This script will try to find:
This script (ab)uses DNS history records. This script will search for old DNS A records and check if the server replies for that domain. It also outputs a confidence level, based on the similarity in HTML response of the possible origin server and the firewall.
The script also fetches the IP's of subdomains because my own experience learned me that subdomain IP's sometimes point to the origin of the main domain.
Use the script like this:
bash bypass-firewalls-by-DNS-history.sh -d example.com
-d --domain: domain to bypass
-o --outputfile: output file with IP's
-l --listsubdomains: list with subdomains for extra coverage
-a --checkall: Check all subdomains for a WAF bypass
jq is needed to parse output to gather automatically subdomains.
apt install jq.
To illustrate what we define as WAF bypass, look at the scheme below.
A normal visitor connects to a Website. The initial request is a DNS request to ask the IP of the website, so the browser of the client knows where to send the HTTP request to. For sites behind cloudflare or some other public WAF, the reply contains an IP address of the WAF itself. Your HTTP traffic flows basically through the WAF to the origin web server. The WAF blocks malicious requests and protects against (D)DoS attacks. However, if an attacker knows the IP of the origin webserver and the origin webserver accepts HTTP traffic from the entire internet, the attacker can perform a WAF bypass: let the HTTP traffic go directly to the origin webserver instead of passing through the WAF.
This script tries to find that origin IP, so you can connect directly to the origin webserver. Attacks like SQL injections or SSRF's are not filtered and can be successfully, in contrary when there is a WAF in between which stops these kind of attacks.
When you find a bypass, you have two options:
c:\Windows\System32\Drivers\etc\hosts(Windows). Add an entry like this:
From this moment, your HTTP traffic goes directly to the origin webserver. You can perform a penetration test as usual, without your requests being blocked by the WAF.
This script is handy for:
The following services are used:
Why in Bash and not in Python?
It started out as a few CURL one-liners, became a bash script, extended the code more and more, and the regret of not using Python extended accordingly.
I find more subdomains with my tools?
I know. I cannot expect everyone to install all these DNS brute-force and enumeration tools. In addition, I don't know beforehand in which folder these tools are placed or under which alias these tools are called. You can still provide your own list with
-l so you can feed output of these subdomain tools into this tool. Expected input is a full subdomain on each line.
Web Application Firewall bypass
find direct/origin IP website