Instructor: Web application firewall logs. 2 2
In this lesson, we're going to talk about the logs 3 3
inside of a web application firewall. 4 4
Now, before we do that, we need to talk 5 5
about what a web application firewall is. 6 6
Well, a web application firewall or a WAF 7 7
is a firewall that's designed specifically 8 8
to protect software running on web servers 9 9
and their backend databases from different types 10 10
of code injection and DoS attacks. 11 11
Now, when we deal with a web application firewall, 12 12
these are going to be used to prevent web-based exploits 13 13
and vulnerabilities, things like SQL injections, 14 14
XML injections, and cross-site scripting attacks. 15 15
These firewalls are different 16 16
than your standard stateful packet-filtering firewalls 17 17
because those can only apply rules 18 18
at the IP and TCP UDP layers based 19 19
on the different ports or protocols in use. 20 20
But a web application firewall can actually parse 21 21
the response and request headers 22 22
and be able to see what's inside these HTML messages. 23 23
And then they can apply detection 24 24
and filtering rules based on those contents. 25 25
Here on the screen is an example 26 26
of a web application firewall. 27 27
Now you can see the application here 28 28
and the number of events that's been triggered, 29 29
which is over 12,000 different events. 30 30
As you look at one of these events 31 31
you can start getting information about it, 32 32
such as the client and the port being used. 33 33
The mod security that was what was flagged 34 34
with this particular rule because it saw 35 35
that there was a Nikto scan that was being run against it. 36 36
Nikto is a web application vulnerability scanner 37 37
and so a lot of times pen testers or hackers 38 38
will use this to try to see 39 39
if there's security in place on your servers. 40 40
As you go through these, 41 41
there is a lot of detailed information. 42 42
Now, these web application firewalls can record their logs 43 43
in a variety of formats, but one of the most common 44 44
is the JSON or JavaScript Object Notation format 45 45
in which they're going to store their logs. 46 46
Inside these logs there's going to be 47 47
a lot of different information. 48 48
This includes things like the time of the event, 49 49
the severity of the event, 50 50
the URL parameters that were passed, 51 51
such as the local resource path or any query strings, 52 52
the HTTP method being used, 53 53
whether it was a post request or a get request 54 54
or what other kind of method was being used here, 55 55
and then the context for the rule. 56 56
Now this context for the rule might have something 57 57
like a reference to the database of known vulnerabilities, 58 58
exploit technique, or some knowledge-based article. 59 59
As you saw in my earlier example, this is one that was based 60 60
off a Nikto scan, and so that was part 61 61
of the reference there inside of that rule set. 62 62
Now for the exam what do you need to know 63 63
about web application firewalls? 64 64
Well, you should know that if you're trying to protect 65 65
your web server, you should have a web application firewall, 66 66
specifically if you're trying to protect it 67 67
against things like SQL injections, XML injections, 68 68
or cross-site scripting attacks. 69 69
Any kind of attack that's operating 70 70
at Layer 7 of the OSI model, an application layer, 71 71
that's targeting one of your web servers 72 72
could be something that's going to be a good candidate 73 73
to remediate using a web application firewall.