes they use a learning mode to add rules automatically through learning about user behaviour.

Operation Modes:

• Negative Model (Blacklist based) - One that defines what is not allowed. Eg. Block all <script>*</script> inputs.
• Positive Model (Whitelist based) - One that defines what is allowed and rejects everything else.
• Mixed/Hybrid Model (Inclusive model) - One that uses a mixed concept of blacklisting and whitelisting stuff.

Where To Look:

• Always look out for common ports that expose that a WAF 80, 443, 8000, 8008, 8080, 8088.

Tip: You can use automate this easily by commandline using a screenshot taker like WebScreenShot.

• Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
• Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
• Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, Big IP WAF).
• Some WAFs expose themselves in the response content (eg. DotDefender, Armor, truShield Sitelock).
• Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight).

Detection Techniques:

1. Make a normal GET request from a browser, intercept and test response headers (specifically cookies).
2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
3. If there is a login page somewhere, try some common (easily detectable) payloads like ' or 1 = 1 --.
4. If there is some search box or input field somewhere, try detecting payloads like <script>alert()</script>.
5. Make GET requests with outdated protocols like HTTP/0.9 (HTTP/0.9 does not support POST type queries).
6. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.

Tip: This method could be easily achieved with tools like HPing3 or Scapy.

7. Side Channel Attacks - Examine the timing behaviour of the request and response content.

WAF Detection

Wanna detect WAFs? Lets see how.

Note

: This section contains manual WAF detection techniques. You might want to switch over to next section.

