Hello everyone.
My name is Steven.
In this section, you will learn about the crucial topic of detecting web application firewalls and
intrusion prevention systems.
IPS So I will guide you through the process of using Nmap, a powerful network scanning tool to identify
these packet filtering systems and understand their significance in safeguarding web servers.
Through the practical examples and explanations, you will gain insights into how web application firewalls
and IPS, the intrusion prevention systems work and their importance in enhancing network security.
So prepare to expand your knowledge and sharpen your skills in this section.
In the dynamic landscape of Web security, organizations employ various measures to protect their applications
from potential threats.
Among these defenses, Web application firewalls and intrusion prevention systems play a vital role
in fortifying network security.
This packet.
Filtering server systems serve as a vigilant guardians, scrutinizing incoming and outgoing web traffic
and forwarding suspected malicious packets.
So for web penetration testers, it becomes essential to identify the presence of such traffic filtering
systems, to evaluate their effectiveness and uncover potential vulnerabilities that may be missed otherwise.
In this comprehensive lecture, we will explore the significance of web application firewalls and intrusion
prevention systems, understanding their inner workings, and discover how to leverage Nmap and a powerful
network scanning tool to detect and analyze these guardians.
Now let's get started with understanding the web application firewalls and intrusion prevention systems
with application firewalls and intrusion prevention systems are indispensable components of modern network
security.
Web application firewalls serve as a protective shield between VR applications and potential threats
and intercepting and analyzing incoming Http requests.
They employ sophisticated rule sets and heuristics to identify and block suspicious or malicious traffic.
IPS On the other hand, intrusion prevention systems monitor network traffic at the packet level, inspecting
data packets in real time to identify and prevent security breaches and attacks.
This is the layer one, layer two, layer three and layer four byte level, right?
So IPS here.
And web application firewalls.
So both Web application firewalls and IPS contribute to the layered defense strategy, providing enhanced
security and mitigating risks associated with web based attacks and the importance of detecting wearables.
Of web application firewalls and intrusion prevention systems for for example, for web penetration
testers.
Detecting the presence of web application firewalls and intrusion prevention systems is a paramount
importance.
Knowing the existence of traffic filtering systems enables testers to strategize and employ more advanced
and stealthy techniques to bypass these defenses by accurately identifying the web application, firewalls
and intrusion prevention systems in place.
Testers can gain insights into its behavior rulesets and limitations.
This knowledge empowers testers to devise effective penetration strategies, ensuring through that security
assessments and aiding organizations in fortifying their web applications against potential attacks.
Now we will go to Linux machine again.
To get more practical in this lecture.
So here I have opened my Linux machine now to detect the web application firewalls and IPS.
Effectively, we can utilize Nmap, a versatile network scanning tool.
So here first we will use sudo here Nmap SV Now we will use a two scripts.
Actually the first script is going to be Http WEF detect, and after that we need to get that web application
firewalls, fingerprint write, detect and Http.
WEF and fingerprint.
And here we have.
After that we need to provide target for our nmap to scan in this case on console.com.
I installed the firewall.
Now let's press enter and start the scanning.
Enter your password.
That's it.
And here we have.
Yes, we had the one alphabetical error here, the text here.
That's it.
And now we will you can use the arrow keys to show the results here.
Upon executing the command, Nmap will perform a series of tests to identify the presence of packet
filtering systems.
The output will indicate whether a web application firewall or intrusion prevention system has been
detected.
And here we let's start from the beginning and here we have the service detection here.
It's port 21, port 26, port 53, and Port 80 is open here and we have the outputs for each http server
header.
The http server header is lightspeed.
Uh, the fingerprint shrinks in a status request, TCP DNS version by TCP and so on.
We have content-length.
And after that your browser send an individual request and we got the 400 bad request because it has
the.
Firewall here.
As you can see here we have the IDs, IPS Web application firewall is detected.
And here we are now we have the results of the application firewall detect.
And this is the here.
Now we have again the fingerprint strings again.
And at the top of it, we have the.
HDP web application firewall detected.
And after that, we have that service fingerprint.
And the next service fingerprint as well.
And here, by analyzing the responses and product identification, testers gain crucial insights into
the defensive mechanisms of our target.
So understanding let's understand the first detection mechanisms here.
So detection process leverages two Nmap options.
Let's actually go to top here the pseudo SV script http detect here and you should be the fingerprint,
right?
So these options initiate the Http WAF, detect and Http fingerprint and C scripts respectively on any
identified web servers.
So this web application firewall detect script developed to identify web application firewalls and intrusion
prevention systems and analyzes the responses to Http requests containing attack pilots.
Right?
