Part 2 - Reconnaissance Playbook: Azure WAF Security Protection and Detection Lab

Published Jan 14 2021 04:35 PM 3,557 Views
Microsoft

 

 

 

Tutorial: Reconnaissance Playbook

 

 

 

The second tutorial in this four-part series for Azure WAF protection and detection lab is the reconnaissance playbook.  The purpose of the Azure WAF security protection lab is to demonstrate Azure WAF's capabilities in identifying and protecting against suspicious activities and potential attacks against your web applications. This playbook explains how to test Azure WAF's protections against a reconnaissance attack with emphasis on Azure WAF protection ruleset and logging capabilities.  The lab does not include advanced application security concepts and is not intended to be a reference for application security testing as these areas are broader than the use cases demonstrated herein.

 

This playbook demonstrates the web application protection capabilities of Azure WAF against a simulated reconnaissance (recon) attack from common, real-world, publicly available hacking and attack tools.

 

In this tutorial you will:

  1. Run web application vulnerability scan against the target OWASP Juice Shop web application directly and then scan the same instance of the web application published through Azure WAF
  2. Review the differences in the results of the two web application vulnerability scans
  3. Review the summarized logs in the WAF Workbook (Azure Monitor Workbook for WAF)

 

 

Prerequisites

 

A completed Azure WAF security lab setup

 

  • We recommend following the lab setup instructions as closely as possible. The closer your lab is to the suggested lab setup, the easier it will be to follow the Azure WAF testing procedures

 

 

Reconnaissance Attack

 

Before an attacker can exploit a vulnerability, they will typically spend time researching their target web application which involves collecting application specific data and analyzing it for potential vulnerabilities.  One of the methods for collecting sensitive security data to identify potential vulnerabilities in a web application is to utilize web application security vulnerability scanners.  These scanners can analyze an application’s response headers to identify potential vulnerabilities.  Data collected with web application vulnerability scanners can reveal potential vulnerabilities that an attacker could then test, develop, and leverage for exploitation or exfiltration.  Such reconnaissance activities also allow attackers to gain a thorough understanding and complete mapping of your application for later use.

 

 

Performing Reconnaissance with Web Application Vulnerability Scanner

 

One of the first things an attacker will attempt is to try and gain extensive understanding of the application components, framework, and the potential vulnerabilities in a target web application.  The quickest, most common method of doing this is to use a commercial or an open source web application vulnerability scanner (also called security scanners) to run unauthenticated/unauthorized scans against a target.  In this tutorial, you will run two web application vulnerability scans against the target web application

 

  1. First scan will point to the target web application directly
    • URL: http://owaspdirect-<deployment guid>.azurewebsites.net
  2. Second scan will point to the same target web application protected by Azure WAF on Application Gateway

 

 

Running Web Application Vulnerability Scan against the Target Application

 

To run the web application vulnerability scans, we will connect to the Kali VM with RDP.  Once connected, we will use Nikto, a versatile, command line open source web application vulnerability scanning tool which is bundled in the Kali Linux distro.  When pointed to the target web application, Nikto will scan the application for common vulnerabilities and display the scan output in the terminal window for quick review.

 

  1. Sign into the Kali Linux VM using your lab credentials
  2. Launch the web browser and ensure that you are able to access the OWASP Juice Shop website directly with URL http://owaspdirect-<deployment guid>.azurewebsites.net and also through WAF with URL http://juiceshopthruwaf.com
  3. Launch two instances of Nikto Web Vulnerability Scanner.  Click on Applications on the top left and then click Web Application Analysis --> Web Vulnerability Scanners --> Nikto

 

Mohit_Kumar_0-1609887818173.png

 

  1. To initiate the scans, utilize the following commands.  One in each of the open Nikto windows
    1. nikto -h http://owaspdirect-<deployment guid>.azurewebsites.net
    2. nikto -h http://juiceshopthruwaf.com

 

  • Tips
    • To display verbose output in Nikto, use the following command
      • nikto -h <http://owaspdirect-<deployment guid>.azurewebsites.net> -Display v
    • To save Nikto output to a file to review later, use the following command
      • nikto -h <http://owaspdirect-<deployment guid>.azurewebsites.net> -Save ./juiceshopdirect.htm 

 

Reviewing Web Application Vulnerability Scan Results

 

After the scans finish running, we can quickly review the results by looking at the highlighted lines in the figures below.

 

  1. When going to the Juice Shop website directly, we see that the scanner sent 7k+ requests1 to the web server and as a result found 2 errors and 150+ items/issues which could then be used to develop further attack and exploitation scenarios

 

Figure 1 (Scan Start)

Mohit_Kumar_0-1609888445044.png

 

Figure 2 (Scan End)

Mohit_Kumar_2-1609796992288.png

! IMPORTANT:  For the scenarios demonstrated in this document, OWASP Juice Shop application was running on HTTP port 3000.  This is not the case when you use the Azure WAF Attack Testing Lab Deployment Template as it configures the application to run on port 80, 443 and assigns it a URL.  For the lab tutorials, you will connect to the application on HTTP port 80 only.  The URL for the application will be http://owaspdirect-<deployment guid>.azurewebsites.net.  <deployment guid> is unique to every deployment

 

  1. While scanning Juice Shop website through the Azure WAF, we see that the scanner made >3x the number of requests1 when compared to scanning the website directly in Step 1 and still it did not find any errors to report.  Similarly, this scan is only able to report <1% of the number of items/issues for further investigation as compared to when scanning the website directly

 

1 Request count for http://owaspdirect-<deployment guid>.azurewebsites.net taken from baseline of scans for comparison

 

Mohit_Kumar_0-1609888844466.png

 

 

Understanding What Happened

 

Upon reviewing the Nikto scan outputs, we see the pattern as shown in the below table.  This clearly indicates that when going through the Azure WAF, the scanner is not as effective in assessing the web application and identifying potential vulnerabilities.

