Here and welcome back.
Now in today's we will be discussing about a W.S. Web application firewall, not the entire concept
related to the IWC that can be explained in this specific diagram.
So let's do one thing.
Let's take a simple example that would allow us to understand the concept in much more easier.
So let's assume that I live in a place in Bangalore and I want to meet my friend living in Place B in
Bangalore.
Now, for those who are in Bangalore is one of the popular cities in terms of traffic congestion, there
is huge amount of traffic.
So before I actually decide to visit my friend, there are certain conditions before that so that conditions
are part of the rule statement.
So the conditions state if traffic is less on the road as well as there is a second condition, which
states that are there any other other elements or basically are there any gaps which are available?
So these conditions are basically associated with the rule statement.
The next one is rules.
So rules basically allow us to perform certain operations on the conditions.
So it states that if the traffic is less and overall less available, then yes or no.
So if both of these conditions are met, then should I be going to visit my friend?
Is it.
Yes.
Or is it going to be.
No.
So you have an area you can also have or you can also have not.
Then the third thing is the webcam webcam.
You can consider it to be container for all the things.
So the rules statement that you define the rules that you define, everything fits under the regulation
and also you can assign a default.
I think that will be discussing at a later stage.
And the last one is the association, your association, a Z.
That basically means that the rules, statements and the rules that we have defined, these are associated
with which entity is Z or is it any other user.
So that is what association meets green.
So now let's do one thing.
Let's go ahead and discuss each one of these in technical terms.
So the first one that we need to understand is rules, statements, and this is very important.
So rude statements basically defines the basic characteristics based on which your request packet would
be analyzed.
So there can be custom defined as well as you can use certain ready-Made group statements from Idalis
as well as marketplace.
So these are the two separate rule statements.
The first one is block all the requests which are coming from out of anger.
So maybe there is a website where all the customers would be from India only.
So in such cases, you can have a rule where any any time a request comes from a user who is out of
India, then the request can be blocked or certain actions can be performed.
Second sample rule statement is block requests, which has a you are a part of admin generally whenever
you have a WordPress or any other websites which has an admin panel.
One of the common scenarios that you will see as part of the attacks is that the attacker tries to log
in to the admin page.
This is one of the first thing that they query.
So this is something that you can also block.
Now, these are certain sample conditions that I had either.
However, you can build your own custom conditions here, like you can create conditions based on header,
based on HDB method, the query strings that you report, the geolocation, the body and so on.
So all of these things can be configured in a rule statement.
The second important part here is the rules.
So you can combine multiple rule statements into rules to precisely target the request that is coming
to your Web application.
Now, there are two primary rule types.
One is the regular rule and second is the rate base rule.
So first, let's look at two sample regular rule.
So it states that if a request comes from 172 rototiller Gerarda 50 and there is a second rule statement
here, which states that request has a school like code typically related to the school injection attacks.
So these are the two rule statements and the rule with multiple statements can be and or not.
So when you create a rule force, you include statements here and then you can decide whether you want
to perform an operation.
So if a request comes from once every to 30 feet and it has a school like code or you can perform oral
operation, then any one of the conditions is to make the rules apply.
So that is what this rule means.
Now, you can also perform the operations here.
So if the rule applies, whether the action should be blocked or action should be allowed or it could
be called.
So that is part of the rules.
You also have read based rule where you have a rate limiting feature.
So if a request comes from a specific IP and if request exceeds thousand requests in ten minutes, so
this is a simple rate based rules that you can add.
So the third one here is the webcam.
So there is a centralized place that contains the rules, rule statements and its associated configurations.
Now it is used to define the oral protection strategy associated with Mervat.
And the last one here is the Association.
So Association defines to which entity that is associated with.
So one important thing to remember is that a value cannot be associated with these two instances directly.
So there are three separate associations here.
One is the application load balancer.
You have the cloud print and you have the API.
You're doing great.
So that's the overview about some of the important components of that.
Let's take a quick demo so that this later becomes better understood.
