Despliegue de un firewall de aplicación web – WAF

WAF (Web ApplicationFirewall) protegen servidores web y las aplicaciones que ejecutan, trabajan en la capa 7 o capa de aplicación del modelo OSI situándose entre el firewall y el servidor.

  • Pueden integrarse como software, hardware o servicio cloud.
  • Funcionan como un antivirus, utilizando una base de datos de reglas, análisis sintáctico y firmas.
  • Protege ante vulnerabilidades de inclusión de ficheros, XSS, SQL injection, etc.
  • Permiten también el balanceo de cargas entre varios servidores.

Realizamos una snapshot

Instalamos el módulo de apache mod-security

apt-get install libapache2-mod-security

Reiniciamos apache

apachectl -M | grep security

Renombramos el fichero de configuración de modsecurity.conf-recommended

cp modsecurity.conf-recommended modsecurity.conf

Editamos el fichero modsecurity.conf y ponemos SecRuleEngine a On

Las reglas se guardan en la siguiente ubicación:

Vamos a descargar las reglas actualizadas de OWASP

sudo git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git /usr/share/modsecurity-crs

Si listo el directorio tenemos más ficheros que antes.

Hay que cambiar el nombre fichero crs-setup-conf.example

cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

Comprobamos que el fichero security2.conf contenga los ficheros de configuración.

nano /etc/apache2/mods-enabled/security2.conf

Añadimos 2 líneas al fichero de configuración.

IncludeOptional /usr/share/modsecurity-crs/*.conf

IncludeOptional /usr/share/modsecurity-crs/rules/*.conf

Vemos la cantidad de reglas que hay descargadas para distintas aplicaciones como cPanel, WordPress, Drupal

Reiniciamos apache

Ahora comprobamos que el módulo modsecurity funciona correctamente

Ejercicios:

1. Simulamos un ataque XSS

192.168.159.128/index.html?=<script>alert<”XSS”>;</script>

Si editamos el fichero modsecurity.conf y desactivamos SecRuleEngine a On se traga el script

2. Ver los logs

Aquí vemos la regla donde capa el ataque

nano /var/log/apache2/modsec_audit.log

 