 

Recon Scan Route

No. of Issues

No. of Items for Investigation

Direct

2

167

Through WAF

0

3

 

Now let us use the Azure Monitor Workbook for WAF to understand how WAF handled traffic from the Nikto security scanner.  This workbook visualizes security relevant WAF events across several filterable panels.  It works with all WAF types, including Application Gateway, Front Door, and CDN, and can be filtered based on WAF type or a specific WAF instance.

 

Click here to deploy Azure Monitor Workbook for WAF to your subscription in Azure.

 

  • Tip:  To understand what is happening when scan traffic destined for the Juice Shop application goes through the Azure WAF, you can also examine the log entries associated with ApplicationGatewayFirewallLog in the Azure Monitor

 

 

Reviewing WAF logs in the Workbook

 

  1. You can access the WAF workbook by going into the Workbook blade and then selecting the WAF workbook deployed for this lab.  Once in the workbook, ensure that you have selected the appropriate Time Range, WAF Type and WAF Items in the event filters

 

Mohit_Kumar_0-1610145342692.png

 

  1. You should also ensure that you have selected the correct Public IP address for your attacker machine (Kali VM) in the Top 10 Attacking IP Addresses, filter to single IP address pane.

 

  • Tip:  If you are using the Azure WAF Attack Testing Lab Environment Deployment Template and have followed the lab setup instructions then the client IP address will be the public IP address of the Azure Firewall in your demo environment

 

Mohit_Kumar_1-1609889556104.png

 

  1. After selecting the correct client IP, we scroll back up to the top of the Workbook and review the visualizations at the top, in the WAF Workbook.  The sections of the workbook we will be using here are highlighted with alphabetized callouts in the below figure, we see that they map to the following sections

 

a. WAF actions filter

b. Top 40 Blocked Request URI addresses, filter to single URI address

c. Top 50 event trigger, filter by rule name

d. Message, full details

 

Mohit_Kumar_0-1609963440098.png

 

 

Overview of the Workbook sections

 

  1. Starting from the top, the WAF actions filter shows the number of matches and the blocked requests

 

Mohit_Kumar_3-1609797570523.png

 

  1. We can then look at the Top 40 Blocked Request URI addresses, filter to single URI address to identify the top URIs for which requests were blocked by WAF

 

Mohit_Kumar_4-1609797610173.png

 

  1. The Top 50 event trigger, filter by rule name shows all the rules which evaluated the scanner traffic

 

Mohit_Kumar_5-1609797663262.png

 

  • The below table shows an extract of the Top 50 event trigger, filter by rule name output for scanner traffic.  This data clearly shows that WAF was able to detect the security scanner and blocked suspicious requests/payloads from the Nikto Scanner.  This is expected because a security scanner will attempt to perform various types of operations to test security of the web application

 

Rule

count_

Found User-Agent associated with security scanner

8906

Request Missing an Accept Header

8906

GET or HEAD Request with Body Content.

8860

Node-Validator Blacklist Keywords

4553

SQL Injection Attack: Common Injection Testing Detected

3354

Found request filename/argument associated with security scanner

2422

Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link

2418

Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)

2355

Detects basic SQL authentication bypass attempts 2/3

2249

Detects MySQL comments, conditions and ch(a)r injections

2233

Path Traversal Attack (/../)

1698

OS File Access Attempt

699

Remote Command Execution: Unix Shell Code Found

682

XSS Attack Detected via libinjection

667

SQL Injection Attack: SQL Tautology Detected.

641

Possible XSS Attack Detected - HTML Tag Handler

616

XSS Filter - Category 1: Script Tag Vector

616

NoScript XSS InjectionChecker: HTML Injection

616

Detects classic SQL injection probings 2/3

455

Invalid character in request (non printable characters)

342

Invalid character in request (null character)

340

SQL Injection Attack

272

Remote Command Execution: Unix Command Injection

199

SQL Comment Sequence Detected.

197

URL file extension is restricted by policy

192

Restricted File Access Attempt

178

SQL Hex Encoding Identified

147

Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload

136

PHP Injection Attack: High-Risk PHP Function Call Found

128

 

  1. Review further details in the Message, full details section

 

Mohit_Kumar_0-1609890153348.png

 

 

Key Takeaway

 

Using security scanners to perform web application vulnerability assessment scans to expose vulnerabilities in a target web application is a common technique used by attackers.  When external adversaries can perform these scans against your web applications, they are able to learn about your application design and its vulnerabilities which could potentially lead to exploitation. 

 

For web applications secured with it, Azure WAF can detect and protect against reconnaissance attacks executed with security scanners at the network edge, with its out of the box ruleset.

