The HAProxy Enterprise WAF

blog20210303-01.sh

$ python /usr/bin/sqlmap \
   --random-agent \
   --cookie="PHPSESSID={YOUR SESSION ID};security=low" \
   --dbs \
   --url="http://{YOUR SITE IP}/vulnerabilities/sqli/?id=&Submit=Submit" \
   -p id

blog20210303-02.sh

[09:24:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: Apache 2.4.25
back-end DBMS: MySQL 5.0.12
[09:24:38] [INFO] fetching database names
available databases [2]:
[*] dvwa
[*] information_schema

blog20210303-03.sh

$ ssh -i ./haproxy_demo.pem ubuntu@[HAPROXY_IP_ADDRESS]

blog20210303-04.sh

$ sudo /opt/hapee-2.2/bin/hapee-lb-modsecurity-getcrs

blog20210303-05.cfg

global
   module-load hapee-lb-modsecurity.so

blog20210303-06.cfg

frontend fe_main
   filter modsecurity owasp_crs rules-file /etc/hapee-2.2/modsec.rules.d/lb-modsecurity.conf

blog20210303-07.sh

$ sudo systemctl reload hapee-2.2-lb

blog20210303-08.sh

$ python /usr/bin/sqlmap \
   --random-agent \
   --cookie="PHPSESSID={SESSION ID};security=low" \
   --dbs \
   --url="http://{SITE IP}/vulnerabilities/sqli/?id=&Submit=Submit" \
   -p id

[09:51:40] [WARNING] GET parameter 'id' is not injectable
[09:51:40] [CRITICAL] all tested parameters appear to be not injectable.
[09:51:40] [WARNING] HTTP error codes detected during run:
403 (Forbidden) - 1 times

blog20210303-09.cfg

acl waf_blocked var(txn.owasp_crs.block) -m bool
http-request send-challenge ... if waf_blocked