So by comparing the status codes and page bodies of Save Http get requests with those containing malicious
payloads, the script detects alterations triggered by packet filtering systems, so this approach is
effective as the web application rarely uses the random parameter names assigned to malicious payloads,
causing only the packet filtering systems to react and modify the return status code such as Http status
code 403 Forbidden or page content.
Furthermore, the Http detect script employs a fingerprint database which recognizes a special headers
and cookies in the response, and this database aids in identifying specific products such as improving
Incapsula, Cloudflare, USB and so on.
Also more secure and and this allows testers to gain insights into the underlying WAF detection and
technology.
So in hand, let's we can also enhance the fingerprint detection of our intrusion prevention system
and web application firewalls to refine the detection process and increase the accuracy of web application
firewall fingerprinting.
Nmap also provides additional options.
Let's try that out.
So.
We can detect the changes here.
We can detect changes.
With http vif.
The text that detects the body changes argument.
And with that we can detect alterations in the responses body.
Particularly useful for with minimal dynamic content.
So this can be done using the pseudo pseudo nmap sv here.
After that we will enter the script again.
Script and http http vaf detect and we will add script arguments.
So script arguments and here http vaf detect dot detect.
Body.
Chains.
And after that you will enter your uncoated, and after that you will enter your target.
In this case, it's going to be called sally.com.
Our target machine that I created, our target website that I created, it's online not on not working
on localhost, it's just online.
Just you can enter this website any time.
And I installed a firewall Cloudflare firewall into this console.com.
And I also installed some plugins in the WordPress here.
Now we can detect this now about 404.67% is done and so on.
Now I will stop the video here and I will start again when the scanning completes.
And here we got the output here.
Now let's check it from the beginning.
That's it.
Now we have the Http server header is lightspeed.
Again, we have the same information because of the script that we used as parameter.
And here we have the Pop3 de IPS firewall detected and here payload script alert document script, and
we have the Lightspeed again.
It was forbidden by administrative rules.
This is a fingerprint.
And so on.
So we can also generate a noisy attack payload.
So in order to do that, the Http web application firewall detect Aguero script arguments triggers the
use of more aggressive attack payloads, leading to responses from a broader range of products.
So this method generates more Http requests but can provide valuable insights into different defensive
mechanisms.
So but firstly, let's actually, I have the Metasploitable system on my computer here.
And now let's try that on our vulnerable system, on our localhost.
It will be pretty quick because it's on my localhost and we don't have to wait any.
Minutes or seconds and we already have the output here.
We have service info.
Metasploitable.
Local domain IRC metasploitable LAN operating system is Unix linux and here in this works on Linux kernel,
we have the open ports.
As you know, if you use the metasploitable before there's a lot of open ports going on here and here
we have RPC info, the open rpc bind, bind and Http server header and so on.
So now let's check that if it has the.
Firewall built on which it isn't.
And here.
As you see here, our server here is a patch ubuntu.
And signs it didn't detect that any.
Firewalls installed on this target.
It didn't show us here.
And service detection performed and so on.
That's it.
Now we will do intensive fingerprint.
But before, of course, as I said, we need to do the noisy attack payloads.
In order to do that, we will write SV http web.
Web application firewall detect and we will delete the script arguments and write again.
Script arguments http WCF detect dot agg arrow and after that we will enter the website and that's it.
And here.
As you can see, because of its aggressive it actually writes a pretty fast.
Because.
Male It doesn't care about catching by firewalls or.
In a kind of forbidden.
Payloads.
And it's almost done.
Just the 2% left almost.
1% left.
And here it's almost done.
Now we have this here under undergoing script scan.
That's it.
And we have a lot of information here.
This is our output.
We have not shown the 989 filter TCP ports because of the no response.
And here we have the TCP wrapped.
So service detection is performed and that's it.
So we can increase the number of probes performed by the singer fingerprint script with that and the
resulting in more detailed analysis.
And in conclusion, the application of firewalls, the WAFs and intrusion prevention systems, IPS are
critical for components of network security, safeguarding web applications against potential threats.
So detecting the presence of these traffic filtering systems is essential for penetration testers,
enabling them to assess the effectiveness of.
Or assess the effectiveness of defences, uncover hidden vulnerabilities.
So with the aid of Nmap and specialized scripts, testers can accurately detect the application firewalls,
gain insights into their behaviour and tailor their attack methodologies accordingly.
By unravelling the secrets behind these guardians, testers can ensure robust security evaluations and
assist organisations in fortifying their web applications against potential attacks.
Understanding the inner workings of the web application, firewalls and IPS is vital in the ongoing
battle against web based threats, reinforcing the need for proactive security measures in today's interconnected
world.