Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 24560 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Help with WAF configuration

NewEagle
I've setup a personal lab with 3 virtual machines to test Sophos UTM. I want to test the WAF launching an automatic web vulnerability scanner (Zap Proxy) from Kali Linux to inspect badstore (a vulnerable webapp) and check if Sophos detect the payloads launched by the scanner.

This is my setup:

1- Sophos VM interface list
********************
External: 192.168.0.105 
KaliNet: 192.168.2.100 
Webserver: 192.168.3.100

1- Kali VM
********************
IP: 192.168.2.50

2- Badstore VM 
********************
IP: 192.168.3.50


           192.168.2.100|192.168.3.100
[Kali]  [UTM]  [Badstore]
192.168.2.50                                       192.168.3.50


In the Webserver Protection I've set-up:

1- A real webserver:
www.badstore.com
192.168.3.50

2- A virtual webserver pointing to the real webserver Badstore and using the Advanced Protection profile.

If I start an active scan with ZAP Proxy, the IPS module detects SQL Inyection attacks and nothing else. However, the WAF also includes other categories (like XSS) and is not detecting anything. I can freely use the most basic attacks like 

In the main dashboard I can see how the IPS has X attacks blocked, but the WAF shows always 0 attacks blocked. Does anybody knows what could be happening? If you need screenshots or any info just ask for it, please.

Thank you!


This thread was automatically locked due to age.
Parents
  • 0
    Every network security professional knows Kali/Backtrack.  [:P]  As Bob alludes to though, most forum denizens here do not fit into that category.  As such, provide as much detail as possible when posting so the issue can be more generalized and less product specific for apps.  In the end it's more about ports and protocols than specific apps.  [:)]
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to Scott_Klassen
    Hi!

    Thank you for your suggestions. I've made same screenshots so you can see:

    This is the list of interfaces created in the UTM:

    [/img]s16.postimg.org/.../Interfaces.png s21.postimg.org/.../img]

    As you can see, I've setup www.wavsep.com as the hostname.

    These are the virtual and real webserver tabs:




    This is the log of the WAF while the attack is being launched:




    As you can see, I've done automatic and manual testing. Nothing is showed in the WAF logs. Just these, and I'm pretty sure that's before even starting the attack

    2015:10:19-18:52:18 sophosutm reverseproxy: [Mon Oct 19 18:52:18.013621 2015] [core:notice] [pid 4982:tid 4147611328] AH00094: Command line: '/usr/apache/bin/httpd'
    2015:10:19-18:52:18 sophosutm reverseproxy: [Mon Oct 19 18:52:18.013642 2015] [mpm_worker:warn] [pid 4982:tid 4147611328] AH00291: long lost child came home! (pid 5814)
    2015:10:19-18:52:18 sophosutm reverseproxy: [Mon Oct 19 18:52:18.013651 2015] [mpm_worker:warn] [pid 4982:tid 4147611328] AH00291: long lost child came home! (pid 5825)
    2015:10:19-18:52:56 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="484" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-18:52:58 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="356" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-19:00:40 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="343" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-19:01:46 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="274" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-19:02:58 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="340" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-19:09:26 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="564" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-"
    2015:10:19-19:09:29 sophosutm reverseproxy: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="54" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="329" url="/lb-status" server="localhost" referer="-" cookie="-" set-cookie="-" 


    I'm not sure if you need any extra information... thank you for your help and suggestions.

    PS: In case you see something strange about badstore and wavsep, I've just switched "badstore" with "wavsep" as the vulnerable web app to attack.
  • 0 in reply to NewEagle
    Hi,

    you should change the virtual webserver interface to 'Internal (Address)'.

    Sabine
Reply Children
No Data
Unfiltered HTML