360 Firewall	Detectability: Easy Detection Methodology: Returns status code 493 upon unusual requests. On viewing source-code of error page, you will find reference to wzws-waf-cgi/ directory. Source code may contain reference to wangshan.360.cn URL. Response headers contain X-Powered-By-360WZB Header.
aeSecure	Detectability: Moderate Detection Methodology: Blocked response content contains aesecure_denied.png image (view source to see). Response headers contain aeSecure-code value.
Airlock (Phion/Ergon)	Detectability: Moderate/Difficult Detection Methodology: Set-Cookie headers may contain AL-SESS={some value} value (case insensitive). Response headers may contain AL-LB={some value} value (case insensitive).
Anquanbao WAF	Detectability: Easy Detection Methodology: Returns blocked HTTP response code 405 upon malicious requests. Blocked response content may contain /aqb_cc/error/ or hidden_intercept_time. Response headers contain X-Powered-by-Anquanbao header field.
Armor Defense	Detectability: Easy Detection Methodology: Blocked response content contains warning This request has been blocked by website protection from Armor.
Application Security Manager (F5 Networks)	Detectability: Difficult Detection Methodology: Blocked response content contains warning The requested URL was rejected. Please consult with your administrator.
Amazon AWS WAF	Detectability: Moderate Detection Methodology: Response headers contain AWS value. Blocked response status code return 403 Forbidden response.
Yunjiasu WAF (Baidu)	Detectability: Moderate Detection Methodology: Response headers contain Yunjiasu-ngnix value.
Barracuda WAF	Detectability: Moderate Detection Methodology: Response cookies may contain barra_counter_session value. Response headers may contain barracude_ keyword.
BIG-IP ASM (F5 Networks)	Detectability: Moderate Detection Methodology: Response headers may contain BigIP or F5 keyword value. Response header fields may contain X-WA-Info header. Response headers might have jumbled X-Cnection field value.
BinarySec WAF	Detectability: Moderate Detection Methodology: Response headers contain binarysec keyword value.
BlockDos	Detectability: Moderate Detection Methodology: Response headers may contain reference to BlockDos.net URL.
ChinaCache Firewall	Detectability: Easy Detection Methodology: Response headers contain Powered-by-ChinaCache field. Blocked response codes contain 400 Bad Request error upon malicious request.
ACE XML Gateway (Cisco)	Detectability: Moderate Detection Methodology: Response headers have ACE XML Gateway value.
Cloudbric	Detectability: Moderate Detection Methodology: Response content has Cloudbric and Malicious Code Detected values.
Cloudflare	Detectability: Easy Detection Methodology: Response headers might have cf-ray field value. Server header field has value cloudflare. Set-Cookie response headers have __cfuid= cookie field. Page content might have Attention Required! or Cloudflare Ray ID:. You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs.
Cloudfront (Amazon)	Detectability: Easy Detection Methodology: Blocked response content contains Error from cloudfront error upon malicious request.
Comodo Firewall	Detectability: Easy Detection Methodology: Response headers contain Protected by COMODO WAF value.
CrawlProtect (Jean-Denis Brun)	Detectability: Easy Detection Methodology: Response content contains value This site is protected by CrawlProtect.
IBM WebSphere DataPower	Detectability: Moderate Detection Methodology: Response headers contains field value value X-Backside-Transport with value OK or FAIL.
Deny-All Firewall	Detectability: Difficult Detection Methodology: Response content contains value Condition Intercepted. Set-Cookie header contains cookie field sessioncookie.
Distil Firewall	Detectability: Easy Detection Methodology: Response headers contain field value X-Distil-CS in all requests.
DoSArrest Internet Security	Detectability: Easy Detection Methodology: Response headers contain field value X-DIS-Request-ID. Response headers might contain DOSarrest keyword.
dotDefender	Detectability: Easy Detection Methodology: Blocked response content contains value dotDefender Blocked Your Request. Blocked response headers contain X-dotDefender-denied field value.
EdgeCast (Verizon)	Detectability: Easy Detection Methodology: Blocked response content contains value Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon). Blocked response code returns 400 Bad Request on malicious requests.
Expression Engine (EllisLab)	Detectability: Difficult Detection Methodology: Blocked response content contains value Invalid GET Request upon malicious GET queries. Blocked POST type queries contain Invalid POST Request in response content.
FortiWeb Firewall	Detectability: Moderate Detection Methodology: Blocked response content contains value .fgd_icon keyword. Response headers contain FORTIWAFSID= on malicious requests. Set-Cookie header has cookie field cookiesession1=.
HyperGuard Firewall	Detectability: Difficult Detection Methodology: Set-Cookie header has cookie field ODSESSION= in response headers.
Imperva Incapsula	Detectability: Easy Detection Methodology: Blocked response page content may contain: Incapsula incident ID keyword. _Incapsula_Resource keyword. subject=WAF Block Page keyword. Normal GET request headers contain visid_incap value. Response headers may contain X-Iinfo header field name. Set-Cookie header has cookie field incap_ses in response headers.
Jiasule Firewall	Detectability: Easy Detection Methodology: Blocked response page contains reference to static.jiasule.com/static/js/http_error.js URL. Set-Cookie header has cookie field __jsluid= in response headers. Response headers have jiasule-WAF or jsl_tracking keywords. Blocked response content has notice-jiasule keyword.
KnownSec Firewall	Detectability: Easy Detection Methodology: Blocked response page displays ks-waf-error.png image (view source to see).
KONA Site Defender (Akamai)	Detectability: Easy Detection Methodology: Headers contain AkamaiGHost keyword.
ModSecurity (Trustwave)	Detectability: Moderate/Difficult Detection Methodology: Blocked response page contains: This error was generated by Mod_Security text. One or more things in your request were suspicious text. rules of the mod_security module text. Response headers may contain Mod_Security or NYOB keywords.
NAXSI (NBS Systems)	Detectability: Easy Detection Methodology: Response headers contain naxsi/waf keyword.
Netcontinuum (Barracuda)	Detectability: Moderate Detection Methodology: Session cookies contain NCI__SessionId= cookie field name.
Citrix NetScaler	Detectability: Moderate Detection Methodology: Response headers may contain Connection: header field name jumbled to nnCoection: ns_af= cookie field name. citrix_ns_id field name. NSC_ keyword. NS-CACHE field value.
NewDefend Firewall	Detectability: Easy Detection Methodology: Response headers contain newdefend keyword.
NSFocus Firewall	Detectability: Easy Detection Methodology: Response headers contain NSFocus keyword.
Palo Alto Firewall	Detectability: Difficult Detection Methodology: Blocked response page contains the following text has been blocked in accordance with company policy.
Profense Firewall	Detectability: Moderate/Difficult Detection Methodology: Set-Cookie headers contain PLBSID= cookie field name. Response headers may contain Profense keyword.
Radware Appwall	Detectability: Moderate Detection Methodology: Response page contains the following text: Unauthorized Activity Has Been Detected. and Case Number text. Response headers may contain X-SL-CompState header field name.
Reblaze Firewall	Detectability: Moderate Detection Methodology: Response headers contain rbzid= header field name. Response headers field values might contain Reblaze Secure Web Gateway text.
Request Validation Mode (ASP.NET)	Detectability: Easy Detection Methodology: A firewall found specifically on ASP.NET websites and none others. Response page contains either of the following text: ASP.NET has detected data in the request that is potentially dangerous. Request Validation has detected a potentially dangerous client input value. HttpRequestValidationException. Blocked response code returned is always 500 Internal Error.
Safe3 Firewall	Detectability: Easy Detection Methodology: Response headers contain Safe3 keyword.
SafeDog Firewall	Detectability: Easy/Moderate Detection Methodology: Response headers may contain: WAF/2.0 keyword. safedog field value.
SecureIIS (BeyondTrust)	Detectability: Easy Detection Methodology: Response page contains either of the following text: SecureIIS Web Server Protection. Reference to http://www.eeye.com/SecureIIS/ URL. subject={somevalue} SecureIIS Error text.
SEnginx (Neusoft)	Detectability: Easy Detection Methodology: Blocked response page contains SENGINX-ROBOT-MITIGATION keyword.
SiteLock TrueShield	Detectability: Easy Detection Methodology: Blocked response page source contains the following: SiteLock Incident ID text. sitelock-site-verification keyword. sitelock_shield_logo image.
SonicWall (Dell)	Detectability: Easy Detection Methodology: Response headers contain SonicWALL keyword value. Blocked response page contains either of the following text: This request is blocked by the SonicWALL. #shd or #nsa_banner hashtags. Web Site Blocked text.
Sophos UTM Firewall	Detectability: Easy Detection Methodology: Blocked response page contains Powered by UTM Web Protection keyword.
Stingray (RiverBed/Brocade)	Detectability: Difficult Detection Methodology: Blocked response code returns 403 Forbidden or 500 Internal Error. Response headers contain the X-Mapping header field name.
Sucuri CloudProxy	Detectability: Easy Detection Methodology: Response headers may contain Sucuri or Cloudproxy values. Blocked response page contains the following text: Access Denied and Sucuri Website Firewall texts. Email cloudproxy@sucuri.net. Returns 403 Forbidden response code upon blocking.
Tencent Cloud WAF	Detectability: Moderate Detection Methodology: Blocked response code returns 405 Method Not Allowed error. Blocked response page contains reference to waf.tencent-cloud.com URL.
TrafficShield (F5 Networks)	Detectability: Moderate Detection Methodology: Response headers might contain F5-TrafficShield keyword. ASINFO= value might be detected in response headers.
URLScan (Microsoft)	Detectability: Moderate Detection Methodology: Response headers might contain Rejected-by-URLScan field value. Blocked response page contains Rejected-by-URLScan text.
USP Secure Entry	Detectability: Moderate Detection Methodology: Response headers contain Secure Entry Server field value.
Varnish (OWASP)	Detectability: Easy Detection Methodology: Response page contains Request rejected by xVarnish-WAF text. Malicious request returns 404 Not Found Error.
WallArm (Nginx)	Detectability: Moderate Detection Methodology: Response headers contain nginx-wallarm text.
WatchGuard Firewall	Detectability: Moderate Detection Methodology: Response headers contain WatchGuard header field value.
WebKnight (Aqtronix)	Detectability: Easy Detection Methodology: Response headers contain WebKnight keyword. Blocked response page contains: WebKnight Application Firewall Alert text warning. AQTRONIX WebKnight text. Blocked response code returned is 999 No Hacking. :p
ZenEdge Firewall	Detectability: Easy Detection Methodology: Blocked response page contains reference to zenedge/assets/ directory. Headers contain the ZENEDGE keyword.
Yundun Firewall	Detectability: Moderate Detection Methodology: Headers contain the yundun keyword.
Yunsuo Firewall	Detectability: Easy Detection Methodology: Blocked response page contains image class reference to .yunsuologo. Response headers contain the yunsuo_session field name.

Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Awesome Tools

WAF Fingerprinting:

1. Fingerprinting with NMap:

Source: GitHub | SVN

• Normal WAF Fingerprinting

nmap --script=http-waf-fingerprint <target>

• Intensive WAF Fingerprinting

nmap --script=http-waf-fingerprint  --script-args http-waf-fingerprint.intensive=1 <target>

• Generic Detection

nmap --script=http-waf-detect <target>

2. Fingerprinting with WafW00f:

Source: GitHub | Pypi

wafw00f <target>

WAF Testing:

• WAFBench - A WAF performance testing suite by Microsoft.
• WAF Testing Framework - A free WAF testing tool by Imperva.

WAF Evading:

1. Evading WAFs with SQLMap Tamper Scripts:

• General Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

• MSSQL Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

• MySQL Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor

• Generic Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

2. Evading WAFs with WAFNinja

Source: GitHub

• Fuzzing

python wafninja.py fuzz -u <target> -t xss

• Bypassing

python wafninja.py bypass -u <target> -p "name=<payload>&Submit=Submit" -t xss

• Insert Fuzzing

python wafninja.py insert-fuzz -i select -e select -t sql

3. Evading WAFs with WhatWaf:

Source: GitHub

whatwaf -u <target> --ra --throttle 2

Presentations & Research Papers

Presentations:

• WAF Profiling & Evasion Techniques - A WAF testing and evasion guide from OWASP.
• Protocol Level WAF Evasion Techniques - A presentation at about efficiently evading WAFs at protocol level from BlackHat US 12.
• Analysing Attacking Detection Logic Mechanisms - A presentation about WAF logic applied to detecting attacks from BlackHat US 16.
• WAF Bypasses and PHP Exploits - A presentation about evading WAFs and developing related PHP exploits.
• Playing Around with WAFs - A small presentation about WAF profiling and playing around with them from Defcon 16.

Research Papers:

• WASC WAF Evaluation Criteria - A guide for WAF Evaluation from Web Application Security Consortium
• Protocol Level WAF Evasion - A protocol level WAF evasion techniques and analysis by Qualys.
• WAF Evasion Testing - A WAF evasion testing guide from SANS.
• WAF Evaluation and Analysis - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from University of Amsterdam.
• Bypassing all WAF XSS Filters - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
• Neural Network based WAF for SQLi - A paper about building a neural network based WAF for detecting SQLi attacks.