WAF指纹探测及识别技术(1)

Web应用防护系统(也称：网站应用级入侵防御系统。英文：Web
Application Firewall，简称： WAF)。利用国际上公认的一种说法：
Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的
一款产品。本文介绍了常见的WAF指纹识别的一些技术，详见如下：一、WAF指纹Cookie值Citrix Netscaler“Citrix Netscaler”会在HTTP返回头部Cookie位置加入“ns_af”的值，可以以此判断为Citrix Netscaler的WAF，国内此类WAF很少(这货居然是searchsecurity认定的2013
最好的防火墙)。一个恶意的请求示例：GET / HTTP/1.1Host: target.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-
Language: en-US,en;q=
0.5Accept-Encoding: gzip, deflateCookie: ASPSESSIONIDAQQSDCSC=HGJHINLDNMNFHABGPPBNGFKC; ns_af=31+LrS3EeEOBbxBV7AWDFIEhrn8A000;ns_af_.target.br_%2F_wat=QVNQU0VTU0lPTklEQVFRU0RDU0Nf?6IgJizHRbTRNuNoOpbBOiKRET2gA&Connection: keep-aliveCache-Control: max-age=0F5 BIG IP ASMF5 BiG IP ASM会在Cookie中加入“TS+随机字符串”的Cookie信息，一个非恶意的请求如下：GET / HTTP/1.1Host: www.target.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCookie: target_cem_tl=40FC2190D3B2D4E60AB22C0F9EF155D5; s_fid=77F8544DA30373AC-31AE8C79E13D7394; s_vnum=1388516400627%26vn%3D1; s_nr=1385938565978-New; s_nr2=1385938565979-New; s_lv=1385938565980; s_vi=[CS]v1|294DCEC0051D2761-40000143E003E9DC[CE]; fe_typo_user=7a64cc46ca253f9889675f9b9b79eb66; TSe3b54b=36f2896d9de8a61cf27aea24f35f8ee1abd1a43de557a25c529fe828; TS65374d=041365b3e678cba0e338668580430c26abd1a43de557a25c529fe8285a5ab5a8e5d0f299Connection: keep-aliveCache-Control: max-age=0HTTP响应Mod_SecurityMod_Security是为Apache设计的开源Web防护模块，一个恶意的请求Mod_Security会在响应头返回“406 Not acceptable”的信息。请求：GET /<script>alert(1);</script>HTTP/1.1Host: www.target.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive响应：HTTP/1.1 406 Not AcceptableDate: Thu, 05 Dec 2013 03:33:03 GMTServer: ApacheContent-Length: 226Keep-Alive: timeout=10, max=30Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1<head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>WebKnightWebKnight是用来设计在IIS下面使用的WAF设备，较为常见。WebKnight会对恶意的请求返回“999 No Hacking”的信息。请求：GET /?
PageID=99<script>alert(1);</script>HTTP/1.1Host: www.aqtronix.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive响应：HTTP/1.1 999 No HackingServer: WWW Server/1.1Date: Thu, 05 Dec 2013 03:14:23 GMTContent-Type: text/html; charset=windows-1252Content-Length: 1160Pragma: no-cacheCache-control: no-cacheExpires: Thu, 05 Dec 2013 03:14:23 GMTF5 BIG IPF5 BIG IP会对恶意请求返回“419 Unknown”的信息，如下：GET /<script> HTTP/1.0HTTP/1.1 419 UnknownCache-Control: no-cacheContent-Type: text/html; charset=iso-8859-15Pragma: no-cacheContent-Length: 8140Date: Mon, 25 Nov 2013 15:22:44 GMTConnection: keep-aliveVary: Accept-EncodingdotDefenderdotDefender用来防护.net的程序，也比较出名，会对恶意请求返回“dotDefender Blocked Your Request”的信息。请求：GET /---HTTP/1.1Host: www.acc.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveCache-Control: max-age=0响应：HTTP/1.1 200 OKCache-Control: no-cacheContent-Type: text/htmlVary: Accept-EncodingServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Thu, 05 Dec 2013 03:40:14 GMTContent-Length: 2616<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>dotDefender Blocked Your Request</title>特定资源文件部分特定WAF在返回的告警页面含特定的CSS或者JS文件，可以作为判断的依据，这类情况在WAF类里比较少，实际也可以归并到HTTP响应中。看2个样例：<html><bodystyle="margin:0;padding:0"><center><iframew
idth="100%"align="center"height="870"frameborder="0"scrolling="no"src="http://safe.webscan.360.cn/stopattack.html"></iframe></center></body></html>HTTP/1.1405NotAllowedServer:ASERVER/1.2.9-3Date:Fri,27Dec201314:15:14GMTContent-Type:text/htmlConnection:keep-aliveX-Powered-By-Anquanbao:MISSfromuni-tj-ky-sb3Content-Length:7188<divclass="wrapper"><divclass="titlelogo"></div><divclass="err_tips">由于您访问的URL有可能对网站造成安全威胁，您的访问被阻断。</div><divclass="feedback"><formaction="http://report.anquanbao.com/api.php"method="post"><inputtype="hidden"name="black_code"value=""class="hidden_rule_id"/><inputtype="hidden"name="deny_time"value=""class="hidden_intercept_time"/><inputtype="hidden"name="server_id"value=""class="hidden_server_title"/><inputtype="hidden"name="deny_url"value=""class="deny_url"/><inputtype="submit"class="submit_img"value=""/></form></div><divclass="detailcontent"><divclass="detailupimg"><ahref="javascript:;">站长点击查看详情</a></div><divclass="detaildownimg"><ahref="javascript:;">站长点击查看详情</a></div><divclass="hiddeninfo">规则ID:<spanclass="rule_id">10384</span><spanstyle="margin-left:20px">拦截时间：</span><spanclass="intercept_time">2013/12/2722:15:14</span><divclass="hiddeninfosecond"><spanstyle="padding-top:20px">ServerName：</span><spanclass="server_title"style="padding-top:20px">uni-tj-ky-sb3/1.2.9-3</span></div><divclass="hiddeninfothird"> 1 2 下一页>>查看全文内容导航第 1 页：WAF指纹第 2 页：WAF识别工具原文：WAF指纹探测及识别技术(1) 返回网络安全首页

时间： 2024-10-30 11:13:56

WAF指纹探测及识别技术(1)

WAF指纹探测及识别技术(1)的相关文章

XSS现代WAF规则探测及绕过技术(1)

XSS现代WAF规则探测及绕过技术

人脸识别技术，将电影变成现实

刷脸和指纹识别out啦，这些公司正在用静脉识别技术颠覆金融业

高通发布指纹识别技术Snapdragon Sense ID

iPhone新款手机会否采用指纹识别技术？

智能手机搭载指纹识别技术将成为未来主流

芯片商洗牌战拉开序幕指纹识别技术独霸市场

用户指纹技术识别技术更安全？你会选择哪种？