 

 

 

Previous: Setup an Azure WAF Attack Testing Lab 

Next: Vulnerability Exploitation Playbook

 

 

 

 

%3CLINGO-SUB%20id%3D%22lingo-sub-2030751%22%20slang%3D%22en-US%22%3EPart%202%20-%20Reconnaissance%20Playbook%3A%20Azure%20WAF%20Security%20Protection%20and%20Detection%20Lab%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2030751%22%20slang%3D%22en-US%22%3E%3CH2%20id%3D%22toc-hId--554603976%22%20id%3D%22toc-hId--554603980%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1932908857%22%20id%3D%22toc-hId-1932908853%22%3E%3CFONT%20size%3D%226%22%3ETutorial%3A%20Reconnaissance%20Playbook%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20second%20tutorial%20in%20this%20four-part%20series%20for%20Azure%20WAF%20protection%20and%20detection%20lab%20is%20the%20reconnaissance%20playbook.%26nbsp%3B%20The%20purpose%20of%20the%20Azure%20WAF%20security%20protection%20lab%20is%20to%20demonstrate%20%3CSTRONG%3EAzure%20WAF%3C%2FSTRONG%3E's%20capabilities%20in%20identifying%20and%20protecting%20against%20suspicious%20activities%20and%20potential%20attacks%20against%20your%20web%20applications.%20This%20playbook%20explains%20how%20to%20test%20Azure%20WAF's%20protections%20against%20a%20%3CSTRONG%3Ereconnaissance%20attack%3C%2FSTRONG%3E%20with%20emphasis%20on%20Azure%20WAF%20protection%20ruleset%20and%20logging%20capabilities.%26nbsp%3B%20The%20lab%20does%20not%20include%20advanced%20application%20security%20concepts%20and%20is%20not%20intended%20to%20be%20a%20reference%20for%20application%20security%20testing%20as%20these%20areas%20are%20broader%20than%20the%20use%20cases%20demonstrated%20herein.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20playbook%20demonstrates%20the%20web%20application%20protection%20capabilities%20of%20Azure%20WAF%20against%20a%20simulated%20reconnaissance%20(recon)%20attack%20from%20common%2C%20real-world%2C%20publicly%20available%20hacking%20and%20attack%20tools.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20tutorial%20you%20will%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ERun%20web%20application%20vulnerability%20scan%20against%20the%20target%20%3CSTRONG%3EOWASP%20Juice%20Shop%3C%2FSTRONG%3E%20web%20application%20directly%20and%20then%20scan%20the%20same%20instance%20of%20the%20web%20application%20published%20through%20Azure%20WAF%3C%2FLI%3E%0A%3CLI%3EReview%20the%20differences%20in%20the%20results%20of%20the%20two%20web%20application%20vulnerability%20scans%3C%2FLI%3E%0A%3CLI%3EReview%20the%20summarized%20logs%20in%20the%20WAF%20Workbook%20(%3CA%20title%3D%22Azure%20Monitor%20Workbook%20for%20WAF%22%20href%3D%22https%3A%2F%2FAka.ms%2FAzWAFworkbook%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EAzure%20Monitor%20Workbook%20for%20WAF%3C%2FA%3E)%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-125454394%22%20id%3D%22toc-hId-125454390%22%3EPrerequisites%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20title%3D%22Setup%20an%20Azure%20WAF%20Attack%20Testing%20Lab%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-network-security%2Fpart-1-lab-setup-azure-web-application-firewall-security%2Fba-p%2F2030469%22%20target%3D%22_blank%22%3EA%20completed%20Azure%20WAF%20security%20lab%20setup%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EWe%20recommend%20following%20the%20lab%20setup%20instructions%20as%20closely%20as%20possible.%20The%20closer%20your%20lab%20is%20to%20the%20suggested%20lab%20setup%2C%20the%20easier%20it%20will%20be%20to%20follow%20the%20Azure%20WAF%20testing%20procedures%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1682000069%22%20id%3D%22toc-hId--1682000073%22%3EReconnaissance%20Attack%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBefore%20an%20attacker%20can%20exploit%20a%20vulnerability%2C%20they%20will%20typically%20spend%20time%20researching%20their%20target%20web%20application%20which%20involves%20collecting%20application%20specific%20data%20and%20analyzing%20it%20for%20potential%20vulnerabilities.%26nbsp%3B%20One%20of%20the%20methods%20for%20collecting%20sensitive%20security%20data%20to%20identify%20potential%20vulnerabilities%20in%20a%20web%20application%20is%20to%20utilize%20%3CSTRONG%3Eweb%20application%20security%20vulnerability%20scanners%3C%2FSTRONG%3E.%26nbsp%3B%20These%20scanners%20can%20analyze%20an%20application%E2%80%99s%20response%20headers%20to%20identify%20potential%20vulnerabilities.%26nbsp%3B%20Data%20collected%20with%20web%20application%20vulnerability%20scanners%20can%20reveal%20potential%20vulnerabilities%20that%20an%20attacker%20could%20then%20test%2C%20develop%2C%20and%20leverage%20for%20exploitation%20or%20exfiltration.%26nbsp%3B%20Such%20reconnaissance%20activities%20also%20allow%20attackers%20to%20gain%20a%20thorough%20understanding%20and%20complete%20mapping%20of%20your%20application%20for%20later%20use.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-805512764%22%20id%3D%22toc-hId-805512760%22%3EPerforming%20Reconnaissance%20with%20Web%20Application%20Vulnerability%20Scanner%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20of%20the%20first%20things%20an%20attacker%20will%20attempt%20is%20to%20try%20and%20gain%20extensive%20understanding%20of%20the%20application%20components%2C%20framework%2C%20and%20the%20potential%20vulnerabilities%20in%20a%20target%20web%20application.