Email: sebastian.schinzel@cs.fau.de Twitter: @seecurity WAFFle: Fingerprinting Filter Rules of Web Application Firewalls Isabell Schmitt, Sebastian Schinzel* Friedrich-Alexander Universität Erlangen-Nürnberg Lehrstuhl für Informatik 1 IT-Sicherheitsinfrastrukturen
Talk presented at 6th USENIX Workshop on Offensive Technologies (WOOT 2012) Full paper: http://www.sebastian-schinzel.de/_download/woot12.pdf Full video of talk: https://www.usenix.org/conference/woot12/waffle-fingerprinting-filter-rules-webapplication-firewalls 2
Introduction: Web Application Firewalls Web Application Firewalls intercept web requests filter requests to prevent attacks Internet Demilitarized Zone Intranet Web Server uses filter rules for detecting common attack patterns Passed Request Blocked Request blind for new attack patterns 3
Introduction: Web Application Firewalls Web Application Firewalls intercept web requests filter requests to prevent attacks Internet Demilitarized Zone Intranet Web Server uses filter rules for detecting common attack patterns Passed Request Blocked Request blind for new attack patterns If attacker knows active filter rule set, he can search for loopholes in the rule set What can the attacker learn about the active filter rule set of a WAF? 3
WAFfle: Fingerprinting Filter Rules of Web Application Firewalls Idea behind WAFfle 1. Generate polymorphic representations of exploit code (e.g. <script>alert(23);</script>, <script_>alert(23);</script>, <script >alert(23);</script> <script >alert(23);</script>) 2. Send to web app and measure response time 3. Analyse response time Internet Passed Request Blocked Request Demilitarized Zone Intranet Web Server 4
WAFfle: Fingerprinting Filter Rules of Web Application Firewalls Idea behind WAFfle Demilitarized Zone Intranet Web Server 1. Generate polymorphic representations of exploit code (e.g. <script>alert(23);</script>, <script_>alert(23);</script>, <script >alert(23);</script> <script >alert(23);</script>) 2. Send to web app and measure response time Internet 4 Passed Request Blocked Request 3. Analyse response time
Introduction: Web Application Firewalls Demilitarized Zone Intranet Web Server Internet Passed Request Blocked Request 5
Introduction: Web Application Firewalls Internet Demilitarized Zone Intranet Web Server 6
Introduction: Web Application Firewalls Internet Demilitarized Zone Intranet Web Server 7
WAFfle: Results Internet Demilitarized Zone Intranet Web Server mod_security filtering as web application plugin 8
WAFfle: Results Internet Demilitarized Zone Intranet Web Server mod_security filtering as web application plugin 8
WAFfle: Results Results All three scenarios allow to distinguish blocked from passed requests by observing response times With no repetitions, >95% of single requests already correctly determine blocked and passed requests 1(a) 1(b) 1(c) 9
WAFfle: Results Results All three scenarios allow to distinguish blocked from passed requests by observing response times With no repetitions, >95% of single requests already correctly determine blocked and passed requests 1(a) 1(b) 1(c) 9
WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) 10
WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) Web User 2) Victim Web Application Web Browser 3) WAF 4) Sends Measurements Attacker 1) Visits 10 Web Site
WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) Generate Javascript code that attacker embeds on web page Web User 2) Victim Web Application Attacker tricks other users to visit web page other users perform measurement and send measurements to attacker 3) Web Browser 4) Sends Measurements Attacker WAF 1) Visits 10 Web Site
WAFfle: Cross Site Timing Attack Cross Site Timing Attack 11
Thanks! Discussion. Email: sebastian.schinzel@cs.fau.de Twitter: @seecurity 12