ืืขืฆืืข ืืึธืจ ืืืจ ืืืคืจืืื Nemesida WAF Free, ืึท ืืื ืึทืืืฉ ืืึธืืืืข ืคึฟืึทืจ NGINX ืืืึธืก ืืืึทืงืก ืื ืคืืื ืืืืฃ ืืืขื ืึทืคึผืืึทืงืืืฉืึทื ื. ื ืื ืขื ืืขื ืื ืืขืฉืขืคื ืืืขืจืกืืข, ืืืึธืก ืืื ืืืืืจื ืืืืฃ ืืึทืฉืื ืืขืจื ืขื, ืื ืคืจืื ืืืขืจืกืืข ืึทื ืึทืืืืืจื ืจืืงืืืขืก ืืืืื ืืื ืื ืืกืืืข ืืืคึฟื.
ืคึฟืขืึดืงืืืื ืคืื ืื ืืขืืืื ื ืคืื Nemesida WAF 4.0.129
ืืืืืขืจ ืื ืงืจืึทื ื ืืขืืืื ื, ืื Nemesida WAF ืืื ืึทืืืฉ ืืึธืืืืข ืฉืืืฆื ืืืืื Nginx Stable 1.12, 1.14 ืืื 1.16. ืื ื ืืึทืข ืืขืืืื ื ืืืกืืฃ ืฉืืืฆื ืคึฟืึทืจ Nginx Mainline, ืกืืึทืจืืื ื ืคืื 1.17, ืืื Nginx Plus, ืกืืึทืจืืื ื ืคืื 1.15.10 (R18).
ืคืืจืืืืก ืืึทืื ืื ืื ืืขืจ WAF?
NAXSI ืืื mod_security ืืขื ืขื ืืืกืืึธืืข ืื ืืขืจืกื ืคืึธืืงืก ืคืจืื ืืืึทืฃ ืืึทืืืฉืืื, ืืื mod_security ืืื ืึทืงืืืืืื ืคึผืจืึธืืึธืืขื ืืืจื Nginx, ืืึธืืฉ ืืืืืขืก ืขืก ืืื ืืขืืืขื ืืขื ืืฆื ืืืืื ืืื Apache2. ืืืืืข ืกืึทืืืฉืึทื ื ืืขื ืขื ืคืจืื, ืึธืคึฟื ืืงืืจ ืืื ืืึธืื ืคืืืข ืืืืขืจื ืึทืจืื ืื ืืืขืื. ืคึฟืึทืจ ืืึธื_ืกืขืงืืจืืื, ืคืจืื ืืื ืืขืฉืขืคื ืืกืืืข ืฉืืขืื ืืขื ืขื ืืืจืขืืืืื ืคึฟืึทืจ $ 500 ืคึผืขืจ ืืึธืจ, ืคึฟืึทืจ NAXSI ืขืก ืืื ืึท ืคืจืื ืืึทื ื ืคืื ืกืืื ืึทืืฉืขืจื ืืืืก ืคืื ืื ืงืขืกืื, ืืื ืืืจ ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ื ืึธื ืกืขืืึทืื ืคืื ืึผืืืื, ืึทืืึท ืืื ืืึธืงืกืกื.
ืืขื ืืึธืจ ืืืจ ืืขืกืืขื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโNAXSI ืืื Nemesida WAF Free. ืืงืืฆืืจ ืืืขืื ืื ืจืขืืืืืืื:
- NAXSI ืืื ื ืืฉื ืืขืงืึธืืข ืืึธืคึผื URL ืืื ืงืืืืขื
- NAXSI ื ืขืื ืึท ืืืืขืจ ืืึทื ื ืฆืืื ืฆื ืงืึทื ืคืืืืขืจ - ืืืจื ืคืขืืืงืืึทื, ืื ืคืขืืืงืืึทื ืืขืจืฉื ืกืขืืืื ืืก ืืืขื ืคืึทืจืฉืคึผืึทืจื ืจืืึฟ ืจืืงืืืขืก ืืืขื ืืจืืขืื ืืื ืึท ืืืขื ืึทืคึผืืึทืงืืืฉืึทื (ืืขืจืืืืืขื ืืฉ, ืขืืืืื ื ืึท ืคึผืจืึธืคืื ืึธืืขืจ ืืึทืืขืจืืึทื, ืคึผืึทืจืืืกืึทืคึผืืืืื ื ืืื ืกืขืจืืืืื, ืืื"ื ื) ืืื ืขืก ืืื ื ืืืืืง ืฆื ืืืฉืขื ืขืจืืื ืืืกื ืขื ืจืฉืืืืช. , ืืืึธืก ืืื ืึท ืฉืืขืื ืืืืจืงืื ื ืืืืฃ ืืืืขืจืืืึทื. Nemesida WAF Free ืืื ืคืขืืืงืืึทื ืกืขืืืื ืืก ืืื ื ืืฉื ืืืจืืคืืจื ืึท ืืืื ืคืึทืืฉ positive ืืฉืขืช ืืจืืขืื ืืื ืืขื ืคึผืืึทืฅ.
- ืื ื ืืืขืจ ืคืื ืืืกื ืื ืคืืื ืคึฟืึทืจ NAXSI ืืื ืคืืืข ืืึธื ืืขืืขืจ, ืขืืง.
