alt3kx/wafparan01d3Quick WAF "paranoid" Doctor Evaluation | WAFPARAN01D3 Tool
웹 애플리케이션 방화벽 패러노이아 레벨 테스트 도구.
— alt3kx.github.io에서
-blue.svg){kind=icon}
본질적으로 Paranoia Level(PL, 패러노이아 레벨)은 Core Rule Set의 공격성을 얼마나 강하게 설정할지 정의할 수 있게 해줍니다.
참조: https://coreruleset.org/20211028/working-with-paranoia-levels/
wafparan01d3.py python3 스크립트는 GET 파라미터를 기반으로 HTTP 요청의 서로 다른 부분에 배치된 인코딩된 payload를 사용하여 악성 요청을 수집하며, 평가 결과는 사용자 머신에 생성되는 디버그 리포트 파일 wafparan01d3.log에 기록됩니다.mysql_gosecure.txt로, gosecure의 연구 "A Scientific Notation Bug in MySQL left AWS WAF Clients Vulnerable to SQL Injection"(여기 https://www.gosecure.net/blog/2021/10/19/a-scientific-notation-bug-in-mysql-left-aws-waf-clients-vulnerable-to-sql-injection/ 참조)를 기반으로 합니다. 기본 구성에서 또는 다양한 규칙/ID를 단계적이고 신속하게 비활성화하여 modsecurity를 사용하는 WAF를 서로 다른 패러노이아 레벨로 평가합니다.
Pentesters: 권한 있는 "쉘"을 사용하여 WAF Linux 박스에 제한적으로 접근하는 GreyBox 범위로, DEV/STG/TEST 환경에서 다양한 payload를 전송하며 WAF Apache 구성 파일을 시작/리로드 및 편집할 수 있습니다.보안 책임자: 조직의 각 솔루션에 적용할 WAF 패러노이아 레벨에 대한 최선의 결정을 내립니다. 블루팀: 조직에서 규칙을 집행하고, 최상의 알림을 제공하며, 오탐(false positive) 결과를 줄입니다. 통합업체: 더 깊은 트러블슈팅을 수행하고 규칙을 신속하게 커스터마이징하거나 가상 패치를 생성하여 적절한 WAF 패러노이아 레벨을 정의합니다. 참조: https://www.inmotionhosting.com/support/server/apache/install-modsecurity-apache-module/
$ sudo apt update -y && sudo apt dist-upgrade -y
$ sudo apt-get install build-essential -y
$ sudo apt-get install apache2 -y
$ sudo apt install libapache2-mod-security2 -y
$ sudo apt-get install curl vim gridsite-clients net-tools -y
$ sudo systemctl restart apache2
$ sudo apt-cache show libapache2-mod-security2
$ sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
다음으로 ModSecurity 감지 모드를 변경합니다. 먼저 cd /etc/modsecurity 폴더로 이동합니다.
2. vi, vim, emacs 또는 nano로 ModSecurity 구성 파일을 편집합니다.
$ sudo vim /etc/modsecurity/modsecurity.conf
SecRuleEngine DetectionOnly가 보일 것입니다. DetectionOnly를 On으로 변경합니다. 원래 값: SecRuleEngine DetectionOnly
새 값: SecRuleEngine On
$ sudo systemctl restart apache2
$ cd ~
$ wget https://github.com/coreruleset/coreruleset/archive/refs/tags/v3.3.2.zip
$ sha1sum v3.3.2.zip && echo ProvidedChecksum
88f336ba32a89922cade11a4b8e986f2e46a97cf v3.3.2.zip
ProvidedChecksum
$ unzip v3.3.2.zip
$ sudo mv coreruleset-3.3.2/crs-setup.conf.example /etc/modsecurity/crs/crs-setup.conf
$ sudo mv coreruleset-3.3.2/rules/ /etc/modsecurity/crs/
$ sudo vim /etc/apache2/mods-enabled/security2.conf
<IfModule security2_module>
# Default Debian dir for modsecurity's persistent data
SecDataDir /var/cache/modsecurity
# Include all the *.conf files in /etc/modsecurity.
# Keeping your local configuration in that directory
# will allow for an easy upgrade of THIS file and
# make your life easier
IncludeOptional /etc/modsecurity/crs-setup.conf
IncludeOptional /etc/modsecurity/rules/*.conf
# Include OWASP ModSecurity CRS rules if installed
#IncludeOptional /usr/share/modsecurity-crs/*.load
</IfModule>
$ sudo vim /etc/apache2/apache2.conf
다음 코드를 복사하여 붙여넣고 저장합니다.
