Posted: 03 May 2016 02:41 PM PDT
It is known that over the years, a trend that addresses the information security landscape has emerged, I mean, web applications are under attack, given this perspective, Web Application Firewalls are becoming increasingly popular, which are most commonly used by organizations to protect against various attacks such as SQL Injection, XSS etc.
Past Saturday, I conducted a "Webcast" on "Garage4hackers" on one of my favorite subjects in the field of Information Security i.e. "WAF Bypass". Initially, i had decided to present something on the topic of "Mobile Browser Security" due to the fact that this has been a topic I have been recently conducting a research on.
However i later realized that the "TakeAways" would not be much helpful, therefore i decided to talk about something that Bughunters/Pentesters can use in their day to day pentests and security engagements and hence i decided to present on this topic.
I must admit that the response has been overwhelming along with it, i have also managed to get a chance to learn more from the feedback and CTF responses.
I would like to specially thank "ImdadUllah", "Himanshu", "Sandeep" along with other garage4hackers members for inviting/supporting me through out the journey. One of the best things "G4H Community" is the work they are doing for the security community by conducting free of cost Webcasts. You can find a list of other Webcasts here - "http://www.garage4hackers.com/ranchoddas/"
In this webinar, the we will talk about various techniques that can be used to bypass WAF"s such as Brute Forcing, Regular expression reversing and browser bugs. The webinar would mostly discuss
- Basic know how about XSS attacks
After the webinar, we had this "CTF" challenge made up by a friend of mine "FileDescriptor", certain parts the first two challenges are based upon characteristics of a real world WAF that I encountered in wild which was combined with FD's ideas to make up the challenge . The last challenge is based upon "@FileDescriptor" unqiue idea and hence, it's not easy to crack and hence we named it as "Hard".
CTF Link :http://126.96.36.199
|You are subscribed to email updates from Ethical Hacking - Rafayhackingarticles. |
To stop receiving these emails, you may unsubscribe now.
|Email delivery powered by Google|
|Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States|