1 1 00:00:00,510 --> 00:00:03,270 Web application firewall logs. 2 2 00:00:03,270 --> 00:00:05,490 In this lesson, we're going to talk about the logs 3 3 00:00:05,490 --> 00:00:07,920 inside of a web application firewall. 4 4 00:00:07,920 --> 00:00:09,630 Now, before we do that, we need to talk 5 5 00:00:09,630 --> 00:00:12,150 about what a web application firewall is. 6 6 00:00:12,150 --> 00:00:15,180 Well, a web application firewall or a WAF 7 7 00:00:15,180 --> 00:00:17,130 is a firewall that's designed specifically 8 8 00:00:17,130 --> 00:00:19,530 to protect software running on web servers 9 9 00:00:19,530 --> 00:00:21,840 and their backend databases from different types 10 10 00:00:21,840 --> 00:00:24,360 of code injection and DoS attacks. 11 11 00:00:24,360 --> 00:00:26,580 Now, when we deal with a web application firewall, 12 12 00:00:26,580 --> 00:00:28,770 these are going to be used to prevent web-based exploits 13 13 00:00:28,770 --> 00:00:31,560 and vulnerabilities, things like SQL injections, 14 14 00:00:31,560 --> 00:00:35,010 XML injections, and cross-site scripting attacks. 15 15 00:00:35,010 --> 00:00:36,330 These firewalls are different 16 16 00:00:36,330 --> 00:00:38,940 than your standard stateful packet-filtering firewalls 17 17 00:00:38,940 --> 00:00:41,220 because those can only apply rules 18 18 00:00:41,220 --> 00:00:44,280 at the IP and TCP UDP layers based 19 19 00:00:44,280 --> 00:00:46,410 on the different ports or protocols in use. 20 20 00:00:46,410 --> 00:00:49,620 But a web application firewall can actually parse 21 21 00:00:49,620 --> 00:00:51,270 the response and request headers 22 22 00:00:51,270 --> 00:00:54,300 and be able to see what's inside these HTML messages. 23 23 00:00:54,300 --> 00:00:55,860 And then they can apply detection 24 24 00:00:55,860 --> 00:00:58,470 and filtering rules based on those contents. 25 25 00:00:58,470 --> 00:00:59,970 Here on the screen is an example 26 26 00:00:59,970 --> 00:01:02,100 of a web application firewall. 27 27 00:01:02,100 --> 00:01:03,660 Now you can see the application here 28 28 00:01:03,660 --> 00:01:05,190 and the number of events that's been triggered, 29 29 00:01:05,190 --> 00:01:07,950 which is over 12,000 different events. 30 30 00:01:07,950 --> 00:01:09,270 As you look at one of these events 31 31 00:01:09,270 --> 00:01:10,830 you can start getting information about it, 32 32 00:01:10,830 --> 00:01:13,080 such as the client and the port being used. 33 33 00:01:13,080 --> 00:01:14,910 The mod security that was what was flagged 34 34 00:01:14,910 --> 00:01:16,710 with this particular rule because it saw 35 35 00:01:16,710 --> 00:01:19,380 that there was a Nikto scan that was being run against it. 36 36 00:01:19,380 --> 00:01:21,930 Nikto is a web application vulnerability scanner 37 37 00:01:21,930 --> 00:01:24,210 and so a lot of times pen testers or hackers 38 38 00:01:24,210 --> 00:01:25,590 will use this to try to see 39 39 00:01:25,590 --> 00:01:27,870 if there's security in place on your servers. 40 40 00:01:27,870 --> 00:01:28,830 As you go through these, 41 41 00:01:28,830 --> 00:01:31,290 there is a lot of detailed information. 42 42 00:01:31,290 --> 00:01:34,470 Now, these web application firewalls can record their logs 43 43 00:01:34,470 --> 00:01:36,930 in a variety of formats, but one of the most common 44 44 00:01:36,930 --> 00:01:40,200 is the JSON or JavaScript Object Notation format 45 45 00:01:40,200 --> 00:01:42,210 in which they're going to store their logs. 46 46 00:01:42,210 --> 00:01:43,770 Inside these logs there's going to be 47 47 00:01:43,770 --> 00:01:45,270 a lot of different information. 48 48 00:01:45,270 --> 00:01:47,460 This includes things like the time of the event, 49 49 00:01:47,460 --> 00:01:49,020 the severity of the event, 50 50 00:01:49,020 --> 00:01:50,730 the URL parameters that were passed, 51 51 00:01:50,730 --> 00:01:53,760 such as the local resource path or any query strings, 52 52 00:01:53,760 --> 00:01:55,560 the HTTP method being used, 53 53 00:01:55,560 --> 00:01:57,930 whether it was a post request or a get request 54 54 00:01:57,930 --> 00:02:00,120 or what other kind of method was being used here, 55 55 00:02:00,120 --> 00:02:02,130 and then the context for the rule. 56 56 00:02:02,130 --> 00:02:04,230 Now this context for the rule might have something 57 57 00:02:04,230 --> 00:02:06,990 like a reference to the database of known vulnerabilities, 58 58 00:02:06,990 --> 00:02:09,600 exploit technique, or some knowledge-based article. 59 59 00:02:09,600 --> 00:02:12,180 As you saw in my earlier example, this is one that was based 60 60 00:02:12,180 --> 00:02:14,250 off a Nikto scan, and so that was part 61 61 00:02:14,250 --> 00:02:16,650 of the reference there inside of that rule set. 62 62 00:02:16,650 --> 00:02:18,720 Now for the exam what do you need to know 63 63 00:02:18,720 --> 00:02:20,850 about web application firewalls? 64 64 00:02:20,850 --> 00:02:22,860 Well, you should know that if you're trying to protect 65 65 00:02:22,860 --> 00:02:25,830 your web server, you should have a web application firewall, 66 66 00:02:25,830 --> 00:02:27,450 specifically if you're trying to protect it 67 67 00:02:27,450 --> 00:02:30,750 against things like SQL injections, XML injections, 68 68 00:02:30,750 --> 00:02:32,640 or cross-site scripting attacks. 69 69 00:02:32,640 --> 00:02:33,990 Any kind of attack that's operating 70 70 00:02:33,990 --> 00:02:36,990 at Layer 7 of the OSI model, an application layer, 71 71 00:02:36,990 --> 00:02:38,550 that's targeting one of your web servers 72 72 00:02:38,550 --> 00:02:40,200 could be something that's going to be a good candidate 73 73 00:02:40,200 --> 00:02:42,813 to remediate using a web application firewall.