ืืจืึธืฅ ืื ืฉืึธืจืืงืึธืืื ืืก, NAXSI ืืื mod_security ืืึธืื ืืคึผืืืช ืฆืืืื ืึทืืืืึทื ืืืืืฉืื - ืึธืคึฟื ืืงืืจ ืืื ืึท ืืจืืืก ื ืืืขืจ ืคืื ื ืืฆืขืจืก. ืืืจ ืฉืืืฆื ืืขื ืืขืืึทื ืง ืคืื ืืืกืงืืึธืืืื ื ืื ืืงืืจ ืงืึธื, ืึธืืขืจ ืืืจ ืงืขื ืขื ื ืืฉื ืืึธื ืืึธืก ื ืึธื ืจืขืื ืฆื ืืขืืืขื ืคึผืจืึธืืืขืืก ืืื "ืคึผืืจืึทืืขืจืืึท" ืคืื ืื ืืขืฉืขืคื ืืืขืจืกืืข, ืึธืืขืจ ืฆื ืคืึทืจืืืืืงื ืคึฟืึทืจ ืืขื ืืืกืึธืจื, ืืืจ ืืขื ืขื ืืึธืจ ืืืกืงืืึธืืืื ื ืื ืืื ืืึทืื ืคืื ืื ืืกืืืข ืฉืืขืื. ืืืจ ืึธืคึผืฉืึทืฆื ืคึผืจืืืืึทืืงืืื ืืื ืคึฟืึธืจืฉืืึธืื ืืืจ ืืึทืฉืืขืืืงื ืืขื ืืื ืืื ืึท ืคึผืจืึทืงืกื ืกืขืจืืืขืจ.
ืคึฟืขืึดืงืืืื ืคืื Nemesida WAF Free:
- ืืืื-ืงืืืึทืืืืขื ืืกืืืข ืืึทืืึทืืืืก ืืื ืึท ืืื ืืืื ื ืืืขืจ ืคืื ืคืึทืืฉ positive ืืื ืคืึทืืฉ ื ืขืืึทืืืื.
- ืื ืกืืึทืืืจืื ื ืืื ืืขืจืืืึทื ืืืงื ืคึฟืื ืื ืจืืคึผืึทืืึทืืึธืจื (ืขืก ืืื ืฉื ืขื ืืื ืืึทืงืืืขื);
- ืคึผืฉืื ืืื ืคืึทืจืฉืืืืืง ืืขืฉืขืขื ืืฉื ืืืขืื ืื ืกืึทืืึทื ืฅ, ืืื ื ืืฉื ืึท "ืืึทืืึทืืึทื" ืืื NAXSI;
- ืืึธืจ ืคืจืื, ืืื ืงืืื ืจืืกืืจืืงืฉืึทื ื ืืืืฃ ืื ืกืืืข ืคืื โโโโืคืึทืจืงืขืจ, ืืืืจืืืึทื ืืื ืืช, ืขืืง.
ืืื ืืกืงื ื, ืืื ืืืขื ืืขืื ืขืืืขืืข ืคึฟืจืืื ืฆื ืึธืคึผืฉืึทืฆื ืื ืคืึธืจืฉืืขืืื ื ืคืื WAF (ืขืก ืืื ืจืขืงืึทืืขื ืืื ืฆื ื ืืฆื ืขืก ืืื ืืขืืขืจ ืคืื ืื ืืึธื ืขืก: URL, ARGS, ืืขืึทืืขืจืก ืืื ืืืฃ):
')) un","ion se","lect 1,2,3,4,5,6,7,8,9,0,11#"]
')) union/**/select/**/1,/**/2,/**/3,/**/4,/**/5,/**/6,/**/7,/**/8,/**/9,/**/'some_text',/**/11#"]
union(select(1),2,3,4,5,6,7,8,9,0x70656e746573746974,11)#"]
')) union+/*!select*/ (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"]
')) /*!u%6eion*/ /*!se%6cect*/ (1),(2),(3),(4),(5),(6),(7),(8),(9.),(0x70656e746573746974),(11)#"]
')) %2f**%2funion%2f**%2fselect (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"]
%5B%221807182982%27%29%29%20uni%22%2C%22on
%20sel%22%2C%22ect%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C%2some_text%27%2C11%23%22%5D
cat /et?/pa?swd
cat /et'c/pa'ss'wd
cat /et*/pa**wd
e'c'ho 'swd test pentest' |awk '{print "cat /etc/pas"$1}' |bas'h
cat /etc/passwd
cat$u+/etc$u/passwd$u
<svg/onload=alert()//
ืืืื ืื ืจืืงืืืขืก ืืขื ืขื ื ืืฉื ืืคืืขืฉืืขืื, ืจืืึฟ ืืกืชึผืื ืื WAF ืืืขื ืคืึทืจืคืืจื ืื ืคืึทืงืืืฉ ืืึทืคืึทืื. ืืืืืขืจ ืืืจ ื ืืฆื ืื ืืืืฉืคืืื, ืืึทืื ืืืืขืจ ืึทื ืื WAF ืืื ื ืืฉื ืืืึทืงืื ื ืืึทืืืฉืืืึทืืึทื ืจืืงืืืขืก.
ืืงืืจ: www.habr.com