%26nbsp%3B%20The%20quickest%2C%20most%20common%20method%20of%20doing%20this%20is%20to%20use%20a%20commercial%20or%20an%20open%20source%20web%20application%20vulnerability%20scanner%20(also%20called%20security%20scanners)%20to%20run%20unauthenticated%2Funauthorized%20scans%20against%20a%20target.%26nbsp%3B%20In%20this%20tutorial%2C%20you%20will%20run%20two%20web%20application%20vulnerability%20scans%20against%20the%20target%20web%20application%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3E%3CSTRONG%3EFirst%20scan%3C%2FSTRONG%3E%20will%20point%20to%20the%20target%20web%20application%20directly%3C%2FLI%3E%0A%3CUL%3E%0A%3CLI%3EURL%3A%20http%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%3C%2FDEPLOYMENT%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CLI%3E%3CSTRONG%3ESecond%20scan%3C%2FSTRONG%3E%20will%20point%20to%20the%20same%20target%20web%20application%20protected%20by%20Azure%20WAF%20on%20Application%20Gateway%3C%2FLI%3E%0A%3CUL%3E%0A%3CLI%3EURL%3A%20%3CA%20href%3D%22http%3A%2F%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttp%3A%2F%2Fjuiceshopthruwaf.com%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1496074238%22%20id%3D%22toc-hId-1496074234%22%3ERunning%20Web%20Application%20Vulnerability%20Scan%20against%20the%20Target%20Application%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20run%20the%20web%20application%20vulnerability%20scans%2C%20we%20will%20connect%20to%20the%20Kali%20VM%20with%20RDP.%26nbsp%3B%20Once%20connected%2C%20we%20will%20use%20%3CA%20href%3D%22https%3A%2F%2Fcirt.net%2FNikto2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSTRONG%3ENikto%3C%2FSTRONG%3E%3C%2FA%3E%2C%20a%20versatile%2C%20command%20line%20open%20source%20web%20application%20vulnerability%20scanning%20tool%20which%20is%20bundled%20in%20the%20Kali%20Linux%20distro.%20%26nbsp%3BWhen%20pointed%20to%20the%20target%20web%20application%2C%20Nikto%20will%20scan%20the%20application%20for%20common%20vulnerabilities%20and%20display%20the%20scan%20output%20in%20the%20terminal%20window%20for%20quick%20review.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ESign%20into%20the%20Kali%20Linux%20VM%20using%20your%20lab%20credentials%3C%2FLI%3E%0A%3CLI%3ELaunch%20the%20web%20browser%20and%20ensure%20that%20you%20are%20able%20to%20access%20the%20OWASP%20Juice%20Shop%20website%20directly%20with%20URL%20http%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%20and%20also%20through%20WAF%20with%20URL%20%3CA%20href%3D%22http%3A%2F%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttp%3A%2F%2Fjuiceshopthruwaf.com%3C%2FA%3E%3C%2FDEPLOYMENT%3E%3C%2FLI%3E%0A%3CLI%3ELaunch%20two%20instances%20of%20%3CSTRONG%3ENikto%3C%2FSTRONG%3E%20Web%20Vulnerability%20Scanner.%26nbsp%3B%20Click%20on%20%3CSTRONG%3EApplications%3C%2FSTRONG%3E%20on%20the%20top%20left%20and%20then%20click%20%3CSTRONG%3EWeb%20Application%20Analysis%20--%26gt%3B%20Web%20Vulnerability%20Scanners%20--%26gt%3B%20Nikto%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1609887818173.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244418i91B6B5066429C6E5%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1609887818173.png%22%20alt%3D%22Mohit_Kumar_0-1609887818173.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%224%22%3E%0A%3CLI%3ETo%20initiate%20the%20scans%2C%20utilize%20the%20following%20commands.%26nbsp%3B%20One%20in%20each%20of%20the%20open%20Nikto%20windows%3COL%20class%3D%22lia-list-style-type-lower-alpha%22%3E%0A%3CLI%3E%3CSTRONG%3Enikto%20-h%20http%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%3C%2FDEPLOYMENT%3E%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3Enikto%20-h%20%3CA%20href%3D%22http%3A%2F%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttp%3A%2F%2Fjuiceshopthruwaf.com%3C%2FA%3E%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%20class%3D%22lia-list-style-type-square%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3ETips%3C%2FSTRONG%3E%3C%2FFONT%3E%3CUL%20class%3D%22lia-list-style-type-disc%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3ETo%20display%20verbose%20output%20in%20Nikto%2C%20use%20the%20following%20command%3C%2FFONT%3E%3CBR%20%2F%3E%3CUL%20class%3D%22lia-list-style-type-circle%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3Enikto%20-h%20%26lt%3B%3CU%3Ehttp%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%3C%2FDEPLOYMENT%3E%3C%2FU%3E%26gt%3B%20-Display%20v%3C%2FFONT%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3ETo%20save%20Nikto%20output%20to%20a%20file%20to%20review%20later%2C%20use%20the%20following%20command%3C%2FFONT%3E%3CBR%20%2F%3E%3CUL%20class%3D%22lia-list-style-type-circle%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3Enikto%20-h%20%26lt%3B%3CU%3Ehttp%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%3C%2FDEPLOYMENT%3E%3C%2FU%3E%26gt%3B%20-Save%20.%2Fjuiceshopdirect.htm%26nbsp%3B%3C%2FFONT%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--311380225%22%20id%3D%22toc-hId--311380229%22%3E%3CFONT%20size%3D%223%22%3EReviewing%20Web%20Application%20Vulnerability%20Scan%20Results%3C%2FFONT%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20the%20scans%20finish%20running%2C%20we%20can%20quickly%20review%20the%20results%20by%20looking%20at%20the%20highlighted%20lines%20in%20the%20figures%20below.