So this is the idea of that.
And so let's go to babka.
And currently you will see that I have one here which is created.
So let's open this up.
So within my baby, basically, you will see that there are certain requests in a graph.
So this is a nice little graph that you can quickly looking.
Now, this graph has multiple requests based on certain rules.
So there are rules like allow India IP.
Then you have query string baseball.
Then you have the establishment rule associated with sequel injection and so on.
So based on the rules, the color associated with this graph also changes.
Now, along with that, you also have certain sample requests which would be coming towards the application
load balance or whichever association that you have configure.
Now, let's look into the rules for you're currently you see that this that has in.
Total of four rules which are associated with it and this specific that this is named because it is
associated with the application load balancer, coalesce my hyphen elby So that basically means that
any request which comes to this load balancer that will analyze that request first, it will apply the
action according to the things that has been configured.
So let's look into some simple rules here.
So the first rule that you see is allow in the IP.
So this is basically the rule name.
Now, as we are discussing, rule basically contains rules, statements.
And on top of that, you perform certain operations like and or not, and then you perform certain actions
whether you are to allow or block.
So in a similar way, let's go ahead and explore this.
I go to Adekoya.
So you see the rule name is allow in the IP.
And there is a condition here which states that if a request does not match the statement.
So you can see if it matches the statement, if it matches all the statement, if it matches at least
one of the statements.
So you have and you have or you have not, and then you have the actual statement.
So this is basically the rule statement.
So the rule statements your states that if the request originates from a country in India.
So this is the rule statement and you have a not audio and the action here is blocked.
So that basically means that any request which is coming to this application load balancer, which is
not in this country, India.
So if that request is not originating from India, then the action of block is applied.
So that is what this specific rule denotes.
So let's do one thing.
Let's try it out.
So first, let's compete against him and from the claim.
Let me quickly do a call on the DNA steamier.
And as expected, you are getting a result or you know, the result is coming primarily because I am
located from India.
So now let's do something.
Let's quickly connect the weapon to another country and we'll run the same way.
So generally for my personal use, I make use of cyber ghost VPN, which is quite good.
Let's quickly connected so it will you IP address from United States.
All right, so it took around a few seconds, and if you see this is the specific IP which I have received.
So now going back to the let's go ahead, try call again.
I know you immediately got a four zero three four billion error, primarily because the IP address from
which this request has been originating is not from the India.
So that has blocked the request grid.
So let's go ahead and disconnected.
Great.
So it's disconnected.
Let's go back to the basic.
And from here, we'll go to the rules, so we have explored one goal, so this rule is basically you
can consider it to be a geolocation based one.
Then the second rule, it is basically a query string rule.
Let's also explore this.
So now we already know that rule contains rule statements.
It contains the condition like and or not.
And it also contains the actions.
So let's go ahead and explore this rule.
That is the query string rule.
And within this rule, you will see you're here inspecting a query string.
So a rule statement can be something from these below options.
So you have originating from a country in or originating from IP address so you can define a country
you can define based on IP address.
Then the components that we were discussing like header, the query parameter, you are a part query
string and so on.
So what this statement states that if there is a query string which contains admen, then the action
should be blocked over here.
So let's try.
Now, before we do that, let's verify if things are working and as expected, things are working.
You know, you can create a quick query stream which contains admin within the request.
And again, as expected, you will see that you immediately got out for 034 billion.
Now, if you use any other keyword, let's say at least the response is perfectly well.
However, whenever you have this specific query stream within the request, the response would be four
zero three three.
So I hope at a high level or you you understood the components associated with that.
So again, let's quickly relate.
So you have a webcam.
Webcam is associated with association rules and rules statements.
Rule statements are the one where we actually define what conditions based on which the request should
be.
Any length that Google statements are part of rules where you can combine multiple rule statements with
and not all, and then you associate the webcam with the application load balancer, a cloud from distribution
or API doing great.
So that's the high level overview about it that I hope this video has been informative for you.
And I look forward to seeing the next video.