Главная
Study mode:
on
1
DefCamp Web Application Firewall Bypassing - an approach for pentesters SECURITY CONSULTANT EUROSEC - SECURITY SINCE 1998
2
NORMALIZATION FUNCTIONS Simplifies the writing of rules • No Knowledge about different forms of input needed
3
INPUT VALIDATION Security Models define how to enforce rules • Rules consist of regular expressions • Three Security Models: 1. Positive Security Model 2. Negative Security Model 3. Hybrid Security M…
4
Bypassing Methods and Techniques
5
SKIPPING PARAMETER VERIFICATION PHP removes whitespaces from parameter names or transforms them into underscores
6
APPROACH FOR PENETRATION TESTERS
7
PHASE O - DISABLE WAF Objective find security flaws in the application more easily assessment of the security level of an application is more accurate
8
RECONNAISSANCE Objective: Gather information to get a overview of the target - Basis for the subsequent phases Gather information about - web server programming language - WAF & Security Model - Inte…
9
ATTACKING THE PRE-PROCESSOR Objective make the WAF skip input validation • Identify which parts of a HTTP request are inspected by the WAF to develop an exploit: 1. Send individual requests that diff…
10
FINDING AN IMPEDANCE MISMATCH Objective make the WAF interpret a request differently than the back end and therefore not detecting it Knowledge about back end technologies is needed
11
BYPASSING THE RULE SET Objective. find a payload that is not blocked by the WAFs rule
12
OTHER VULNERABILITIES Objective find other vulnerabilities that can not be detected by the WAF • Broken authentication mechanism . Privilege escalation
13
AFTER THE PENTEST Objective: Inform customer about the vulnerabilities • Advise customer to fix the root cause of a vulnerability . For the time being the vulnerability should be virtually patched by…
Description:
Explore web application firewall (WAF) bypassing techniques in this DefCamp 2016 conference talk. Learn about security models, input validation, and various bypassing methods used by penetration testers. Discover approaches for disabling WAFs, conducting reconnaissance, attacking pre-processors, exploiting impedance mismatches, and circumventing rule sets. Gain insights into identifying vulnerabilities that WAFs may not detect, such as broken authentication mechanisms and privilege escalation. Understand the importance of post-pentest actions, including informing clients about vulnerabilities and recommending both immediate virtual patching and long-term fixes for root causes.

Web Application Firewall Bypassing - DefCamp - 2016

DefCamp
Add to list
#Conference Talks #DefCamp #Information Security (InfoSec) #Penetration Testing #Cybersecurity #Security Models #Vulnerability Assessment #Programming #Web Development #Input Validation #Reconnaissance
0:00 / 0:00
1 of 13

DefCamp Web Application Firewall Bypassing - an approach for pentesters SECURITY CONSULTANT EUROSEC - SECURITY SINCE 1998