{"metadata":{"kernelspec":{"language":"python","display_name":"Python 3","name":"python3"},"language_info":{"pygments_lexer":"ipython3","nbconvert_exporter":"python","version":"3.6.4","file_extension":".py","codemirror_mode":{"name":"ipython","version":3},"name":"python","mimetype":"text/x-python"}},"nbformat_minor":4,"nbformat":4,"cells":[{"cell_type":"markdown","source":"# WAF\n\nThis challenge required the participants to find a payload to overcome a WAF (Web application firewall) with malicious code.\n\nI didn't have the required experience to solve this challenge but I leveraged data used to train ML based WAFS from github and by mistake searching what kind of exploits were blocked I found an exploit the could go through the WAF and return a flag.\n\nThis was quite lucky, but this shows that often an exploitable payload for an application is already in the wild only waiting to be found.\n\nIn particular I used these repos from github\n1. [repo1](https://github.com/faizann24/Fwaf-Machine-Learning-driven-Web-Application-Firewall)\n2. [repo2](https://github.com/grananqvist/Machine-Learning-Web-Application-Firewall-and-Dataset) (solution is in this one)\n\nI moved from the first one to the second one because the exploits were categorized making it easier to check what kind of exploits were getting blocked and which were the ones on whih I had to concentrate my attention. ","metadata":{}},{"cell_type":"code","source":"\nimport pandas as pd\nimport numpy as np\nimport os\nimport requests\nfrom IPython.display import Image as Ima\n\nfrom IPython.display import clear_output, display\nfrom PIL import Image as Im\nfrom torch.utils.data import Dataset, DataLoader\nimport torch\nimport joblib\nimport matplotlib.pyplot as plt\nimport json\nimport base64\nimport shutil\nimport warnings\nwarnings.filterwarnings(\"ignore\")\n\n\ndir_name = \"/kaggle/input/ai-village-ctf\"\n\n","metadata":{"_uuid":"8f2839f25d086af736a60e9eeb907d3b93b6e0e5","_cell_guid":"b1076dfc-b9ad-4769-8c92-a6c4dae69d19","execution":{"iopub.status.busy":"2022-09-11T21:34:03.769139Z","iopub.execute_input":"2022-09-11T21:34:03.770484Z","iopub.status.idle":"2022-09-11T21:34:03.777481Z","shell.execute_reply.started":"2022-09-11T21:34:03.770430Z","shell.execute_reply":"2022-09-11T21:34:03.776493Z"},"jupyter":{"source_hidden":true},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"def add_flag(challenge_id: str, flag: str) -> str:\n    try:\n        submission_path = \"/kaggle/working/submission.csv\"\n        template_path = f\"{dir_name}/submission.csv\"\n        if not os.path.isfile(submission_path) :\n            shutil.copyfile(template_path, submission_path)\n        flags = pd.read_csv(submission_path, index_col=\"challenge_id\")\n        valid = flags.index.to_list()\n        if challenge_id in valid:\n            flags.at[challenge_id] = flag\n            flags.to_csv(submission_path)\n            print(\"Flag saved. If you want to update the scoreboard, click 'submit' on the right. Remember that you can only update your score on the scoreboard 50 times per day\")\n        else:\n            print(\"Invalid challenge_id\")\n    except:\n        print(\"We had trouble saving that flag. Keep a copy of it and contact the CTF organizers.\")","metadata":{"_kg_hide-input":true,"execution":{"iopub.status.busy":"2022-09-11T21:34:03.794833Z","iopub.execute_input":"2022-09-11T21:34:03.795319Z","iopub.status.idle":"2022-09-11T21:34:03.802961Z","shell.execute_reply.started":"2022-09-11T21:34:03.795285Z","shell.execute_reply":"2022-09-11T21:34:03.801613Z"},"jupyter":{"source_hidden":true},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"markdown","source":"# WAF (id: waf) -- 500 Points\n\n### Scenario\n\nA ML model has been built to detect a 0-day. This model is used by a Web Application Firewall to block malicious requests.\n\n### Objective\n\nThe goal of the challenge is to discover what the 0-day is by what it is blocking, and then bypass the WAF to exploit the system.\n\nPS: The WAF assesses malicious strings in 5 characters blocks.","metadata":{"execution":{"iopub.status.busy":"2022-07-25T14:57:01.386134Z","iopub.execute_input":"2022-07-25T14:57:01.38663Z","iopub.status.idle":"2022-07-25T14:57:01.39651Z","shell.execute_reply.started":"2022-07-25T14:57:01.386588Z","shell.execute_reply":"2022-07-25T14:57:01.394443Z"}}},{"cell_type":"code","source":"%%capture\n!wget https://raw.githubusercontent.com/faizann24/Fwaf-Machine-Learning-driven-Web-Application-Firewall/master/badqueries.txt","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:34:03.805766Z","iopub.execute_input":"2022-09-11T21:34:03.806701Z","iopub.status.idle":"2022-09-11T21:34:05.411436Z","shell.execute_reply.started":"2022-09-11T21:34:03.806650Z","shell.execute_reply":"2022-09-11T21:34:05.409650Z"},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"with open(\"badqueries.txt\") as f:\n    