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EWhen%20going%20to%20the%20Juice%20Shop%20website%20directly%2C%20we%20see%20that%20the%20scanner%20sent%20%3CSTRONG%3E7k%2B%3C%2FSTRONG%3E%20%3CSTRONG%3Erequests%3CSUP%3E1%3C%2FSUP%3E%3C%2FSTRONG%3E%20to%20the%20web%20server%20and%20as%20a%20result%20found%20%3CSTRONG%3E2%20errors%3C%2FSTRONG%3E%20and%20%3CSTRONG%3E150%2B%20items%2Fissues%3C%2FSTRONG%3E%20which%20could%20then%20be%20used%20to%20develop%20further%20attack%20and%20exploitation%20scenarios%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3EFigure%201%20(Scan%20Start)%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1609888445044.png%22%20style%3D%22width%3A%20627px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244419i2BC879A6A6154E75%2Fimage-dimensions%2F627x395%3Fv%3D1.0%22%20width%3D%22627%22%20height%3D%22395%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1609888445044.png%22%20alt%3D%22Mohit_Kumar_0-1609888445044.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3EFigure%202%20(Scan%20End)%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_2-1609796992288.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244011i8E5E9A77D218B7FB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_2-1609796992288.png%22%20alt%3D%22Mohit_Kumar_2-1609796992288.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CFONT%20size%3D%222%22%3E%3CFONT%20color%3D%22%23FF0000%22%3E%3CSTRONG%3E!%3C%2FSTRONG%3E%3C%2FFONT%3E%3CSTRONG%3E%20IMPORTANT%3C%2FSTRONG%3E%3A%20%26nbsp%3BFor%20the%20scenarios%20demonstrated%20in%20this%20document%2C%20OWASP%20Juice%20Shop%20application%20was%20running%20on%20HTTP%20port%203000.%26nbsp%3B%20This%20is%20not%20the%20case%20when%20you%20use%20the%20Azure%20WAF%20Attack%20Testing%20Lab%20Deployment%20Template%20as%20it%20configures%20the%20application%20to%20run%20on%20port%2080%2C%20443%20and%20assigns%20it%20a%20URL.%26nbsp%3B%20For%20the%20lab%20tutorials%2C%20you%20will%20connect%20to%20the%20application%20on%20HTTP%20port%2080%20only.%26nbsp%3B%20The%20URL%20for%20the%20application%20will%20be%20http%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net.%26nbsp%3B%20%3CDEPLOYMENT%20guid%3D%22%22%3E%20is%20unique%20to%20every%20deployment%3C%2FDEPLOYMENT%3E%3C%2FDEPLOYMENT%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%222%22%3E%0A%3CLI%3EWhile%20scanning%20Juice%20Shop%20website%20through%20the%20Azure%20WAF%2C%20we%20see%20that%20the%20scanner%20made%20%3CSTRONG%3E%26gt%3B3x%20the%20number%20of%3C%2FSTRONG%3E%20%3CSTRONG%3Erequests%3CSUP%3E1%3C%2FSUP%3E%3C%2FSTRONG%3E%20when%20compared%20to%20scanning%20the%20website%20directly%20in%20Step%201%20and%20still%20it%20%3CSTRONG%3Edid%20not%20find%20any%20errors%3C%2FSTRONG%3E%20to%20report.%26nbsp%3B%20Similarly%2C%20this%20scan%20is%20only%20able%20to%20report%20%3CSTRONG%3E%26lt%3B1%25%20of%20the%20number%20of%20items%2Fissues%3C%2FSTRONG%3E%20for%20further%20investigation%20as%20compared%20to%20when%20scanning%20the%20website%20directly%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%20style%3D%22font-family%3A%20inherit%3B%22%3E%3CSUP%3E1%3C%2FSUP%3E%3C%2FSTRONG%3E%3CFONT%20size%3D%222%22%20style%3D%22font-family%3A%20inherit%3B%22%3E%20Request%20count%20for%20http%3A%2F%2Fowaspdirect-%3CDEPLOYMENT%20guid%3D%22%22%3E.azurewebsites.net%20taken%20from%20baseline%20of%20scans%20for%20comparison%3C%2FDEPLOYMENT%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1609888844466.png%22%20style%3D%22width%3A%20627px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244420i0358066759AB0C54%2Fimage-dimensions%2F627x394%3Fv%3D1.0%22%20width%3D%22627%22%20height%3D%22394%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1609888844466.png%22%20alt%3D%22Mohit_Kumar_0-1609888844466.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH4%20id%3D%22toc-hId-379181249%22%20id%3D%22toc-hId-379181245%22%3E%26nbsp%3B%3C%2FH4%3E%0A%3CH2%20id%3D%22toc-hId--2129337792%22%20id%3D%22toc-hId--2129337796%22%3EUnderstanding%20What%20Happened%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUpon%20reviewing%20the%20Nikto%20scan%20outputs%2C%20we%20see%20the%20pattern%20as%20shown%20in%20the%20below%20table.%26nbsp%3B%20This%20clearly%20indicates%20that%20when%20going%20through%20the%20Azure%20WAF%2C%20the%20scanner%20is%20not%20as%20effective%20in%20assessing%20the%20web%20application%20and%20identifying%20potential%20vulnerabilities.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20border%3D%221%22%20width%3D%2299.86187845303867%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2257px%22%3E%3CP%3E%3CSTRONG%3ERecon%20Scan%20Route%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2257px%22%3E%3CP%20class%3D%22lia-align-center%22%3E%3CSTRONG%3ENo.%20of%20Issues%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2257px%22%3E%3CP%3E%3CSTRONG%3ENo.%20of%20Items%20for%20Investigation%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%3E%3CP%3EDirect%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%20class%3D%22lia-align-center%22%3E%3CP%3E2%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%20class%3D%22lia-align-center%22%3E%3CP%3E167%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%3E%3CP%3EThrough%20WAF%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%20class%3D%22lia-align-center%22%3E%3CP%3E0%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2233.28729281767956%25%22%20height%3D%2230px%22%20class%3D%22lia-align-center%22%3E%3CP%3E3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20let%20us%20use%20the%20%3CA%20title%3D%22Azure%20Monitor%20Workbook%20for%20WAF%22%20href%3D%22http%3A%2F%2FAka.ms%2FAzWAFworkbook%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EAzure%20Monitor%20Workbook%20for%20WAF%3C%2FA%3E%20to%20understand%20how%20WAF%20handled%20traffic%20from%20the%20%3CSTRONG%3ENikto%20%3C%2FSTRONG%3Esecurity%20scanner.