Attackers can bypass WAF brute-force attacks to crack users.

Attackers can bypass WAF brute-force attacks to crack users.

Hexun provides interfaces for Traversing users. However, WAF blocked the user password during brute-force cracking, finally bypassing WAF and successfully cracked the attack.

The webmail traversal interface is as follows:

Https://reg.hexun.com/regname.aspx

Simple registration function. after entering the email address, you can use ajax to submit and check whether the user has already registered the email address,

If you have not registered, only:

{"State": "Y", "msg": "available "}

Registered yet:

{"State": "N", "msg": "email has been registered "}

There is no problem with this interface. I only know some registered mailboxes. Use one of them to crack the password and try to see if it is possible to hit the database or something. However, this occurs more than a dozen times after the brute-force cracking:


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 22 Mar 2015 13:46:58 GMT

Content-Type: Text/Html; charset = gb2312

Content-Length: 98

Connection: close

Cache-Control: no-cache

Pragma: no-cache

Expires:-1

X-AspNet-Version: 4.0.30319

Set-Cookie: hexunGoUrl = http:// I .hexun.com; path =/

X-Powered-By: ASP. NET
 

This obviously has waf. Let me see if it can be bypassed. Change your account and try again,
 

What, is it not easy to change the number? This obviously blocked my ip address. I decided to try another ip address. This was the attempt and I found:

First try x-forwarded-for to see if you can enable Firefox plug-in,

Come on: X-Forwarded-For127.0.0.1

The result is as follows:
 

Logon successful:
 

At this point, the waf account lock has expired, and other users will not crack it one by one. It is expected that no more than 12306 million

Solution:

Modify waf Policy