WAF fingerprint detection and recognition technology (1)

Web application protection system (also called website application-level intrusion defense system. Web Application Firewall (WAF ). Using an internationally recognized saying: Web Application Firewall is a product designed to protect Web applications by executing a series of HTTP/HTTPS security policies. This article introduces some common WAF fingerprint recognition technologies. For details, see the following:

I. WAF fingerprint

Cookie Value

Citrix Netscaler

"Citrix Netscaler" adds the "ns_af" value to the Cookie location of the HTTP returned header, which can be determined as the WAF of Citrix Netscaler, there are few such WAF in China (this product is actually the best 2013 firewall recognized by searchsecurity ).

A malicious request example:

GET / HTTP/1.1Host: target.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCookie: ASPSESSIONIDAQQSDCSC=HGJHINLDNMNFHABGPPBNGFKC; ns_af=31+LrS3EeEOBbxBV7AWDFIEhrn8A000;ns_af_.target.br_%2F_wat=QVNQU0VTU0lPTklEQVFRU0RDU0Nf?6IgJizHRbTRNuNoOpbBOiKRET2gA&Connection: keep-aliveCache-Control: max-age=0

F5 BIG IP ASM

F5 BiG ip asm adds "TS + random string" Cookie information to the Cookie. A non-malicious request is as follows: GET/HTTP/1.1 Host: www.tar get. comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv: 25.0) Gecko/20100101 Firefox/25.0 Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8Accept-Language: en-US, en; q = 0.5Accept-Encoding: gzip, deflateCookie: target_cem_tl = Beijing; s_fid = Beijing; s_vnum = 1388516400627% 26vn % 3D1; s_nr = 1385938565978-New; s_nr2 = 1385938565979-New; s_lv = 1385938565980; s_vi = [CS] v1 | percent [CE]; fe_typo_user = percent; TSe3b54b = 36f2896d9de8a61cf27aea24f35f8ee1abd1a43de557a25c529fe828; TS65374d = train: keep-aliveCache-Control: max-age = 0

HTTP Response

Mod_Security

Mod_Security is an open-source Web protection module designed for Apache. A malicious request Mod_Security will return "406 Not acceptable" in the response header.

Request:

GET /<script>alert(1);</script>HTTP/1.1Host: www.target.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive

Response:

HTTP/1.1 406 Not AcceptableDate: Thu, 05 Dec 2013 03:33:03 GMTServer: ApacheContent-Length: 226Keep-Alive: timeout=10, max=30Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
WebKnight
WebKnight is a common WAF device used in IIS. WebKnight returns the "999 No Hacking" message for malicious requests.
Request:
GET /?PageID=99<script>alert(1);</script>HTTP/1.1Host: www.aqtronix.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alive
Response:
HTTP/1.1 999 No HackingServer: WWW Server/1.1Date: Thu, 05 Dec 2013 03:14:23 GMTContent-Type: text/html; charset=windows-1252Content-Length: 1160Pragma: no-cacheCache-control: no-cacheExpires: Thu, 05 Dec 2013 03:14:23 GMT
F5 BIG IP
F5 big ip will return "419 Unknown" information for malicious requests, as follows:
GET /<script> HTTP/1.0HTTP/1.1 419 UnknownCache-Control: no-cacheContent-Type: text/html; charset=iso-8859-15Pragma: no-cacheContent-Length: 8140Date: Mon, 25 Nov 2013 15:22:44 GMTConnection: keep-aliveVary: Accept-Encoding

DotDefender
DotDefender is also well known for its protection against. net programs. It will return "dotDefender Blocked Your Request" information for malicious requests.
Request:
GET /---HTTP/1.1Host: www.acc.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveCache-Control: max-age=0
Response:
HTTP/1.1 200 OKCache-Control: no-cacheContent-Type: text/htmlVary: Accept-EncodingServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Thu, 05 Dec 2013 03:40:14 GMTContent-Length: 2616<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">


Specific resource files
Some specific WAF reports specific CSS or JS files on the returned alarm page, which can be used as a basis for judgment. Such situations are rarely found in the WAF class and can be merged into the HTTP response.
See two examples:
 
   

  
    
<Html> <body style = "margin: 0; padding: 0 "> <center> <iframe width =" 100% "align =" center "height =" 870 "frameborder =" 0 "scrolling =" no "src =" http://safe.webscan.360.cn/stopattack.html "> </iframe> </center> </body>  
    
HTTP/1.1 405 Not Allowed
  
    
Server: ASERVER/1.2.9-3
  
    
Date: Fri, 27 Dec 2013 14:15:14 GMT
  
    
Content-Type: text/html
  
    
Connection: keep-alive
  
    
X-Powered-By-Anquanbao: MISS from uni-tj-ky-sb3
  
    
Content-Length: 7188
  
    
<Div class = "wrapper">
  
    
<Div class = "titlelogo"> </div>
  
    
<Div class = "err_tips"> your access is blocked because the URL you visit may pose a security threat to your website. </Div>
  
    
<Div class = "feedback">
  
    
<Form action = "http://report.anquanbao.com/api.php" method = "post">
  
    
<Input type = "hidden" name = "black_code" value = "" class = "hidden_rule_id"/>
  
    
<Input type = "hidden" name = "deny_time" value = "" class = "hidden_intercept_time"/>
  
    
<Input type = "hidden" name = "server_id" value = "" class = "hidden_server_title"/>
  
    
<Input type = "hidden" name = "deny_url" value = "" class = "deny_url"/>
  
    
<Input type = "submit" class = "submit_img" value = ""/>
  
    
</Form>
  
    
</Div>
  
    
<Div class = "detailcontent">
  
    
<Div class = "detailupimg">
  
    
<A href = "javascript:;"> webmaster click to View Details </a>
  
    
</Div>
  
    
<Div class = "detaildownimg">
  
    
<A href = "javascript:;"> webmaster click to View Details </a>
  
    
</Div>
  
    
<Div class = "hiddeninfo">
  
    
Rule ID: <span class = "rule_id"> 10384 </span>
  
    
<Span style = "margin-left: 20px"> interception time: </span> <span class = "intercept_time"> 22:15:14 </span>
  
    
<Div class = "hiddeninfosecond">
  
    
<Span style = "padding-top: 20px"> ServerName: </span> <span class = "server_title" style = "padding-top: 20px "> uni-tj-ky-sb3/1.2.9-3 </span>
  
    
</Div>
  
    
<Div class = "hiddeninfothird">