Web Application Firewalls:
Attacking detection logic
mechanisms

Vladimir Ivanov@httpsonly

/whoam/i
MSc Information Security (merit) - RHUL (UK)Web App penetration tester at Positive Technologies (ptsecurity.com)

Agenda1.

Introduction2.

Detection logic in WAF

3.

METHOD I: Syntax bypass

4.

METHOD II: Logical bypass

5.

METHOD III: Unexpected by primary logic bypass

6.

Takeaways

Motivation
The Standoff:
1. Attackers. Mix of various techniques, rarely understand root cause.
2. Defenders. WAFs protect against automative testing, every vendorimplements additional functionality.

Result: No careful whitebox analysis

WAF workflow example
Stage 1: Parse HTTP(s) packet from client
Stage 2: Chose rule set depending on type ofincoming parameter

Stage 3: Normalise data
Stage 4: Apply detection logic
Stage 5: Make detection decision

WAF workflow:
Detection logic

repsheetlibinjection

OWASP CRS 2
Reputation

OWASP CRS 3dev

OWASP CRS 3rc

Comodo rules
Anomalydetection

HMM

Tokenizer

PHPIDS
Score
Builder

Waf.redQuickDefenceWaf

NAXSI
ShadowD

Vultureprojectetc…

Regular expression…
…is a sequence of characters that define a search pattern(?i)(<script[^>]*>.*?)
123

500+ regular expressions:Sources• OWASP CRS2 (modsecurity)• OWASP CRS3dev (modsecurity)• OWASP CRS3rc1 (modsecurity)• PHPIDS• Comodo WAF• QuickDefense

XSS

12.8%

43.3%

SQL

43.8%
Other: LFI/RFI,
PHP, OS exec, etc

Results
300+ potential bypasses
Most “vulnerable”: PHPIDS (E = 1,15)
Less “vulnerable”: Comodo WAF (E = 0,32)
Most “exploitable”: OWASP CRS3-rc (E = 0,89)

E = Potential bypasses / Total rules

METHOD I: Syntax bypass
Of regular expressions
Enumerate all possible and invent all impossible mistakes

What’s wrong with regexp?
Level: Easy!

What’s wrong with regexp?
Level: Easy!

1. atTacKpAyloAd(?i:)

What’s wrong with regexp?
Level: Easy!

1. atTacKpAyloAd

(?i:)

2.

^$

attackpayload

What’s wrong with regexp?
Level: Easy!

1. atTacKpAyloAd

(?i:)

2.

^$

attackpayload

3. attackpayloadattackpayloadattackpayloadattackpa… {1,3}What’s wrong with regexp?
Level: Medium
1.

ReDoS

What’s wrong with regexp?
Level: Medium
1.

ReDoS

2.

Repetitions: + *What’s wrong with regexp?
Level: Medium
1.

ReDoS

2.

Repetitions: + *3.

Blacklisting wildcards in a set

What’s wrong with regexp?
Level: Advanced1.

Non-standard diapasons

2.

POSIX character classes

3.

Operators

4.

Backlinks, wildcards

Regular expressions:
Security cheatsheet
2 parts: theoretical "whitepaper" and practical "code".
Hack regular expressions with regular expressions!
+ SAST: Assists with whitebox analysis of regular expressions in sourcecode of your projects+ Low false positives: Focused on finding high severity security issues+ Opensource on Github!
- Does not dynamically analyze lexis (yet).

https://github.com/attackercan/
REGEXP-SECURITY-CHEATSHEETTarget audience
Not only WAFs use Reg Exp Detection Logic:• XSS Auditors• Backend parsers• Front-end analyzers

Developers, security auditors, bughunters

DEMO

Regex Security Cheatsheet DEMO^(?:ht|f)tps?://(.*)$

Comodo WAF:
Att4ck is bl0cked!

QuickDefense WAF:
Attackers are lazy enough(\bunion[\s\\*\/]{1,100}?\bselect\b)JavaScript checker in real-life web app

JavaScript checker in real-life web app

We can make ReDoS on client-side by supplying specially crafted email as input.

JavaScript checker in real-life web app

We can make ReDoS on client-side by supplying specially crafted email as input.
But what if backend also has same regex for checking?

JavaScript checker in real-life web app

We can make ReDoS on client-side by supplying specially crafted email as input.
But what if backend also has same regex for checking?EdgeHTML.dll

EdgeHTML.dll

IE+Edge XSS
AuditorEdgeHTML.dll

IE+Edge XSS
AuditorResult:blockedEdgeHTML.dll

Regexpbypass.
Result: alert!
Thx @ahack_ru for payload

(?:div|like|between|and|not )\s+\w)

(?:div|like|between|and|not )\s+\w)
https://github.com/PHPIDS/PHPIDS/commit/667e63af93e8fd2ee4df99dd98cb41acdf480906

What’s next?
1. Identify WAF vendor and version using “signature” vulnerabilities.

What’s next?
1. Identify WAF vendor and version using “signature” vulnerabilities.
2. Reveal and apply bypasses depending on a situation

What’s next?
1. Identify WAF vendor and version using “signature” vulnerabilities.
2. Reveal and apply bypasses depending on a situation
3. Craft string which bypasses all regexp-based rules.

ModSecurity SQLi Bypass
Basic SQLi is given:

All SQLi Regexp bypass:​1'OR#foo
id=IF#foo(ASCII#foo((SELECT-version()/1.))<250,1,0) #What’s next?
1. Identify WAF vendor and version using “signature” vulnerabilities.
2. Reveal and apply bypasses depending on a situation
3. Craft string which bypasses all regexp-based rules.

4. …

What’s next?
1. Identify WAF vendor and version using “signature” vulnerabilities.
2. Reveal and apply bypasses depending on a situation
3. Craft string which bypasses all regexp-based rules.

4. …
5. Dig deeper!

METHOD II: Logical bypass
Manual review analysis+Non-standard findings- SubjectiveBlacklists fail #1

https://github.com/netty/netty/issues/5535

Blacklists fail #2, 3, 4, …
NAXSI

0x0b10101
b’10101’ModSecurity 2.2.9
XSS Rule 973300<(a|abbr|acronym|...

<non_existing_tag
onmouseover=alert(1)>hover this!

adduser

useradd

ipconfig
copy, move

ifconfig
cp, mv

ModSecurity 3RC-1
OS-Commands.data

Researches success@mazen160

Researches success@mazen160

METHOD III: Unexpectedby primary logic bypass

XSS Fuzzer

XSS Fuzzer

libinjection

libinjection

https://github.com/attackercan/
CPP-SQL-FUZZER• Receive SQL query as input• Fuzz it (mysql.h, SQLAPI.h, ODBC?)• Record every query except syntax errors• Parse output!
• Current MySQL.h perfomance: 21M symbols in <1 hour;
speed = 9k queries per second (QPS).
• Up to 1.6M QPS!

SQL fuzzer

SQL fuzzer: Examples

SQL Fuzzer: Results

Contribution• Regexp security cheatsheet + SAST
• Blacklist improvement• SQL Fuzzer: Classified tables

https://github.com/attackercan

TODO
1.

Update Regular Expression Security Cheatsheet

2.

Create regular expression Dynamic analysis tool3.

“Clever fuzzing” + scalable (MySQL allows 1.6M QPS)

Questions?

Thank you
Arseniy Sharoglazov <mohemiv@gmail.com>(Contribution to Regex Security Cheatsheet)

Dmitry Serebryannikov @dsrbr(Contribution to SQL fuzzer)

Andrey Evlanin @xpathmasterAll @ptsecurity team ;)