%26nbsp%3B%20This%20workbook%20visualizes%20security%20relevant%20WAF%20events%20across%20several%20filterable%20panels.%26nbsp%3B%20%3CEM%3EIt%20works%20with%20all%20WAF%20types%2C%20including%20Application%20Gateway%2C%20Front%20Door%2C%20and%20CDN%2C%20and%20can%20be%20filtered%20based%20on%20WAF%20type%20or%20a%20specific%20WAF%20instance.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20title%3D%22Deploy%20Azure%20Monitor%20Workbook%20for%20WAF%22%20href%3D%22https%3A%2F%2Faka.ms%2FWAFworkbookdeploy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EClick%20here%3C%2FA%3E%26nbsp%3Bto%20deploy%26nbsp%3B%3CSTRONG%3EAzure%20Monitor%20Workbook%20for%20WAF%3C%2FSTRONG%3E%26nbsp%3Bto%20your%20subscription%20in%20Azure.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%20class%3D%22lia-list-style-type-square%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3ETip%3C%2FSTRONG%3E%3A%26nbsp%3B%20To%20understand%20what%20is%20happening%20when%20scan%20traffic%20destined%20for%20the%20Juice%20Shop%20application%20goes%20through%20the%20Azure%20WAF%2C%20you%20can%20also%20examine%20the%20log%20entries%20associated%20with%20%3CSTRONG%3EApplicationGatewayFirewallLog%20%3C%2FSTRONG%3Ein%20the%3CSTRONG%3E%20Azure%20Monitor%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1438776318%22%20id%3D%22toc-hId--1438776322%22%3EReviewing%20WAF%20logs%20in%20the%20Workbook%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EYou%20can%20access%20the%20WAF%20workbook%20by%20going%20into%20the%20Workbook%20blade%20and%20then%20selecting%20the%20WAF%20workbook%20deployed%20for%20this%20lab.%26nbsp%3B%20Once%20in%20the%20workbook%2C%20ensure%20that%20you%20have%20selected%20the%20appropriate%20%3CSTRONG%3ETime%20Range%3C%2FSTRONG%3E%2C%20%3CSTRONG%3EWAF%20Type%20and%20WAF%20Items%20%3C%2FSTRONG%3Ein%20the%20event%20filters%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1610145342692.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244984i68DFC89B9DCDB226%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1610145342692.png%22%20alt%3D%22Mohit_Kumar_0-1610145342692.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%222%22%3E%0A%3CLI%3EYou%20should%20also%20ensure%20that%20you%20have%20selected%20the%20correct%20Public%20IP%20address%20for%20your%20attacker%20machine%20(Kali%20VM)%20in%20the%20%3CSTRONG%3ETop%2010%20Attacking%20IP%20Addresses%2C%3C%2FSTRONG%3E%3CSTRONG%3E%20filter%20to%20single%20IP%20address%20%3C%2FSTRONG%3Epane%3CSTRONG%3E.%20%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%20class%3D%22lia-list-style-type-square%22%3E%0A%3CLI%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3ETip%3C%2FSTRONG%3E%3A%26nbsp%3B%20If%20you%20are%20using%20the%20%3CSPAN%3EAzure%20WAF%20Attack%20Testing%20Lab%20Environment%20Deployment%20Template%3C%2FSPAN%3E%20and%20have%20followed%20the%20lab%20setup%20instructions%20then%20the%20client%20IP%20address%20will%20be%20the%20public%20IP%20address%20of%20the%20Azure%20Firewall%20in%20your%20demo%20environment%3C%2FFONT%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_1-1609889556104.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244422iFF4C8DBC9A66E9D1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_1-1609889556104.png%22%20alt%3D%22Mohit_Kumar_1-1609889556104.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%223%22%3E%0A%3CLI%3EAfter%20selecting%20the%20correct%20client%20IP%2C%20we%20scroll%20back%20up%20to%20the%20top%20of%20the%20Workbook%20and%20review%20the%20visualizations%20at%20the%20top%2C%20in%20the%20WAF%20Workbook.%26nbsp%3B%20The%20sections%20of%20the%20workbook%20we%20will%20be%20using%20here%20are%20highlighted%20with%20%3CSPAN%3Ealphabetized%26nbsp%3B%3C%2FSPAN%3Ecallouts%20in%20the%20below%20figure%2C%20we%20see%20that%20they%20map%20to%20the%20following%20sections%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3Ea.%20WAF%20actions%20filter%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3Eb.%20Top%2040%20Blocked%20Request%20URI%20addresses%2C%20filter%20to%20single%20URI%20address%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3Ec.%20Top%2050%20event%20trigger%2C%20filter%20by%20rule%20name%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3Ed.%20Message%2C%20full%20details%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1609963440098.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244600iC07B01CB2710FFFA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1609963440098.png%22%20alt%3D%22Mohit_Kumar_0-1609963440098.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorMohit_Kumar_2%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-353573036%22%20id%3D%22toc-hId-353573032%22%3EOverview%20of%20the%20Workbook%20sections%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20class%3D%22lia-list-style-type-lower-alpha%22%3E%0A%3CLI%3EStarting%20from%20the%20top%2C%20the%20%3CSTRONG%3EWAF%20actions%20filter%20%3C%2FSTRONG%3Eshows%20the%20number%20of%20matches%20and%20the%20blocked%20requests%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_3-1609797570523.