Awesome WAF

A curated list of awesome WAF stuff.

A Concise Definition: A web application firewall is a form of firewall with a set of configured rules that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. (Source Wikipedia)

Feel free to contribute.

Contents:

• Awesome WAFs List
• Awesome Testing Methodology
• Awesome WAF Detection
• Awesome Evasion Techniques
• Awesome Tools
• Awesome Blogs & Writeups
• Awesome Presentations & Papers

Awesome WAFs List

360 WangZhanBao	A WAF solution from 360 Security Team.
Airlock	The Airlock Web Application Firewall offers a unique combination of protective mechanisms for web applications. Each access is systematically monitored and filtered at every level. It features reverse proxy, central checkpoint, filtering, API security and dynamic whitelisting.
Anquanbao	A cloud based WAF solution for enterprises featuring big data analysis, clustering solutions, content optimisations, and access accelerations.
Armor	A virtual WAF solution by Armor technologies. which protects web-applications from OWASP top 10 attacks and features accurate response and remediation via applied intelligence from their threat centre.
	A comprehensive web application firewall from F5 Networks that protects apps and data from known and unknown threats, defends against bots that bypass standard protections, and virtually patches app vulnerabilities.
Amazon AWS WAF	A WAF solution from Amazon AWS that features full time web-traffic filtering, virtual patching, traffic visibility, attack transparency integrated with customisable rules.
Baidu Cloud WAF	A cloud based protection system from Baidu to effectively defend against web application attacks. It features cloud based real-time protections, load balancing, DDoS protection and its own content-delivery network.
Barracuda	A WAF solution from Barracuda Networks featuring web aplication, API, and mobile apps against various attacks. Beside it provides DDoS protections, automated attack and bot protections, access controls and authentication protections.
Kona Site Defender	A cloud based WAF solution from Akamai technologies that feaures a proprietary WAF rule set, created and automatically updated based on visibility into the latest attacks with protections. It provides API security integrated with DevOps security, report visibility, etc.

Testing Methodology

Alright, now lets see the approach of testing WAFs. Wait, before that we need to know how they work right? Here you go.

How WAFs Work:

• Using a set of rules to distinguish between normal requests and malicious requests.
• Sometimes they use a learning mode to add rules automatically through learning about user behaviour.

Operation Modes:

• Negative Model (Blacklist based) - One that defines what is not allowed. Eg. Block all <script>*</script> inputs.
• Positive Model (Whitelist based) - One that defines what is allowed and rejects everything else.
• Mixed/Hybrid Model (Inclusive model) - One that uses a mixed concept of blacklisting and whitelisting stuff.

Where To Look:

• Always look out for common ports that expose that a WAF 80, 443, 8000, 8008, 8080, 8088.

Tip: You can use automate this easily by commandline using a screenshot taker like WebScreenShot.

• Some WAFs set their own cookies in requests (eg. Citrix Netscaler, Yunsuo WAF).
• Some associate themselves with separate headers (eg. Anquanbao WAF, Amazon AWS WAF).
• Some often alter headers and jumble characters to confuse attacker (eg. Citrix Netscaler, Big IP WAF).
• Some WAFs expose themselves in the response content (eg. DotDefender, Armor, truShield Sitelock).
• Other WAFs reply with unusual response codes upon malicious requests (eg. WebKnight).

Detection Techniques:

1. Make a normal GET request from a browser, intercept and test response headers (specifically cookies).
2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included).
3. If there is a login page somewhere, try some common (easily detectable) payloads like ' or 1 = 1 --.
4. If there is some search box or input field somewhere, try detecting payloads like <script>alert()</script>.
5. Make GET requests with outdated protocols like HTTP/0.9 (HTTP/0.9 does not support POST type queries).
6. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response.

Tip: This method could be easily achieved with tools like HPing3 or Scapy.

7. Side Channel Attacks - Examine the timing behaviour of the request and response content.

WAF Detection

Wanna detect WAFs? Lets see how.

Note

: This section contains manual WAF detection techniques. You might want to switch over to next section.

360 Web Application Firewall	Detectability: Easy Returns status code 493 upon unusual requests. On viewing source-code of error page, you will find reference to wzws-waf-cgi/ directory. Source code may contain reference to wangshan.360.cn URL. Response headers contain X-Powered-By Header.
</td> </tr>

WAF Evasion Techniques

Lets look at some methods of bypassing and evading WAFs.

Awesome Tools

WAF Fingerprinting:

1. Fingerprinting with NMap:

Source: GitHub | SVN

• Normal WAF Fingerprinting

nmap --script=http-waf-fingerprint <target>

• Intensive WAF Fingerprinting

nmap --script=http-waf-fingerprint  --script-args http-waf-fingerprint.intensive=1 <target>

• Generic Detection

nmap --script=http-waf-detect <target>

2. Fingerprinting with WafW00f:

Source: GitHub | Pypi

wafw00f <target>

WAF Testing:

• WAFBench - A WAF performance testing suite by Microsoft.
• WAF Testing Framework - A free WAF testing tool by Imperva.

WAF Evading:

1. Evading WAFs with SQLMap Tamper Scripts:

• General Tamper Testing

tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

• MSSQL Tamper Testing

tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

• MySQL Tamper Testing

tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor

• Generic Tamper Testing

sqlmap -u <target> --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

2. Evading WAFs with WAFNinja

Source: GitHub

• Fuzzing

python wafninja.py fuzz -u <target> -t xss

• Bypassing

python wafninja.py bypass -u <target> -p "name=<payload>&Submit=Submit" -t xss

• Insert Fuzzing

python wafninja.py insert-fuzz -i select -e select -t sql

3. Evading WAFs with WhatWaf:

Source: GitHub

whatwaf -u <target> --ra --throttle 2

Presentations & Research Papers

Presentations:

• WAF Profiling & Evasion Techniques - A WAF testing and evasion guide from OWASP.
• Protocol Level WAF Evasion Techniques - A presentation at about efficiently evading WAFs at protocol level from BlackHat US 12.
• Analysing Attacking Detection Logic Mechanisms - A presentation about WAF logic applied to detecting attacks from BlackHat US 16.
• WAF Bypasses and PHP Exploits - A presentation about evading WAFs and developing related PHP exploits.
• Playing Around with WAFs - A small presentation about WAF profiling and playing around with them from Defcon 16.

Research Papers:

• WASC WAF Evaluation Criteria - A guide for WAF Evaluation from Web Application Security Consortium
• Protocol Level WAF Evasion - A protocol level WAF evasion techniques and analysis by Qualys.
• WAF Evasion Testing - A WAF evasion testing guide from SANS.
• WAF Evaluation and Analysis - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from University of Amsterdam.
• Bypassing all WAF XSS Filters - A paper about bypassing all XSS filter rules and evading WAFs for XSS.
• Neural Network based WAF for SQLi - A paper about building a neural network based WAF for detecting SQLi attacks.