The waf book intro

1. Practical Defensive Security
for Security Engineers
Ref: 052921DSMM-TWB-HB-V1.P, SOT:S,B.
▪ Email: lior.rotkovitch@gmail.com
▪ Twitter: @rotkovitch
▪ LinkedIn: Lior Rotkovitch
▪ Instagram: l.rotkovitch
Web App Firewall
https://SIRT.club
By: Lior Rotkovitch
70295
©

2. 70295
https://SIRT.club
©

3. Vulnerabilities - Software bugs
Bugs = glitch – “unexpected condition in software” LR
-> Security bug – bug that can be used to assist with attack goals.
-> Vulnerability – software bugs with security ramifications
NF
Application
Servers
Web
Servers
WEB
ISP
bugs
bugs
CLOUD’S
Web Application
Database
Servers
https://SIRT.club
70295
©

4. Vulnerabilities – security design bugs
NF
Application
Servers
Web
Servers
WEB
ISP
CLOUD’S
Web Application
Database
Servers
▪ Design bugs– insecure implementations
▪ Misconfiguration bugs– wrong, defaults
https://SIRT.club
70295
©

5. Aggregated 21.21k 23.57 36.72k
172.29.46.6 2.75k 3.05 4.08k
10.0.0.138 2.26k 2.51 5.27k
192.168.1.1 2.25k 2.50 3.10k
172.29.44.44 2.23k 2.48 4.64k
192.168.1.254 2.01k 2.23 2.82k
0
20
40
60
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
IP’S
IP1 IP2 IP3 IP4 IP5
ISP
Partners
Unknow User
Web Bot
automated traffic
ISP
ISP
Coffee shop
Mobile
users
WEB
Attacks :
▪ Floods
▪ Brute force
▪ Scraping
▪ ...
Load % Statistics
CPU 70% 0/1/2
Memory 72% 80GB
Throughput 35% 11.7Mbps
RPS 25% 10k
70295
Expected traffic footprint
https://SIRT.club
app can’t detect nor enforce
©

6. Attacking the Web App
Attack: Offending traffic that violates the expected usage
Application
Server/s
Web
Server/s
Database
Server/s
0
50
1 2 3 4 5 6 7 8 9 101112131415161718192021
IP’S
IP1 IP2 IP3 IP4 IP5
Load % Statistics
CPU 70% 0/1/2
Memory 72% 80GB
Throughput 35% 11.7Mbps
RPS 25% 10k
Hacking goals:
▪ Service
▪ App Data
▪ Computing power
Web Application
https://SIRT.club
70295
©

7. Attack status brief
Type:
• Fun
• Random
• Targeted
Motivation
• Fun and Profit
• Fame
• Just because they can
Execution:
• Vulnerability hunting
• DDoS
• Brute force
• Malware
• BotNet
• Automation
• More…
CLIENTS
THE
WEB
https://SIRT.club
70295
©

8. Hackers wants your assets ! your infra your data your users
https://SIRT.club
70295
©

9. Attack Elements
HTTP
Web Application
Attacks occur when a vulnerable software meets the exploit
that was sent by the attack agent in the attack surface
Database
App
Servers
Web
Servers
https://SIRT.club
70295
©

10. Web Application
HTTP
Application/s
Request
handler/s Database/s
Vulnerability
Vulnerability – is a software condition
(bug) with security implication that
create a risk to the application assets
Vulnerability examples:
• Code
• Configuration
• Design
• No ATF enforcement
Vulnerability: root cause security bug
Main reasons:
• Validation
• Functionality
• Limitations
https://SIRT.club
70295
©

11. HTTP
Application/s
Request
handler/s Database/s
Attack Surface
Attack surface examples:
1. Code – Function, library, URL, Parameter
2. Infrastructure – OS, servers, virtualization, keys,
3. System – hardware, network, devices
Vulnerability location
Attack surface – the place where the
vulnerability exists. Also refer to the entry
point for the exploit or the meeting place
between the exploit and the vulnerability.
Web Application
https://SIRT.club
70295
©

12. HTTP
Request
handler/s Database/s
Attack Agent
Operate from:
• Clouds
• Mobiles
• PC/ tablet
• IoT
Request generator tool
Attack agent – the software vehicle
that is used to sends the exploit to
the attack surface
Software Types:
• CLI
• Browser automation
• Client framework
Web Application
Application/s
https://SIRT.club
70295
©

13. HTTP
Request
handler/s Database/s
Exploit
Actual code that activate the vulnerability
Exploit – the code / pattern that
activate the vulnerability and allow
exploitation of the vulnerability.
Exploit types:
• POC exploit
• Exploitation exploit
• Weaponizing exploit – RCE
Web Application
Application/s
https://SIRT.club
70295
©

14. HTTP
Request
handler/s Database/s
Attack Vector
Attack technique and / or goal
Web Application
We use the same attack
elements for all the attacks. The
vector is the technique used to
achieve the goal
Goals:
• Deny service / impact performance – DoS
• Extract data from DB – SQLi
• Session stealing – XSS
• Account take over – brute force
Technique:
• DoS (floods, load)
• SQLi
• XSS
• Brute force
• Etc…
Application/s
https://SIRT.club
70295
©

