Welcome back guys in this module. I
will discuss bypassing web application
of firewalls. This is a very nice
example.
Because we have web application firewalls
in our corporate environments, right
they are placed in between us
users also attackers
hackers and web applications.
So what the what the web application firewalls
are trying to do is something like
this trying to figure out whether someone is
trying to hack the web app, right?
And if there is a kind of suspicious traffic, then
the web application firewalls just
blocks the connection between the user
or hacker and the web application and
and you've got a problem you as a penetration tester
you as a ethical hacker, right?
And that's the reason why you have to learn how
to bypass web application of firewalls in
order to successfully find SQL injections and exploit
them. So this is a an obstacle
for ethical hackers and
Pen testers, right? It just makes
the game more difficult for us.
Okay, so let me hear start
with this command now, you
know very well what this command
is all about.
We've got the URL like example.com items
dot PHP search name XYZ.
So we are just the research just
a kind of search functionality and we
are going to find out where there is something
like xyzat right in our online store.
You can put whatever you want but important thing is
certain parameter, so nothing extraordinary here
and then we've got risk Free level five
and banner. So what I want to focus right
now on is that this
command can be used to send maximum
number of payloads to
the web application, right? So if
you want to
Figure out if surge name
parameters is vulnerable to SQL injection
and you want to send a maximum
number of payloads, you're gonna use risk-free and level
5 and that's the maximum one you can do. It may
happen that no injection point will
be detected. So this is it.
So, you know how to send the maximum number of payloads, but it may happen
that you will not be successful.
And well, there are different reasons of
why you might not be successful. One of
them is like there is no SQL injection
possible here, right? So it
may happen that surgeoning parameter is not vulnerable.
To a SQL injection. It's possible, but maybe
our attack is blocked by web application firewall
in short was
And well, if you
don't learn how to bypass web application firewall, then
you cannot learn if indeed there
is any kind of SQL injection
vulnerable You're not right?
So this is another challenge for you.
Trying to bypass web application firewall and
learn if SQL injection is possible or not.
So now let me show you how you can and bypass web
application firewall just to give you a kind of overview of how
it works.
There is something called.
Thumpers scripting in SQL map
and tamper scripts can be used to
you know mutate your
requests so that well you
are actually for example able to bypass web application
firewalls.
So tampering script takes your request mutates
this request so that it may
be possible after this mutation to go
through the firewall. Just
just an example. There are quite many different campus
Scripts.
Here you can you can go to temper directory
in SQL map and you can learn about them. But
let me just give you one example popular one random
case.
This is a an exemplary tamper script
that can be used to bypass web application firewalls.
And as the name suggests, let's say this tamper
script is used to change the
keywords to a mixture of small and
capital letters, right? So when you go a little
bit down into the actual SQL injection
commands, then you
will see a keywords like for example, select, right?
Well on default we use capital letters and
web application firewalls have
some rules like they're trying to figure out
whether some suspicious keywords
are going to send by a user.
And if it's gonna happen
then potentially it might might mean that someone is trying
to launch a school injection attack here, right? But one
of the ways of how you can bypass this firewalls
is you can try.
To send instead of let's say the classical the
default names like capital letters. You
can try to send the mixture of small and capital
letters like here right and it may
help you ethical hacker to bypass web application
firewall. This is just an example to give you an idea of
how how it works. And now let's
go to the command and here is the command
actually right? So in our case we've got for example search
name.
We are going to find out whether a search name parameter.
Is vulnerable to SQL injection? We've got
risk Free level 5 and
in addition to this we've got temper random
case because well if
we are
not successful with risk free and level 5
then the actually only thing that we can do more is
try to do some kind of tamper scripting right
and at the very end we've got Banner, right?
So what I suggest here is something like
this.
Risk-free level 5, of course, assuming that you've
got staging platform. If you are not successful try
with tamper script so -temper
and for example random case and then if
you are not successful, then it probably means that
SQL injection is not possible here.
Okay. So now you have a kind of
understanding of how you can bypass web application firewalls
with the so called tamper scripts. So
let's jump to the demo and let me show you how it works in
practice.