s=f.readline()","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:34:05.413470Z","iopub.execute_input":"2022-09-11T21:34:05.413825Z","iopub.status.idle":"2022-09-11T21:34:05.420027Z","shell.execute_reply.started":"2022-09-11T21:34:05.413795Z","shell.execute_reply":"2022-09-11T21:34:05.418811Z"},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"\nwith open(\"caughtqueries.txt\",\"w+\") as c, open(\"notcaughtqueries.txt\",\"w+\") as negatives:\n    with open(\"badqueries.txt\") as f:\n        \n        for s in f:\n            try:\n                input_string = base64.b64encode(bytes(s,\"utf-8\")).decode()\n\n                \n                if \"mFzaC\" in input_string:\n                    data = json.dumps(\n                        {\"input\": input_string}\n                    )\n                    try:\n                        r = requests.post(\"https://waf.fly.dev/score\", data=data)\n                        if \"SAFE\" not in r.text:\n                            c.write(s+\"\\n\")\n                            print(s,input_string,\"\\n\",r.text)\n                        else:\n                            negatives.write(s+\"\\n\")\n                            \n                        if \"message\" in r.text:\n                            break\n                    except requests.exceptions.ConnectionError:\n                        print(\"Connection problems. Contact the CTF organizers.\")\n            except:\n                print(s,\"--- failed\")","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:34:05.421457Z","iopub.execute_input":"2022-09-11T21:34:05.422305Z","iopub.status.idle":"2022-09-11T21:34:06.039123Z","shell.execute_reply.started":"2022-09-11T21:34:05.422271Z","shell.execute_reply":"2022-09-11T21:34:06.037887Z"},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"%%capture\n!wget https://raw.githubusercontent.com/grananqvist/Machine-Learning-Web-Application-Firewall-and-Dataset/master/data/ShellCollection.txt -O shell.txt\n!wget https://raw.githubusercontent.com/grananqvist/Machine-Learning-Web-Application-Firewall-and-Dataset/master/data/XSSCollection.txt -O xss.txt\n!wget https://raw.githubusercontent.com/grananqvist/Machine-Learning-Web-Application-Firewall-and-Dataset/master/data/SQLKeywords.txt -O key.txt\n!wget https://raw.githubusercontent.com/grananqvist/Machine-Learning-Web-Application-Firewall-and-Dataset/master/data/SQLCollection.txt -O sql.txt","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:34:06.042436Z","iopub.execute_input":"2022-09-11T21:34:06.042910Z","iopub.status.idle":"2022-09-11T21:34:11.961675Z","shell.execute_reply.started":"2022-09-11T21:34:06.042862Z","shell.execute_reply":"2022-09-11T21:34:11.960083Z"},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"\nimport time\n\nfor category in [\"shell\",\"xss\",\"key\",\"sql\"]:\n    with open(f\"caughtqueries_{category}.txt\",\"w+\") as c, open(f\"notcaughtqueries_{category}.txt\",\"w+\") as negatives:\n        with open(f\"{category}.txt\") as f:\n\n            for s in f:\n                try:\n                    input_string = base64.b64encode(bytes(s,\"utf-8\")).decode()\n                    if \"mFzaC\" in input_string:\n                        data = json.dumps(\n                            {\"input\": input_string}\n                        )\n\n                        try:\n                            time.sleep(0.5)\n                            r = requests.post(\"https://waf.fly.dev/score\", data=data)\n                            if \"SAFE\" not in r.text:\n                                c.write(s)\n                                print(category,\"\\n\",input_string,\"\\n\",s,r.text,\"\\n\")\n                            else:\n                                negatives.write(s)\n                            if \"message\" in r.text:\n                                solution=r.text\n                                break\n                        except requests.exceptions.ConnectionError:\n                            print(\"Connection problems. Contact the CTF organizers.\")\n                except:\n                    print(s,input_string,\"--- failed\",r.text)","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:36:16.443922Z","iopub.execute_input":"2022-09-11T21:36:16.444333Z","iopub.status.idle":"2022-09-11T21:36:17.541361Z","shell.execute_reply.started":"2022-09-11T21:36:16.444302Z","shell.execute_reply":"2022-09-11T21:36:17.540498Z"},"trusted":true},"execution_count":null,"outputs":[]},{"cell_type":"code","source":"add_flag(\"waf\", solution.split(\"message\\\": \\\"\")[1][:-2])\nsolution.split(\"message\\\": \\\"\")[1][:-2]","metadata":{"execution":{"iopub.status.busy":"2022-09-11T21:36:25.464651Z","iopub.execute_input":"2022-09-11T21:36:25.465207Z","iopub.status.idle":"2022-09-11T21:36:25.479476Z","shell.execute_reply.started":"2022-09-11T21:36:25.465163Z","shell.execute_reply":"2022-09-11T21:36:25.478226Z"},"trusted":true},"execution_count":null,"outputs":[]}]}