15. Attack Elements
Attack Agent
Exploit
Attack Vector
Vulnerability
Attack Surface
A Bug is a software condition in software that wasn’t intended to happen and
affect the functionality of the software. Vul is a bug with security implication that
create a risk to the application assets i.e. Security bug
Attack surface – the location where the vulnerability exists. Also refer to the entry
point for the exploit or the meeting place between the exploit and the vulnerability.
Attack agent – the software vehicle used to send the exploit
to the attack surface the contains the vulnerability.
Exploit – the code / pattern that active the vulnerability and
allow exploitation of the vulnerability.
We use the same attack elements for all the attacks. The
vector is the technique used to achieve the goal
https://SIRT.club
70295
©

16. Threat Landscape - Traditional
Users / HTTP clients
App SRV
Web SRV
Server/s
Database SRV
App owner
Hacker playground ..;-()
Web Application
https://SIRT.club
70295
©

17. Threat Landscape - Modern
DEVOPS
partners
NF
Mobile Users
Ads/ 3rd party
services
Remote
employee
Web Bot
User
Requests
Responses
ABSTRACTION LAYER
Allowed
automated traffic
Application/s
Request
handler/s
Authorization
SIEM ≈
Analytics ∑
Mobile app/ API
Database/s
DEV
OPSSEC
INSIDER
HACKED
PURPOSE
BUILD BOTNET
Cloud
${{:-}j
Internet
Cloud
https://SIRT.club
70295
©

18. Web Application
HTTP
Attack Automation
Attack agent automation = Bot / Botnet
Exploit automation = scanner
Bot = AE automation
Attack surface automation = scanner
Vulnerability automation = Vulnerability hunting
AUTO
https://SIRT.club
70295
©

19. Attack agent automation
CLI browser
Full Browser automation
Full Human Browser simulators
https://SIRT.club
Automaton type– simulating browser capabilities
70295
©

20. Exploit Automation
https://SIRT.club
Automaton type– Multiple exploit (Shifting exploits)
Multiple exploit - Shifting exploits
▪ Shifting payloads
▪ Single app
▪ Same site
E1
E2
E3
E4
E5
E6
E5 -> AS -> Vul
70295
©

21. vul / attack surface Automation
https://SIRT.club
▪ Different Vul
▪ Rotation AS:VUL pairs
▪ Many apps
▪ Many sites
Automation – attack agent – shifting AS/Vul
Vul1 AS1
Vul2 AS2
Vul3 AS3
Vul4 AS4
Vul1 AS1
Vul2 AS2
Vul3 AS3
Vul4 AS4
70295
©

22. https://SIRT.club
Site A
Site D
Site C
Site B
Site E
FQDN Target (site) Automation
Automation – FQDN rotation
▪ Many apps
▪ Many sites
70295
©

23. All automations
Site C
Site B
Site A
Site X…
Automation { AS / E / AS / Vul }
https://SIRT.club
70295
©

24. X100
E
HTTP
Bot Node
Botnet enlisting type:
▪ Purpose build
▪ Hacked
▪ Infected
IP
Botnet: C&C @ nodes
Geo/ ISP/ Clouds
AS
V
Bot Master
nodes
From Bot to Botnet
https://SIRT.club
70295
©

25. Attack automation - Botnet – disturbed
Exploit
pool
Bot MASTER
Purpose build
Hacked
Infected
App A
App B
App C
App D
App A
App B
App C
App D
App D
App B
App C
App A
App D
App C
App B
App A
Site 3
Site 2
Site 1
https://SIRT.club
70295
©

26. • C&C – 1 to many • Shifting Centralized nodes • Autonomous -
https://SIRT.club
70295
©

27. • SQLi
• XSS
• LFI/ RFI
• RCE
• CSRF
Web Exploits
• BF
• CS
• PS
ATO
• Floods
• Loads
DDoS
BOT/S
BOTNET/S
Web Application
Attack Surface /s
Vulnerabilities
Exploit
Attack Agent
ATTACK AUTOMATION
AUTO
https://SIRT.club
Summary
70295
©

28. Attack Traffic Footprint
0
500
1000
1500
2000
2500
3000
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
URL /
Top URL RPS Avr
/ 21.21k
/search.php 2.75k
/login.php 2.26k
/sell.php 2.25k
/user_login.php 2.23k
/noneexisting 2.01k
https://SIRT.club
Attack Elements
▪ Vulnerability
▪ Attack Surface
▪ Attack Agent
▪ Exploit
▪ Attack Vector
▪ Attack automation
GET /search.php?q=../../../../../../etc/passwd HTTP/1.1
Host: sirt.club
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/95.0.4638.54
70295
©

29. https://SIRT.club
By: Lior Rotkovitch
“Man’s biggest obstacle is he himself” LR
70295
▪ Email: lior.rotkovitch@gmail.com
▪ Twitter: @rotkovitch
▪ LinkedIn: Lior Rotkovitch
▪ Instagram: l.rotkovitch
70295
Practical Defensive Security
for Security Engineers
©