vincentcox / bypass-firewalls-by-dns-history

Firewall bypass script based on DNS history records. This script will search for DNS A history records and check if the server replies for that domain. Handy for bugbounty hunters.

Bypass firewalls by abusing DNS history

This script will try to find:

• the direct IP address of a server behind a firewall like Cloudflare, Incapsula, SUCURI ...
• an old server which still running the same (inactive and unmaintained) website, not receiving active traffic because the A DNS record is not pointing towards it. Because it's an outdated and unmaintained website version of the current active one, it is likely vulnerable for various exploits. It might be easier to find SQL injections and access the database of the old website and abuse this information to use on the current and active website.

This script (ab)uses DNS history records. This script will search for old DNS A records and check if the server replies for that domain. It also outputs a confidence level, based on the similarity in HTML response of the possible origin server and the firewall.

The script also fetches the IP's of subdomains because my own experience learned me that subdomain IP's sometimes point to the origin of the main domain.

Usage

Use the script like this:

bash bypass-firewalls-by-DNS-history.sh -d example.com

• -d --domain: domain to bypass
• -o --outputfile: output file with IP's
• -l --listsubdomains: list with subdomains for extra coverage
• -a --checkall: Check all subdomains for a WAF bypass

Requirements (optional)

jq is needed to parse output to gather automatically subdomains. Install with apt install jq.

Background information

WAF Bypass explanation

To illustrate what we define as WAF bypass, look at the scheme below.

A normal visitor connects to a Website. The initial request is a DNS request to ask the IP of the website, so the browser of the client knows where to send the HTTP request to. For sites behind cloudflare or some other public WAF, the reply contains an IP address of the WAF itself. Your HTTP traffic flows basically through the WAF to the origin web server. The WAF blocks malicious requests and protects against (D)DoS attacks. However, if an attacker knows the IP of the origin webserver and the origin webserver accepts HTTP traffic from the entire internet, the attacker can perform a WAF bypass: let the HTTP traffic go directly to the origin webserver instead of passing through the WAF.

This script tries to find that origin IP, so you can connect directly to the origin webserver. Attacks like SQL injections or SSRF's are not filtered and can be successfully, in contrary when there is a WAF in between which stops these kind of attacks.

Further exploitation

When you find a bypass, you have two options:

• Edit your host-file, which is a system-wide solution. You can find your host-file at /etc/hosts(Linux/Mac) or c:\Windows\System32\Drivers\etc\hosts (Windows). Add an entry like this: 80.40.10.22 vincentcox.com.
• Burp Suite:

From this moment, your HTTP traffic goes directly to the origin webserver. You can perform a penetration test as usual, without your requests being blocked by the WAF.

How to protect against this script?

• If you use a firewall, make sure to accept only traffic coming through the firewall. Deny all traffic coming directly from the internet. For example: Cloudflare has a list of IP's which you can whitelist with iptables or UFW. Deny all other traffic.
• Make sure that no old servers are still accepting connections and not accessible in the first place

For who is this script?

This script is handy for:

• Security auditors
• Web administrators
• Bug bounty hunters
• Blackhatters I guess ¯\_(ツ)_/¯

Web services used in this script

The following services are used:

• SecurityTrails
• CrimeFlare
• certspotter
• DNSDumpster
• IPinfo
• ViewDNS

FAQ

Why in Bash and not in Python?

It started out as a few CURL one-liners, became a bash script, extended the code more and more, and the regret of not using Python extended accordingly.

I find more subdomains with my tools?

I know. I cannot expect everyone to install all these DNS brute-force and enumeration tools. In addition, I don't know beforehand in which folder these tools are placed or under which alias these tools are called. You can still provide your own list with -l so you can feed output of these subdomain tools into this tool. Expected input is a full subdomain on each line.

Author

Project Creator

Tags

WAF bypass
Web Application Firewall bypass
DNS History
find direct/origin IP website

bypass-firewalls-by-dns-history's Issues

syntax error - Running in Ubuntu HyperV

I'm trying this:
$bash bypass-firewalls-by-DNS-history.sh -d google.com

and had this response:
bypass-firewalls-by-DNS-history.sh: line 8: syntax error near unexpected token newline' bypass-firewalls-by-DNS-history.sh: line 8: '

Sintax Error

The command that i use it was:

C:\Users\deskc\bypass-firewalls-by-DNS-history>bash bypass-firewalls-by-DNS-history.sh -d sitewebtarget.com

The error i recive:
bypass-firewalls-by-DNS-history.sh: line 14: syntax error in conditional expression
'ypass-firewalls-by-DNS-history.sh: line 14: syntax error near ]] 'ypass-firewalls-by-DNS-history.sh: line 14: while [[ $# -gt 0

]]

IP's not showing in terminal, no output file as well

I'm not sure if this is a bug or my own mistake. I tried this on Parrot OS with jq installed.
Tried both commands on three different domains, to find out if there is an equal address from those three domains. Unfortunately results are not as expected:

No bypass found;
Neither creates output file (this should?)

My input as follows...
$ bash waf.sh -d DOMAIN.BLA -o output
$ bash waf.sh -d DOMAIN.BLA -o /media/user/data/Scripts/wafbypass/output.txt

Output from terminal...
[-] 3 Domains collected...
[-] Scraping IP's from (sub)domains (100%)
[-] 24 IP's gathered from DNS history...
[-] Launching requests to origin servers...
[-] Waiting on replies from origin servers...
[-] No Bypass found!

$ locate output
returns nothing...
$ locate output.txt
returns nothing...

$ cd /media/user/data/Scripts/wafbypass/
$ ls
LICENSE README.md waf.sh

Consider one more source for DNS history

Try out spyse.com for a historical DNS. Pretty similar to Securitytrails, but sometimes updates faster. Nevertheless sometimes is not, so better to use both I guess.

jq: error

jq: error (at :0): Cannot index string with string "dns_names"
jq: error (at :5): Cannot iterate over null (null)
parse error: Invalid numeric literal at line 3, column 0

debian 9 and debian 10

sudo apt install jq
$ git clone https://github.com/vincentcox/bypass-firewalls-by-DNS-history

bash ./bypass-firewalls-by-DNS-history.sh -a -d dadadadada.de

nothing comes up

This is all im getting there's no ip or anything
and this is exactly what i pasted
"bash bypass-firewalls-by-DNS-history.sh -d example.com"
any help or something im doing wrong? thanks!

Access 403

Hello @vincentcox ,
Its not an issue but I am curious that by abusing the DNS history can we able to access the ip / domain which is throwing 403 ?

Thank You.

Cert Spotter APIv0 has been discontinued

{"code":"api_discontinued","message":"Cert Spotter APIv0 has been discontinued in favor of APIv1. Please see https://sslmate.com/certspotter/api/docs-v1 for documentation."}

Bash Syntax error

bypass-firewalls-by-DNS-history.sh: 13: bypass-firewalls-by-DNS-history.sh: Syntax error: "(" unexpected

Jq is installed on the sytem

ls

Virustotla requires Recaptcha

curl -H 'user-agent: Mozilla' -s https://www.virustotal.com/ui/domains/bugcrowd.com/subdomains\?limit\=

{
    "error": {
        "message": "Please re-send request with a valid reCAPTCHA response in the \"x-recaptcha-response\" header",
        "code": "RecaptchaRequiredError"
    }

Use python instead

Python is installed by default on most machine, but you use jq(1) that is requires to be install. In the light of that, why do not use python -m json.tool instead?

Please change SecurityTrails to use the API instead of scraping

Hey there,

great tool! SecurityTrails has a great API available for querying the information you are currently scraping from the free app. The free app regularly changes and the method you are using will not work in the future.

Our API is free of charge for your use-case and fairly easy to query, please check out
https://docs.securitytrails.com/reference#history-dns

In case you have questions, I will be around to help you switching over ;)

virustotal require captcha

#domain=example.com

#curl -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36' -s https://www.virustotal.com/ui/domains/$domain/subdomains\?limit\= | jq '.data[].id' | grep -o '"[^"]\+"' | grep "$domain" | sed 's/"//g' >> /tmp/waf-bypass-alldomains-$domain.txt

jq: error (at <stdin>:5): Cannot iterate over null (null)



#curl -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36' -s https://www.virustotal.com/ui/domains/$domain/subdomains\?limit\=

{
    "error": {
        "code": "RecaptchaRequiredError",
        "message": "Please re-send request with a valid reCAPTCHA response in the \"x-recaptcha-response\" header"
    }
}