Home
Contribute Contact Us Browse all meetings
Home Contribute Contact Us Browse all meetings
GitLab / Protect Stage / 24 Jun 2020
GitLab / Protect Stage / 24 Jun 2020
Previous Meeting Next Meeting
⏯
Add meeting Rate page Subscribe
youtube image
►
From YouTube: Web Application Firewall (ModSecurity)

Description

Documentation: https://docs.gitlab.com/ee/topics/web_application_firewall/



This video demonstrates how to install the Web Application Firewall in logging and blocking modes.


Previous video in the series: https://youtu.be/IN-XGE1X8Mo


OWASP Core Rule Set:

- https://coreruleset.org/

- https://github.com/coreruleset/coreruleset/

A

Once we have a kubernetes cluster with helm available, we can finally stall the Web Application, Firewall or wife. For short, you can select whether you want to enable or disable the after installation and if you choose to enable you can also select between log in mode and blocking mode I'm going to leave it enable in locking log in mode and I'm gonna click install behind-the-scenes, Helm's, installing mode security and deploy the OWASP core route rule set. You can find a link to the rules in the video description.

A

Once the wife is installed, you should be able to see some ingress services in the Google cloud platform console now that wofe is installed. Let's have a look at the logs to see if anything is coming up yet I'm piping, the output over the logs to JQ for better readability.

A

We can see that we've received a couple events from modsecurity. These particularly requests were not blocked, since the graph is operating in login mode. Only now I'm going to change the web mode from logging to blocking. What's the change is complete. We can go to the console and test a few requests. First I'm gonna start the login again. Second I'm gonna make a harmless request.

A

This is the URL to the application and you can see that once I requested I get a normal response from the server now, let's change our request to something potentially dangerous, like a script embedded in the query string once I make this request, I can see that he was forbidden and if I go to the logs I can see the reason why this request was denied.

A

This was a very basic demonstration of the wife capabilities with the default or Wasco rule set I recommend you check out the chorus at the whole website and also the remaining of the gitlab graph documentation. It has useful information, such as how to enable charts for anomalous traffic.