O le tausaga na teʻa nei na matou tatalaina ai Nemesida WAF Free, o se faʻaoga malosi mo NGINX e poloka ai osofaʻiga i luga o upega tafaʻilagi. E le pei o le faʻasalalauga faʻapisinisi, lea e faʻavae i luga o le aʻoaʻoina o masini, o le free version e suʻesuʻeina talosaga naʻo le faʻaaogaina o le auala saini.
Vaega o le tatalaina o Nemesida WAF 4.0.129
Aʻo leʻi faʻatagaina nei, o le Nemesida WAF dynamic module na lagolagoina na o Nginx Stable 1.12, 1.14 ma le 1.16. O le faʻasalalauga fou e faʻaopoopoina le lagolago mo Nginx Mainline, amata mai le 1.17, ma le Nginx Plus, amata mai le 1.15.10 (R18).
Aisea e fai ai se isi WAF?
NAXSI ma mod_security atonu o le WAF modules e sili ona lauiloa, ma o le mod_security o loʻo faʻamalosia malosi e Nginx, e ui lava na faʻaaoga muamua i Apache2. O fofo uma e lua e leai se totogi, matala ma maua le tele o tagata faʻaoga i le lalolagi atoa. Mo mod_security, saini saini saoloto ma pisinisi o loʻo avanoa mo le $ 500 i le tausaga, mo NAXSI o loʻo i ai se seti saoloto o saini mai le pusa, ma e mafai foi ona e mauaina seti faaopoopo o tulafono, e pei o le doxsi.
O le tausaga nei na matou faʻataʻitaʻia ai le faʻaogaina o le NAXSI ma Nemesida WAF Free. Fa'apuupuu e uiga i taunu'uga:
- NAXSI e le fa'aluaina le fa'aliliuina URL i kuki
- NAXSI e umi se taimi e fetuutuunai ai - e ala i le le mafai, o le faʻaogaina o tulafono faʻatulagaina o le a poloka ai le tele o talosaga pe a galue i se upega tafaʻilagi (faʻatagaina, faʻasaʻo se talaaga poʻo se mea, auai i suʻesuʻega, ma isi) ma e manaʻomia le faia o lisi faʻapitoa , lea e i ai se aafiaga leaga i le saogalemu. Nemesida WAF Free fa'atasi ai ma tulaga fa'aletonu na te le'i faia se fa'ailoga sese se tasi a'o galue ma le saite.
- o le numera o osofaʻiga misia mo NAXSI e tele taimi maualuga, ma isi.
E ui i o latou vaivaiga, ae o le NAXSI ma le mod_security e lua ona lelei: o le code tatala ma le tele o tagata faʻaoga. Matou te lagolagoina le manatu o le faʻaalia o le code punaoa, ae matou te leʻi mafai ona faia ona o ni faʻafitauli e ono tulaʻi mai i le faʻasalalauga faapisinisi. Mo le taui o lenei mea, o loʻo matou faʻaalia atoatoa mea o loʻo i totonu o le seti saini. Matou te faʻatauaina le le faalauaiteleina o faamatalaga ma valaaulia oe e te iloa mo oe lava e ala i le faʻaaogaina o se sui.sapalai.
Vaega o Nemesida WAF Free:
- fa'amaumauga saini maualuga ma se numera la'ititi o False Positive ma False Negative.
- faʻapipiʻi ma faʻafouina mai le fale teu oloa (e vave ma faigofie);
- mea faigofie ma malamalama e uiga i mea na tutupu, ae le o se "gaogao" pei o NAXSI;
- saoloto atoatoa, e leai ni tapulaa i luga o le aofaʻi o fefaʻatauaiga, virtual hosts, etc.
I le faaiuga, o le a ou tuuina atu ni nai fesili e iloilo ai le faatinoga o le WAF (e fautuaina e faaaoga i sone taitasi: URL, ARGS, Headers & Body):
')) un","ion se","lect 1,2,3,4,5,6,7,8,9,0,11#"] ')) union/**/select/**/1,/**/2,/**/3,/**/4,/**/5,/**/6,/**/7,/**/8,/**/9,/**/'some_text',/**/11#"] union(select(1),2,3,4,5,6,7,8,9,0x70656e746573746974,11)#"] ')) union+/*!select*/ (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"] ')) /*!u%6eion*/ /*!se%6cect*/ (1),(2),(3),(4),(5),(6),(7),(8),(9.),(0x70656e746573746974),(11)#"] ')) %2f**%2funion%2f**%2fselect (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"] %5B%221807182982%27%29%29%20uni%22%2C%22on
%20sel%22%2C%22ect%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C%2some_text%27%2C11%23%22%5D
cat /et?/pa?swd
cat /et'c/pa'ss'wd
cat /et*/pa**wd
e'c'ho 'swd test pentest' |awk '{print "cat /etc/pas"$1}' |bas'h
cat /etc/passwd
cat$u+/etc$u/passwd$u
<svg/onload=alert()//
Afai e le poloka ia talosaga, e foliga mai o le a misia e le WAF le osofaʻiga moni. Aʻo leʻi faʻaaogaina faʻataʻitaʻiga, ia mautinoa e le o poloka e le WAF talosaga faʻamaonia.
puna: www.habr.com