# Include list of ports to listen on
Include ports.conf
Include /etc/modsecurity/modsecurity.conf
Include /etc/modsecurity/crs/crs-setup.conf
Include /etc/modsecurity/crs/rules/*.conf
$ cd /etc/apache2
$ sudo cp mods-available/proxy_http.load mods-enabled
$ sudo cp mods-available/proxy.load mods-enabled/
$ sudo cp mods-available/rewrite.load mods-enabled/
$ sudo systemctl restart apache2
/etc/apache2/ports.conf 편집 $ sudo vim /etc/apache2/ports.conf
다음 코드를 복사하여 붙여넣고 저장합니다.
# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf
Listen 8080
Listen 18080
<IfModule ssl_module>
Listen 443
</IfModule>
<IfModule mod_gnutls.c>
Listen 443
</IfModule>
/etc/apache2/sites-enabled로 이동하여 001-test.conf 파일을 생성합니다. $ cd /etc/apache2/sites-enabled/
$ sudo touch 001-test.conf
$ sudo vim 001-test.conf
다음 코드를 복사하여 붙여넣고 저장합니다.
<VirtualHost *:8080>
ServerName test.domain:8080
SecRuleEngine On
ErrorLog ${APACHE_LOG_DIR}/test_error.log
CustomLog ${APACHE_LOG_DIR}/test_access.log combined
SecAuditLog ${APACHE_LOG_DIR}/test_audit.log
ProxyPass / http://127.0.0.1:18080/
ProxyPassReverse / http://127.0.0.1:18080/
</VirtualHost>
/etc/apache2/sites-enabled로 이동하여 002-moc.conf 파일을 생성합니다. $ cd /etc/apache2/sites-enabled/
$ sudo touch 002-moc.conf
$ sudo vim 002-moc.conf
다음 코드를 복사하여 붙여넣고 저장합니다.
<VirtualHost 127.0.0.1:18080>
ErrorLog ${APACHE_LOG_DIR}/moc_error.log
CustomLog ${APACHE_LOG_DIR}/moc_access.log combined
RewriteEngine On
RewriteRule ^(.*)$ $1 [R=200,L]
</VirtualHost>
$ sudo systemctl restart apache2
wafparan01d3_rulesremove.conf 파일을 생성합니다. $ sudo touch /etc/apache2/conf-enabled/wafparan01d3_rulesremove.conf
$ sudo service apache2 reload
Must be specify a domain , edit the following lines
Windows:
C:\Windows\System32\drivers\etc\hosts
192.168.56.106 test.domain <-- add this line and specify your IP address
Linux:
/etc/hosts
192.168.1.23 test.domain <-- add this line and specify your IP address
$ curl -i -k -s -XGET http://test.domain:8080/
HTTP/1.1 200 OK
Date: Mon, 22 Nov 2021 06:31:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 571
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>200 OK</title>
</head><body>
<h1>OK</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at
[no address given] to inform them of the time this error occurred,
and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 18080</address>
</body></html>
$ curl -i -k -s -XGET http://localhost:18080/
HTTP/1.1 200 OK
Date: Mon, 22 Nov 2021 06:27:17 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 571
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>200 OK</title>
</head><body>
<h1>OK</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at
[no address given] to inform them of the time this error occurred,
and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at localhost Port 18080</address>
</body></html>
도움이 필요하면 help 옵션을 사용할 수 있습니다. 기본 사용법은 정의된 다양한 인수를 전달하는 것입니다.
예시:
$ sudo python3 wafparan01d3.py -h
( ) ) ( )
( ( ))\ ) ) ( ) ( /(( /( )\ ) ( /(
)\))( ( /(()/( ` ) ( /( )( ( /( ( )\())\()|()/( )\())
((_)()\ )(_))(_))/(/( )(_)|()\ )(_)) )\ ) ((_)((_)\ ((_)|(_)\
_(()((_|(_)(_) _((_)_\((_)_ ((_|(_)_ _(_/( / (_) (_)_| |__ (_)
\ V V / _` | _| '_ \) _` | '_/ _` | ' \)) () || |/ _` ||_ \
\_/\_/\__,_|_| | .__/\__,_|_| \__,_|_||_| \__/ |_|\__,_|___/
|_|
~ WAFPARANO1D3 : v1.1 ~
The Web Application Firewall Paranoia Level Test Tool.
usage: wafparan01d3.py [-h] [--run [_RUN]] [--debug [_DEBUG]] [--pl [_PARANOIALEVEL ...]] [--proxy [_PROXY]] [--payload [_PAYLOAD]] [--rules-remove [_RULESREMOVE]] [--log [_LOG]] [--domain [_DOMAIN]] [--conf-file [_CONF_FILE]]
[--time-sleep [_TIME_TO_SLEEP]] [--time-sleep-request [_TIME_TO_SLEEP_REQUEST]] [--desc [_DESC]] [--output-desc [_OUTPUT_DESC]]
optional arguments:
-h, --help show this help message and exit
--run [_RUN] Run script
--debug [_DEBUG] Debug mode
--pl [_PARANOIALEVEL ...]