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244021iB3265F9696090B44%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_3-1609797570523.png%22%20alt%3D%22Mohit_Kumar_3-1609797570523.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20class%3D%22lia-list-style-type-lower-alpha%22%20start%3D%222%22%3E%0A%3CLI%3EWe%20can%20then%20look%20at%20the%20%3CSTRONG%3ETop%2040%20Blocked%20Request%20URI%20addresses%2C%20filter%20to%20single%20URI%20address%20%3C%2FSTRONG%3Eto%20identify%20the%20top%20URIs%20for%20which%20requests%20were%20blocked%20by%20WAF%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_4-1609797610173.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244022i47A3A89DC0C3673D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_4-1609797610173.png%22%20alt%3D%22Mohit_Kumar_4-1609797610173.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20class%3D%22lia-list-style-type-lower-alpha%22%20start%3D%223%22%3E%0A%3CLI%3EThe%20%3CSTRONG%3ETop%2050%20event%20trigger%2C%20filter%20by%20rule%20name%20%3C%2FSTRONG%3Eshows%20all%20the%20rules%20which%20evaluated%20the%20scanner%20traffic%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_5-1609797663262.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244023iBF0DD58B23B1C549%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_5-1609797663262.png%22%20alt%3D%22Mohit_Kumar_5-1609797663262.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EThe%20below%20table%20shows%20an%20extract%20of%20the%20%3CSTRONG%3ETop%2050%20event%20trigger%2C%20filter%20by%20rule%20name%20%3C%2FSTRONG%3Eoutput%20for%20scanner%20traffic.%26nbsp%3B%20This%20data%20clearly%20shows%20that%20WAF%20was%20able%20to%20detect%20the%20security%20scanner%20and%20blocked%20suspicious%20requests%2Fpayloads%20from%20the%20Nikto%20Scanner.%26nbsp%3B%20This%20is%20expected%20because%20a%20security%20scanner%20will%20attempt%20to%20perform%20various%20types%20of%20operations%20to%20test%20security%20of%20the%20web%20application%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3E%3CSTRONG%3ERule%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E%3CSTRONG%3Ecount_%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EFound%20User-Agent%20associated%20with%20security%20scanner%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E8906%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ERequest%20Missing%20an%20Accept%20Header%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E8906%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EGET%20or%20HEAD%20Request%20with%20Body%20Content.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E8860%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ENode-Validator%20Blacklist%20Keywords%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E4553%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ESQL%20Injection%20Attack%3A%20Common%20Injection%20Testing%20Detected%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E3354%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EFound%20request%20filename%2Fargument%20associated%20with%20security%20scanner%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E2422%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EPossible%20Remote%20File%20Inclusion%20(RFI)%20Attack%3A%20Off-Domain%20Reference%2FLink%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E2418%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2257px%22%3E%3CP%3EPossible%20Remote%20File%20Inclusion%20(RFI)%20Attack%3A%20URL%20Payload%20Used%20w%2FTrailing%20Question%20Mark%20Character%20(%3F)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2257px%22%3E%3CP%3E2355%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EDetects%20basic%20SQL%20authentication%20bypass%20attempts%202%2F3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E2249%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EDetects%20MySQL%20comments%2C%20conditions%20and%20ch(a)r%20injections%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E2233%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EPath%20Traversal%20Attack%20(%2F..%2F)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E1698%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EOS%20File%20Access%20Attempt%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E699%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ERemote%20Command%20Execution%3A%20Unix%20Shell%20Code%20Found%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E682%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EXSS%20Attack%20Detected%20via%20libinjection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E667%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ESQL%20Injection%20Attack%3A%20SQL%20Tautology%20Detected.