Deja un comentario

slot thailand

slot gacor

slot gacor

https://badudu.org/

badudu

slot gacor

https://siakad.unikamamuju.ac.id/fonts/-/starlight-princess/

slot gacor

slot gacor 4d

slot gacor

https://labskill.umtas.ac.id/wp-content/slot-gacor/

https://kamalinews.co.id/wp-content/slot-deposit-qris/

https://lsgi.org/

https://lsgi.org/

slot777

slot88

http://upforfifty.xyz/

slot gacor

slot88

slot

https://katalog.uinsyahada.ac.id/slot/

slot gacor

slot

slot gacor

slot gacor

slot gacor

slot demo

toto4d

pay4d

https://bpbd.tulangbawangkab.go.id/shop/server-thailand/

https://게이코슬롯.com/

gacor88

slot gacor

slot thailand

slot demo

slot gacor

slot gacor

situs slot gacor

situs slot gacor

slot-thailand

slot gacor

slot88

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot demo

https://manajemen.unik-kediri.ac.id/wp-content/files/-/slot-toto/

slot4d

slot gacor

https://simpatda.rohilkab.go.id/public/

https://pajak.gunungmaskab.go.id/js/

slot88

https://ojs.trigunadharma.ac.id/public/

https://ojs.trigunadharma.ac.id/up_load/site/

https://kip-kuliah.itbi.ac.id/images/

https://itbi.ac.id/asset/

https://kabanjahe.itbi.ac.id/asset/

https://dindikbud.pekalongankab.go.id/assets/js/

https://dindikbud.pekalongankab.go.id/styles/img/

https://rsud.tulangbawangkab.go.id/shop/

https://dindikbud.pekalongankab.go.id/styles/fonts/

https://ppdb.dindikbud.pekalongankab.go.id/img/

https://simppdb.dindikbud.pekalongankab.go.id/.well-known/pki-validation/

https://akpergshwng.ac.id/assets/js/

https://slot88.smkmuhkandanghaur.sch.id/

https://myexist.muallimaat.sch.id/.well-known/

slot gacor

toto macau

slot gacor

slot gacor

slot gacor hari ini

slot gacor

slot maxwin

https://keclasem.rembangkab.go.id/error/

https://ak.polnep.ac.id/slot-gacor/

slot thailand

https://pmbtest.akpergshwng.ac.id/data/slot-qris-gacor/

slot gacor 4d

https://elsa.polteksahid.ac.id/elsa/files/slot-gacor-thailand/

https://ppdb.smai-soedirman-kotabekasi.sch.id/assets/

slot-gacor

slot-gacor

olxtoto

slot gacor

slot gacor

https://roadpowersystems.com/pages/

slot4d

slot gacor

slot gacor

slot gacor

slot thailand

togel online

slot88

togel online

slot gacor

https://fkomputer.umku.ac.id/wp-content/plugins/

https://feb.umku.ac.id/wp-includes/

https://fgizi.umku.ac.id/wp-content/languages/

https://fmipa.umku.ac.id/wp-includes/

slot gacor

slot88

slot88

slot gacor

slot gacor

slot gacor

slot gacor

https://fkip.umku.ac.id/wp-content/uploads/

https://fkesehatan.umku.ac.id/wp-content/plugins/

slot gacor

slot gacor

https://fst.umku.ac.id/wp-content/plugins/

https://fkeperawatan.umku.ac.id/wp-content/plugins/

olx toto

https://akparjakarta.ac.id/wp-content/

slot qris

slot qris

slot gacor

slot gopay

slot thailand

slot gacor

slot gopay

slot5000

https://ppdb.smai-soedirman-kotabekasi.sch.id/assets/

https://pmbtest.akpergshwng.ac.id/data/slot-qris-gacor/

https://cbt.dindikbud.pekalongankab.go.id/assets/

slot ovo

https://jdih.pn-labuanbajo.go.id/images/

https://pn-labuanbajo.go.id/wp-content/uploads/

https://fst.umku.ac.id/wp-content/uploads/

slot gacor

slot gacor

slot gacor

slot88

slot gacor

https://smkpelitanusantara.sch.id/

https://wibs.sch.id/

https://smkm3-alkamal.sch.id/

https://pelitanusantara.sch.id/

slot hoki

slot gacor kamboja

slot777

slot gacor 4d

http://esptpd.kaimanakab.go.id/public/img/

slot gacor

slot server luar

slot gacor

slot88

slot hoki

https://api.kelastryout.id/assets/

slot gacor

slot gacor

slot gacor

slot gacor 2023

https://perpustakaan.poltekkespangkalpinang.ac.id/macau-slot-gacor/

https://sipp.pn-labuanbajo.go.id/resources/

http://bphtb.mitrakab.go.id/public/js/

slot88

https://lppm.upr.ac.id/assets/uploads/

slot gacor

slot88

slot88

slot gacor

slot gacor

slot maxwin

slot gacor

slot gacor

slot maxwin

slot gacor

slot gacor

slot777

slot gacor

http://bphtb.mitrakab.go.id/public/img/

slot demo

https://fkg.unimus.ac.id/wp-content/

slot-thailand

