1

In the following blog http://blog.wfilterngf.com/?p=225 , there's an option to prevent upload to web pages. Similar to that, if I were to write a program that blocks uploads to all web pages, what method is used to block file uploads?

Would it be something like blocking all packets that include HTTP PUT or HTTP POST?

(Basically, I'm trying to understand how programs like that achieve that functionality)

2
  • It's hard to answer your question as it is. File upload is performed in many ways (binary, as form, it uses both POST and PUT) and to block it you have to use multiple rules with filters (ie. to block POST.file but not POST.API request to create user). I'd say that WFilter you linked to is the prototype of "Next Generation Firewalls" and you should simply google for how they work. This should make this topic clear.
    – Aramil
    Aug 31, 2023 at 13:13
  • PS: If you want to write program for training, I would advise you to first read on topic and then use Wireshark to listen to communication with few servers and block this explicit occurrences. After that you can check what more will be blocked in every iteration of code and start to create general rules.
    – Aramil
    Aug 31, 2023 at 13:15

1 Answer 1

1

Blocking file uploads reliably nowadays is a difficult, if not an impossible task. In the era of HTTPS it is almost impossible to get your hands on unencrypted traffic you could analyze, which means in almost all cases there is no way you can actually see if the HTTP request is a PUT, GET, POST, etc., nor can you see any of the other headers.

If we were to distance ourselves from encryption and HTTPS, generally speaking there are three main metrics that could help with detecting file uploads:

  1. Request method (PUT/POST) - as you already know, PUT and POST are the main methods used for uploading data, but this data could be anything, could be a request to an API, somebody just trying to login, or anything else of the sort. @Aramil has mentioned POST.file and POST.API, but there is no such thing, there is just POST. Moreover, even if there was POST.API (e.g. you could differentiate between POST used for files and POST used for API), you could upload files through APIs easily just by encoding the file content in base64 format.
  2. Content-Type header - this header specifices the type of the content that is getting uploaded. However, on more insecure websites, it is possible to set this header as anything you want, so it could be unreliable.
  3. Size of the sent data - of course biggers file would show bigger numbers. API requests usually do not require for large amounts of data to be sent. But we shouldn't forget the possibility of uploading small files, or just fragmenting a big file into enough small parts so that you could upload it over multiple small requests, thus making this also somewhat unreliable.

There are certainly more than 3 metrics that could help, but none will make the detection (and blocking) of file uploads a completely reliable endeavor. But the more metrics you find of use, the smaller the error rate will become. You can simply start analyzing HTTP requests yourself when you upload files, use APIs, and etc., so that you can narrow down smaller differences. But no matter what you do, a human that would want to upload a file at all costs will always find a way as long as they have internet access.

WFilter which you have mentioned in your post is old software that (I can only guess) relies on unencrypted HTTP traffic.

1

Not the answer you're looking for? Browse other questions tagged .