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E641%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EPossible%20XSS%20Attack%20Detected%20-%20HTML%20Tag%20Handler%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E616%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EXSS%20Filter%20-%20Category%201%3A%20Script%20Tag%20Vector%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E616%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ENoScript%20XSS%20InjectionChecker%3A%20HTML%20Injection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E616%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EDetects%20classic%20SQL%20injection%20probings%202%2F3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E455%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EInvalid%20character%20in%20request%20(non%20printable%20characters)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E342%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EInvalid%20character%20in%20request%20(null%20character)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E340%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ESQL%20Injection%20Attack%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E272%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ERemote%20Command%20Execution%3A%20Unix%20Command%20Injection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E199%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ESQL%20Comment%20Sequence%20Detected.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E197%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EURL%20file%20extension%20is%20restricted%20by%20policy%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E192%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ERestricted%20File%20Access%20Attempt%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E178%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3ESQL%20Hex%20Encoding%20Identified%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E147%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2257px%22%3E%3CP%3EPossible%20Remote%20File%20Inclusion%20(RFI)%20Attack%3A%20Common%20RFI%20Vulnerable%20Parameter%20Name%20used%20w%2FURL%20Payload%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2257px%22%3E%3CP%3E136%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22597px%22%20height%3D%2230px%22%3E%3CP%3EPHP%20Injection%20Attack%3A%20High-Risk%20PHP%20Function%20Call%20Found%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22126px%22%20height%3D%2230px%22%3E%3CP%3E128%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20class%3D%22lia-list-style-type-lower-alpha%22%20start%3D%224%22%3E%0A%3CLI%3EReview%20further%20details%20in%20the%20%3CSTRONG%3EMessage%2C%20full%20details%20%3C%2FSTRONG%3Esection%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1609890153348.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244426i3C23069AC845EB5A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1609890153348.png%22%20alt%3D%22Mohit_Kumar_0-1609890153348.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1582964146%22%20id%3D%22toc-hId--1582964150%22%3EKey%20Takeaway%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUsing%20security%20scanners%20to%20perform%20web%20application%20vulnerability%20assessment%20scans%20to%20expose%20vulnerabilities%20in%20a%20target%20web%20application%20is%20a%20common%20technique%20used%20by%20attackers.%26nbsp%3B%20When%20external%20adversaries%20can%20perform%20these%20scans%20against%20your%20web%20applications%2C%20they%20are%20able%20to%20learn%20about%20your%20application%20design%20and%20its%20vulnerabilities%20which%20could%20potentially%20lead%20to%20exploitation.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EFor%20web%20applications%20secured%20with%20it%2C%20Azure%20WAF%20can%20detect%20and%20protect%20against%20reconnaissance%20attacks%20executed%20with%20security%20scanners%20at%20the%20network%20edge%2C%20with%20its%20out%20of%20the%20box%20ruleset.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20border%3D%221%22%20width%3D%22100%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CH4%20id%3D%22toc-hId-1162714125%22%20id%3D%22toc-hId-1162714121%22%3EPrevious%3A%26nbsp%3B%3CA%20title%3D%22Setup%20an%20Azure%20WAF%20Attack%20Testing%20Lab%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-network-security%2Fpart-1-lab-setup-azure-web-application-firewall-security%2Fba-p%2F2030469%22%20target%3D%22_blank%22%3ESetup%20an%20Azure%20WAF%20Attack%20Testing%20Lab%3C%2FA%3E%26nbsp%3B%3C%2FH4%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CH4%20id%3D%22toc-hId--644740338%22%20id%3D%22toc-hId--644740342%22%3ENext%3A%26nbsp%3B%3CA%20title%3D%22Vulnerability%20Exploitation%20Playbook%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-network-security%2Fpart-3-vulnerability-exploitation-playbook-azure-waf-security%2Fba-p%2F2031047%22%20target%3D%22_blank%22%3EVulnerability%20Exploitation%20Playbook%3C%2FA%3E%3C%2FH4%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CH4%20id%3D%22toc-hId-1842772495%22%20id%3D%22toc-hId-1842772491%22%3E%26nbsp%3B%3C%2FH4%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2030751%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20lab%20tutorial%20shows%20how%20to%20test%20Azure%20WAF's%20protections%20against%20and%20detections%20for%26nbsp%3Breconnaissance%20attacks.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mohit_Kumar_0-1610673966282.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F246502iA71C0D00EA084112%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Mohit_Kumar_0-1610673966282.png%22%20alt%3D%22Mohit_Kumar_0-1610673966282.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2030751%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Application%20Gateway%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20WAF%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Jan 14 2021 06:00 PM
Updated by:
www.000webhost.com