Define paranoia level Ex. -pl 2
--proxy [_PROXY] Define Proxy. Ex: http://127.0.0.1:8081
--payload [_PAYLOAD] Define payload file. Ex. --payload payload2.txt
--rules-remove [_RULESREMOVE]
Define rules remove file. Ex. --rules-remove rules1.txt
--log [_LOG] Define path of the log file. Ex. --log /var/log/apache/wafparan01d3.log
--domain [_DOMAIN] Define your domain. Ex. --domain example.domain:8080
--conf-file [_CONF_FILE]
Define configuration file. Ex. --conf-file /opt/modsecurity/crs/rules/INITIALIZATION.conf
--time-sleep [_TIME_TO_SLEEP]
Sleep time per PL. Ex. --time-sleep 3
--time-sleep-request [_TIME_TO_SLEEP_REQUEST]
Sleep time per Request. Ex. --time-sleep-request 3
--desc [_DESC] Description of the script and authors
--output-desc [_OUTPUT_DESC]
Description of the output on console mode.
$ sudo python3 wafparan01d3.py -h
- show the help message
$ sudo python3 wafparan01d3.py --run
- run the script with default options.
$ sudo python3 wafparan01d3.py --run --debug
- Print every line on console.
$ sudo python3 wafparan01d3.py --run --pl 1
- Run the script in assigned Paranoia Level.
- By default runs on Paranoia Level 1, 2, 3, 4
$ sudo python3 wafparan01d3.py --run --payload file_payload2.txt
- Define the payload file that you want to send to WAF.
- By default takes the file mysql_gosecure.txt
$ sudo python3 wafparan01d3.py --run --rules-remove rules_removex.txt
- Define the rules that you want to remove on GWAF.
- Example of the file:
- Default 920000 920001 920002
- By default takes the files: rules_remove1.txt, rules_remove2.txt, rules_remove3.txt, rules_remove4.txt
$ sudo python3 wafparan01d3.py --run --log /home/waf_user/paranoia.log
- Define LOG File.
- By default print the log on paranoia_debug.log
$ sudo python3 wafparan01d3.py --run --domain mydomain.test.com
- Define Domain of Front End WAF.
- By default runs over domain domain.test:8080
$ sudo python3 wafparan01d3.py --run --conf-file /opt/modsecurity/crs/rules/INITIALIZATION.conf
- Define the configuration file to update the Paranoia Level
- By default takes /etc/modsecurity/crs/rules/REQUEST-901-INITIALIZATION.conf
$ sudo python3 wafparan01d3.py --run --time-sleep 3
- Define the time to sleep per Paranoia Level.
$ sudo python3 wafparan01d3.py --run --time-sleep-request 2
- Define the time to sleep per request send to WAF.
$ sudo python3 wafparan01d3.py --desc
- Print the description of the script and the authors.
최신 OWASP Core Rule Set CRS 3.3.2를 사용하여 WAF ModSecurity 및 'Mock'을 배포하는 VM 환경(Ubuntu)을 실행하면 wafparan01d3.py를 사용해 볼 수 있습니다. ModSecurity 패러노이아 레벨을 평가하며 쉽게 커스터마이징할 수 있습니다.
실행 방법:
$ git clone https://github.com/alt3kx/wafparan01d3.git
$ cd wafparan01d3
$ sudo python3 wafparan01d3.py --help
$ sudo python3 wafparan01d3.py --run
$ sudo python3 wafparan01d3.py --run --debug --proxy http://192.168.56.1:8081
$ sudo python3 wafparan01d3.py --run --debug --pl 1 2 --proxy http://192.168.56.1:8081 --log test.log --domain vulnerable.domain:8080 --time-sleep-request 1 --time-sleep 1 --rules-remove my_rules_remove.txt --payload my_payload.txt
https://github.com/mindhack03d/WAF-Rule-Scientific-Notation
Alex Hernandez 일명 (@_alt3kx_)
Jesus Huerta 일명 @mindhack03d