Welcome to the second installment of our Azure Web Application Firewall (WAF) Security Lab series. In this tutorial, we’ll focus on reconnaissance techniques and demonstrate how Azure WAF protects against common web application vulnerability scanners.
Before launching an attack, adversaries typically spend time researching their target. They use various tools to collect data and analyze potential vulnerabilities. Understanding how Azure WAF handles these reconnaissance attempts is crucial for building a robust security posture.
By the end of this tutorial, you will:
We’ll simulate a reconnaissance attack using Nikto, an open-source web application vulnerability scanner. This tool is commonly used by both security professionals and attackers to identify potential vulnerabilities in web applications.
Tip: If Nikto isn’t installed, run
sudo apt install -y nikto
in the terminal.
Execute the following commands in separate Nikto windows:
nikto -h http://owaspdirect-<deployment guid>.azurewebsites.net
nikto -h http://juiceshopthruazwaf.com
Tip: For verbose output, add
-Display v
to the command. To save results, use-Save ./filename.htm
.
The direct scan revealed:
This wealth of information could be used by an attacker to develop further exploitation scenarios.
The scan through Azure WAF showed:
This dramatic difference demonstrates Azure WAF’s effectiveness in obscuring application details and blocking potentially malicious requests.
To dive deeper into how Azure WAF handled the scanner traffic, we’ll use the Azure Monitor Workbook for WAF.
AzureDiagnostics | where ResourceType == "APPLICATIONGATEWAYS" | where Category == "ApplicationGatewayFirewallLog" | where action_s == "Blocked"
Some of the top rules that caught the scanner’s activity include:
This shows that Azure WAF successfully identified various types of probing attempts typical of security scanners.
By implementing Azure WAF, you can dramatically reduce the information exposed to potential attackers during the reconnaissance phase, making it much harder for them to plan and execute successful attacks.
Now that we’ve seen how Azure WAF handles reconnaissance attempts, we’re ready to dive deeper into specific attack scenarios. In our next tutorial, we’ll explore the “Vulnerability Exploitation Playbook” and test Azure WAF’s capabilities against more targeted attack techniques.
Stay tuned, and keep your lab environment ready for more exciting security testing!
In this session, we will explore the architecture and best practices for building secure and…
Introduction Welcome to our comprehensive series on Azure Web Application Firewall (WAF) security! In this…
Introduction Welcome to the third installment of our Azure Web Application Firewall (WAF) Security Lab…
Introduction Welcome to the first installment of our four-part Azure Web Application Firewall (WAF) Security…
Introduction In today's digital landscape, protecting web applications from sophisticated attacks is crucial. Azure Web…
Description: Join us for an insightful session on securing your web applications with Azure Web…