RSS

Detecting Web Application Firewalls

13 Jan

Web application firewalls play an important role in the security of websites as they can mitigate risks and they can offer protection against a large-scale of vulnerabilities.That is the reason that many companies in nowadays are implementing a web application firewall solution in their existing infrastructure.Of course an implementation of a WAF on its own cannot resolve the security problems that a web application might have and proper modifications must be made in order many of the attacks to be able to identified and blocked.

Penetration testers must be aware before they start the web application engagement if there is a WAF in place as the results of their attacks can be affected.So if the penetration test is a white-box then this question should be asked in the initial meetings with the client.If it is a black-box then the penetration tester should try to investigate on his own whether or not there is a web application firewall in place.In this article we will try to examine the methods and the tools that will allow us to detect a WAF.

Before we start it is always good to know where a WAF is usually used on a network.Most of the times a web application firewall is between a web server and a client like the one that we can see in the next image.However there are web application firewalls that can be installed directly into the web servers.

WAF – Network Topology

Manual Discovery

The existence of a web application firewall can be identified with a variety of ways.A good indication is by checking the cookies because some web application firewalls add their own cookie in the communication between the client and the web server.For example in the next image we can see an HTTP request where a cookie has been added by the WAF.Specifically the ns_af unveils that the web application firewall is a Citrix Netscaler.

WAF Discovery Via Cookies

WAF Discovery Via Cookies

 

Another method is through the HTTP headers as many WAF products allow the header to be rewritten and they can also make the web server to produce different HTTP responses from the common ones.For example as we can see and from the image below the web server respond to our request with a message You shouldn’t be here and unveiled that is Varnish.

Indication of WAF via HTTP response

Indication of WAF via HTTP response

 

Additionally a web application firewall presence can be identified in cases where you are trying to send a request and the session is expiring very quickly like the example in the next image.

WAF - Session Expired

WAF – Session Expired

Automated Discovery

The most well-known tool that can detect and fingerprint web application firewalls is the WAFW00F.The usage of this tool is very simple and can discover a variety of WAF products.The next image is showing the successful detection of a Citrix Netscaler firewall that protects the website.

Detection of WAF with wafwoof

Detection of WAF with wafwoof

 

Nmap also can be used for this purpose as it contains a script that can detect a web application firewall.Specifically we run the script against the same website as above and the results were the following:

WAF detection via Nmap

WAF detection via Nmap

 

Finally there is a script that is capable only to detect Imperva WAF installations.

Detection of Imperva WAF

Detection of Imperva WAF

 

Conclusion

In this article we examined some methods and tools for detection of web application firewalls.This is an important process that must be done in every web application penetration test during the information gathering stage in order to ensure that the results from the attacks that will performed are accurate.Also by having the knowledge that a WAF is in place the penetration tester can try different techniques in order to bypass the protections and to exploit any weaknesses in the web application.

About these ads
 
5 Comments

Posted by on January 13, 2013 in Web Application

 

Tags: , , , , ,

5 responses to “Detecting Web Application Firewalls

  1. Emilio

    January 13, 2013 at 6:07 pm

    Muy bueno, gracias por compartir la información!, no conocía lo de Imperva.
    Gracias!

     
  2. Dimitris

    January 15, 2013 at 12:28 am

    el_GR: Άριστο μεγάλε!
    en_GB: Fabulous, you’re the man!

     
  3. Dimitris

    January 15, 2013 at 12:29 am

    You may have a look at Juniper Mykonos Intrusion Deception WAF… intriguing!

     
  4. Lamar Spells

    March 28, 2013 at 6:52 pm

    Thanks for linking to imperva.sh. Much appreciated. I wrote imperva.sh to assist Imperva customers in making sure that the environments that they expected their WAFs to protect were actually being protected by the appliances. There are a number of scenarios where this might not be the case, such as new servers being added to the environment without the involvement of the security team, errors in network configuration causing traffic to route around the Imperva, etc. Hopefully, Imperva customers will find it helpful as it is probably the fastest of all these tools at that one specific task. :-)

     

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
Follow

Get every new post delivered to your Inbox.

Join 701 other followers

%d bloggers like this: