Filter Identification

🛡️ Defense Detection: Systematic identification of input filters, blacklisted characters, and WAF protection mechanisms

Overview

Even when developers attempt to secure web applications against injections, implementations may still be exploitable if not properly coded. Common mitigation techniques include:

Blacklisted characters and words on the back-end
Input validation filters at the application level
Web Application Firewalls (WAFs) with broader detection scope
Pattern-based detection systems

This section demonstrates how to identify what is being blocked and develop systematic bypass strategies.

Focus: Methodical filter detection and characterization to develop targeted bypass techniques.

Filter/WAF Detection

Initial Detection Signs

Scenario: Enhanced Host Checker application with security mitigations

Previous Working Payload:

127.0.0.1; whoami

Current Response:

Invalid input

Detection Indicators:

Application-Level Filtering:

Error message appears in normal application output
Standard web application styling maintained
Response includes original form structure
Error displayed where command output would appear

WAF-Level Filtering:

Different error page format
May include IP address and request details
Generic security-focused error message
Response may lack application-specific styling

Response Analysis

Application Filter Response:

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8

<div class="host-checker">
    <form>
        <input type="text" value="127.0.0.1; whoami">
        <button>Check</button>
    </form>
    <div class="output">
        Invalid input
    </div>
</div>

WAF Response (Example):

HTTP/1.1 403 Forbidden
Content-Type: text/html

<html>
<head><title>Access Denied</title></head>
<body>
    <h1>Request Blocked</h1>
    <p>Your request was blocked by security policy.</p>
    <p>Client IP: 192.168.1.100</p>
    <p>Request ID: ABC123</p>
</body>
</html>

Blacklisted Characters

Common Implementation

Typical PHP Blacklist Filter:

$blacklist = ['&', '|', ';', '&&', '||', 'sh', 'bash', 'nc', 'telnet', ...];

foreach ($blacklist as $character) {
    if (strpos($_POST['ip'], $character) !== false) {
        echo "Invalid input";
        exit();
    }
}

Filter Characteristics:

String-based detection - Searches for exact character matches
Case-sensitive or case-insensitive matching
Partial matches - Any occurrence triggers block
Word boundaries - May or may not respect word boundaries

Filter Logic Variations

Simple Character Blacklist:

// Basic character filtering
if (strpos($input, ';') !== false || strpos($input, '&') !== false) {
    die("Invalid input");
}

Regex-Based Filtering:

// Pattern-based filtering
if (preg_match('/[;&|`$()]/i', $input)) {
    die("Invalid input");
}

Word-Based Filtering:

// Command blacklisting
$blocked_commands = ['whoami', 'cat', 'ls', 'nc', 'bash'];
foreach ($blocked_commands as $cmd) {
    if (stripos($input, $cmd) !== false) {
        die("Invalid input");
    }
}

Combined Filtering:

// Multi-layer filtering
function isBlocked($input) {
    $char_blacklist = [';', '&', '|', '`', '$'];
    $cmd_blacklist = ['whoami', 'cat', 'ls', 'sh'];
    
    // Check characters
    foreach ($char_blacklist as $char) {
        if (strpos($input, $char) !== false) return true;
    }
    
    // Check commands
    foreach ($cmd_blacklist as $cmd) {
        if (stripos($input, $cmd) !== false) return true;
    }
    
    return false;
}

Systematic Filter Identification

Step-by-Step Testing Methodology

Step 1: Baseline Verification

# Confirm normal functionality still works
ip=127.0.0.1

# Expected: Normal ping output
# Result: ✅ Working - baseline established

Step 2: Individual Character Testing

Test each injection operator separately:

Semicolon Test:

ip=127.0.0.1%3b