SQL Injection Filter Evasion Part 1

In this tutorial I will explain you some of the basics of SQL Injection
filter Evasion, This is the first part of the two of the articles I will
post on SQL Injection filter evasion and bypassing, In this post I am not
gonna teach you Basics of SQL injection, I will assume that you already
know them, because cmon every one talks about it, you will find tons and
tons of posts on forums related to basics of SQL Injection, In this post I
will talk about common methods of used by hackers and pentesters for
evading IDS, IPS, WAF's such as Modsecurity, dotdefender etc.

WebApplication Firewalls:

According to webappsec "Web Application Firewall (WAF): An intermediary
device, sitting between a web-clientand a web server, analyzing OSI Layer-7
messages for violations in the programmedsecurity policy. A web application
firewall is used as a security device protecting theweb server from attack."

Almost all Webapplication firewalls and IDS use Signature based protection,
where they are looking of common inputs such as "'Or 1=1", "Or x=x" etc.
But in my opinion webapplication firewalls are only good for detecting
automated tools and script kiddies. However if the tool you are using for
attacking a SQL Injection vulnerable database is an open source such as
SQLMAP, You can easily modify it to evade a webapplication firewall.

Detecting A WAF:Before learning about bypassing the WAF, You must know how
to detect a Webapplication firewall. There are numerous methods of
detecting if the target website is using a Webapplication firewall.

Prompt Message:

1. If you are attacking a website and you get an error like "Hacking
attempt detected" or "Page not found", you are up against a WAF.

Cookies:

The most common method of detecting a webapplication firewall is by
capturing the http:// request, Lots of WAF's add their own cookie in the
HTTP communication.

Here is a live brazilian website using WAF, The cookie value "WAT" shows
that the target host is using a WAF:

GET /news.asp?PageId=254 HTTP/1.1Host: www.poupex.com.brUser-Agent:
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.12)Accept:
image/png,*/*;q=0.5Accept-Encoding: gzip,deflateKeep-Alive:
300Proxy-Connection: keep-aliveReferer:
http://www.SomeSite.comCookie:ASPSESSIONCWKSPSVLTF=OUESYHFAPQLFMNBTKJHGQGXM;ns_af=xL9sPs2RIJMF5GhtbxSnol+xU0uSx;ns_af_.SomeSite.com_%2F_wat=KXMhOJ7DvSHNDkBAHDwMSNsFHMSFHEmSr?nmEkaen19mlrwBio1/lsrzV810C&

Dotdefender:

If you are up against a Dotdefender you will get the following error
message:

Observing HTTP Response:

If you see a similar http response whenever you make a malicious http
request, you are probably up against a MOD secuirty WAF.

HTTP/1.1 501 Method Not ImplementedDate: Fri, 27 Jun 2008 23:30:54
GMTAllow: TRACEContent-Length: 279Connection: closeContent-Type: text/html;
charset=iso-8859-1http://ws.

WEBAPPLICATION Firewall Evasion:

There are tons and tone of methods to evade a webapplication firewall, Here
is some of them:

1. Comments.

2. Changing Cases.

3. Encoding.

And much more.

Example of a sample IDS and WAF Signature:

alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: "SQL Injection attempt
detected, Your IP has been logged";

flow: to_server, established; content: "' or 1=1 --"; nocase; sid: 1; rev:1;

The above signature is telling WAF that if the attackers inputs the
following content into the webpage "' OR 1=1" display the message "SQL
Injection attempt detected, Your IP has been logged".

Bypassing The Signature:

Such poorly written signatures can be easily bypassed. Think for a second
what if the attacker inputs ' OR 2=2, Isn't 2=2, How about OR 3=3 and so
on. So such poorly written signatures are good for nothing. You can also
add comments in order to bypass more complex signatures, e.g OR 2/**/=/**/2.

Comments:

Comments are one of the most easiest ways to defeat a WAF, As lots of
signatures are not looking for the comments they are just looking for the
malicious keywords.

Union statement against a WAF without comments:

www.site.com/a.php?id=123 union select 1,2,3,4,5-- BLOCKED

Union statement against a WAF with comments:

www.site.com/a.php?id=123 union/*We are bypassing the WAF*/select/*Rafay
Hacking Artcles*/1,2,3,4,5-- ALLOWED

Changing Cases:

Some WAF's don't have any rule or signatures to detect upper cases, Here
are some examples of a union statement with Uppercase.

uNiOn aLl sElEcT

UnIoN aLL SELECT

You can combine uppercase statements with comments for more better results:

www.site.com/a.php?id=123 uNiOn All sEleCt/*We are bypassing the
WAF*/select/*Rafay Hacking Artcles*/1,2,3,4,5--

Well I hope you have liked this post, In this post we talked about
detecting a WAF and some basic techniques on evading a webapplication
firewall, However in the next post we will look at some more advanced
techniques such as encoding, whitespaces etc to bypass a webapplication
firewall.

Copy from Rafay hacking articles