WAF Bypass Using Headers
Introduction
Web Application Firewalls (WAFs) are commonly used to filter and monitor HTTP traffic to protect web applications from attacks. However, attackers can bypass WAFs by manipulating HTTP headers. One such attack involves Password Reset Poisoning, where an attacker leverages forged headers to manipulate the behavior of the application, particularly in password reset functionalities.
This document outlines techniques to bypass WAFs using custom headers, including examples of how they can be used in password reset poisoning and other similar attacks.
How Does WAF Header Manipulation Work?
Many web applications rely on HTTP headers to determine a user's origin, session, or intended destination. By modifying these headers, an attacker can:
Trick the application into believing the request is coming from a trusted source.
Redirect password reset links to an attacker's domain.
Bypass security measures by manipulating
X-Forwarded-For,Referer, orOriginheaders.Spoof a legitimate user by injecting headers used for authentication.
Some applications also have misconfigured reverse proxies, which trust certain headers to determine the client’s IP address, allowing internal access through header manipulation.
Common Headers Used for WAF Bypass
Below are the most commonly used headers for WAF bypass and server-side manipulation:
Practical Attack Scenario: Password Reset Poisoning
Step 1: Identifying the Vulnerability
Many web applications send password reset links based on the Host or Origin headers.
If these headers are not validated properly, an attacker can poison the password reset URL.
Step 2: Sending a Manipulated Request
Example Request:
Step 3: Intercepting the Response
If the server does not validate the X-Forwarded-Host header, it might send a password reset link to the victim that looks like this:
Now, when the victim clicks on the reset link, they will be redirected to the attacker's site, where their credentials can be stolen via phishing.
Other Uses of WAF Header Manipulation
1. Bypassing IP-Based Restrictions
Some web applications block access based on the user’s IP address.
If the WAF trusts headers like
X-Forwarded-For, an attacker can spoof their IP and gain access.
Example Request:
If
192.168.1.100is a trusted internal IP, access will be granted.
2. Exploiting Open Redirects
Some applications use Referer, Redirect, or X-Forwarded-Host to construct redirect URLs.
Example Request:
The victim is redirected to a phishing page hosted by the attacker.
3. SSRF (Server-Side Request Forgery) Exploitation
Some applications fetch remote resources based on user input. By modifying headers, an attacker can:
Force the application to fetch internal resources.
Target AWS metadata services or other sensitive internal services.
Example Request:
If the application fetches the resource using these headers, it could leak AWS credentials or internal system information.
Author
Last updated