Enforcing IP Access control for cloud-security-protected web applications (Cloudfare, Sucuri)

By YGN Ethical Hacker Group -
A lot of cloud-protected services claimed that your web site is safe and secure once you have set up DNS for your web sites pointing to their DNS servers.  This claim is far from truth.

A naive way to bypass is an attacker can find out about your actual IP from various way.   And use the host header and your actual IP to directly attack your web sites without having to worry about the protection.

Assume your IP is blocked by Cloudflare.   You can just do quick test.

Hacker-Mac: yehg$ curl http://your_server_ip --header "host: yehg.net" --header "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36"
Hey, you have bypassed!


How to allow only Cloudflare IP addresses (for Apache)

  1. Get the list of current Cloudflare IP range (https://www.cloudflare.com/ips-v4 , https://www.cloudflare.com/ips-v6)
  2. Set deny, allow rule in your .htacces file https://gist.githubusercontent.com/yehgdotnet/6353e367cb1178017980d2437417d6a5/raw/f25e88d0fc5899752c296510132b036ceacb9788/gistfile1.txt

Hacker-Mac: yehg$ curl http://your_server_ip --header "host: yehg.net" --header "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36"
<html><head><title>Error 403 - Forbidden</title><head><body><h1>Error 403 - Forbidden</h1><p>You don't have permission to access the requested resource. Please contact the web site owner for further assistance.</p></body></html>



Comments

Post a Comment

Popular posts from this blog

XSS: Gaining access to HttpOnly Cookie in 2012

By YGN Ethical Hacker Group -
Image
Update 2016/02: We were asked by a lot if this still works.  Shortly after our disclosure, this issue has been patched. ------ The Background - The Past Gaining access to  HttpOnly cookie  was first attempted by means of XST,  Cross Site Tracing  vulnerability. Soon after the popularity of XST, the TRACE method has been disabled by most web servers.  Later, browsers' implementation of XMLHttpRequest also blocked "TRACE" method (i.e.  xmlhttp.open('TRACE', url, true) ].  Later,  a flawed implementation in Firefox's  XMLHttpRequest which can be used to access set-cookie response header was fixed.   JS Debugger pointing out "TRACE" method as invalid arugment   JS Debugger pointing out "TRACE" method as illegal value A Sla.ckers.org forum member, LeverOne, posted ways to access HttpOnly cookie through the use of Java API and applet.  I reproduced his techniques. When the first method was tried, the Java Runtime did no
Read more

Jumping out of Touch Screen Kiosks

By YGN Ethical Hacker Group -
Image
Background: Nowadays, the use of large touch screen kiosks has been prevalent.  They are to replace tradition paper-based brochures and to provide more interactive means to consumers. In restaurants, you can see a variety of food menu that can be accessible in large touch screen LCD monitor.  In your local Telcos, you can see a variety of mobile and Internet subscriptions plans.   Behind these touch screen menus are running standalone or browser-mode Adobe Flash applications which are second-to-none for interactivity and scalablity and ease of update. Data could be pulled from somewhere round their centralized web severs. Weakness: Jumping out We cannot use  iKat  at first as we do not have access to any keyboard facility. However, the trick is no-brainer. Do long press on any locations and relieve.  You should see the usual Flash context menu like: Touch "Global Settings".  A web browser window will pop up and redirect to the Adobe URL,  http://www.macromedia.c
Read more