https://gizi.unimus.ac.id/wp-content/

https://statistik.unimus.ac.id/wp-content/

https://pmb.akpergshwng.ac.id/js/

https://pmb.akpergshwng.ac.id/css/

https://pmb.akpergshwng.ac.id/images/

slot maxwin

slot thailand

slot gacor

slot

slot gacor

slot gacor

slot maxwin

slot gacor

slot gacor

slot777

https://pajak.gunungmaskab.go.id/bphtb/public/fonts/

http://bphtb.mitrakab.go.id/public/img/

slot demo

slot4d

slot88

slot maxwin

slot gacor

slot gacor

slot thailand

slot gacor

slot thailand

slot gacor

slot gacor

slot gacor

www.oooms.org/

slot gacor

slot gacor

slot gacor

slot gacor

https://descubripunilla.com/

slot gacor

slot88

slot777

https://walnuttavern.com/

https://royalharbor.org/

slot gacor

https://ppdb.smai-soedirman-kotabekasi.sch.id/js/

https://asik.sman1marabahan.sch.id/js/

slot garansi

https://dindikbud.pekalongankab.go.id/stats/

slot dana

slot dana

slot gacor

slot gacor

https://ppdb.smai-soedirman-kotabekasi.sch.id/web/

https://programmes.help.edu.my/wp-content/ninjajago/

https://surgalt.mof.gov.mn/public/ninjajago/

https://www.funteacherprivate.com/ninjajago/

server vietnam

https://lms.cpraedcourse.com/public/store/ninjajago/

slot gopay

slot thailand

slot thailand

slot88

slot gacor

slot gacor

slot gacor

slot777

slot gacor

togel

slot thailand

slot88

slot gacor

slot gacor

slot gacor

slot5000

slot gacor

slot demo

slot88

slot gacor

https://cas.beetleware.com/ninjajago/

https://savadrasane.ir/ninjajago/

https://wilipso.edu.pe/ninjajago/

https://innovacionescyc.net/HOME/wp-content/ninjajago/

https://e-classe.mfr-pontonx.com/cours/web/ninjajago/

https://softwarevilla.com/uploads/

slot gacor

slot88

https://online-sattaking.com/js/

https://aqualtrend.addinol.cz/ninjajago/

https://app.rekola.cz/assets/ninjajago/

https://cas.beetleware.com/assets/ninjajago/

https://quimicaantupiren.com/wp-content/uploads/ninjajago/

https://patrickboisclair.com/ninjajago/

slot gacor

slot gacor

slot thailand

slot gacor

http://simrsud.pasamankab.go.id/slot-luar-negeri/

https://colegiodentistasgranada.org/static/ckeditor/

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot gacor

slot thailand

https://longwood.ibot.cas.cz/mpo-slot/

slot thailand

slot thailand

slot gacor

slot thailand

slot gacor

slot thailand

slot777

http://simrsud.pasamankab.go.id/slot-luar-negeri/

slot gacor

slot luar negeri

slot777

slot gacor hari ini

slot777

slot gacor

slot gacor

situs slot gacor

slot gacor

slot gacor

slot demo

slot demo

https://psb.bbpkmakassar.or.id/blog/thailand/

https://www.france-boissons.fr/slot-gacor/

slot777

slot gacor hari ini

slot gacor hari ini

slot88

slot gacor

slot gacor

http://poskocovid19.perhubungan.jatengprov.go.id/products/ninjajago-gacor/

slot gacor

slot thailand

https://simppdb.dindikbud.pekalongankab.go.id/products/server-thailand/

https://poskocovid19.perhubungan.jatengprov.go.id/products/gacor/

slot gacor

slot thailand

slot thailand

https://siakad-d2.poltekesos.ac.id/ninjajago/

slot thailand

https://www.bsides.nz/

https://pmb.akpergshwng.ac.id/products/ninja-gacor/

slot gacor

https://murnajati.jatimprov.go.id/assets/ninjajago-gacor/

slot gacor

slot thailand

https://pbb-p2.balikpapan.go.id/-/

https://lib.murnajati.jatimprov.go.id/pg/

https://ppid.murnajati.jatimprov.go.id/rekomendasi-gacor/

https://antareja.upnyk.ac.id/produk/gacor-ninjajago/

https://unigres.ac.id/ninjajago/

http://poskocovid19.perhubungan.jatengprov.go.id/link-gacor/

slot777

toto togel

https://slot-gacor.center/

slot thailand

https://gemarimart.gemri.id/

slot gacor maxwin

https://parkir.salatiga.go.id/products/gacor-server-thailand/

https://슬롯88.org/

https://antareja.upnyk.ac.id/product/88gacor/

https://simbphtb.kuduskab.go.id/simbphtb/-/

https://katalog.uinsyahada.ac.id/slot-luar-negeri/

https://repository.stiem-bongaya.ac.id/files/gacor-dong/

https://ebphtb.rohilkab.go.id/shop/situs-wd/

slot gacor

slot demo

slot gacor