Learn to build before you destroy (experiment with PHP WAF)

[Prince]

well all know what is WAF (web application firewall) which is used to help block out certian attack queries,
we spend days and days hacking websites mostly with SQLI and sometimes we get across some nasty filters.

so im asking you, wouldnt be more fun to try to make your OWN WAF and try to chellange yourself (and hopefully learn how to master the art of making better filters or also learn how to evade them?)

so i have with me PHP script that i made at work to experiment with WAF on my local server

so this is what the script looks like
Posted Image

what happen when we add single quote?
Posted Image

now lets try some SQL Injection
Posted Image

this is the part where you have to experiment using preg_match (this is the real shit that act as WAF)
Posted Image

you might wana have :-

- local server (with apache, PHP, any SQL server but MySQL is preferred) - just download XAMP if you're on windows

- something to experiment your SQLI attacks on (which why i made the script)

- some simple database (i got a dummy countries sql file that you can import to your local server and get records from)

Please, Log in or Register to view codes content!

 

[Alcaalata]

great

 

[redacid]

good post!

 

[pat]

top post, thanks!

 

[SadBoy6x3]

good job and keep posting

 

[everblack666]

amazing share

 

[profswiper]

amazing man! Thank you !

 

[selassie]

thank you!

 

[Fyrestone]

+1 rep

 

[dorky1]

tyy bro