How do you.
And welcome back.
So today's video is going to be an exciting one because we are going to implement the this Web application
fadeaway from scratch.
So with this, let's get started.
So currently I am in the easy to cancel from these services here.
Let's go ahead and open up Dove App Service in a new tab.
So this is how the Web console really looks like and what we are interested in.
We are interested in to create the new web, see it.
So you can either created from here or on the left hand side.
You can open up the web earlier and you can basically create a baby seal from it.
Now, again, one important thing to note is that in some of the services, you cannot directly select
the region from here.
You'll have a dropdown, something similar to this where you can go ahead and select the region accordingly.
So if you see the easy to cancel, currently it is based on this old region.
So let's go ahead and select the same region, audio soil.
Select this your region yet?
Great.
And Virginia, let's go ahead and create our first Web ACL within the name.
Let's call it the Escape Labs Web ACL.
And if you look into the resource type, you either have a cloud trend distribution, which you can
select, which is basically a global resource, or you can select regional resources.
So in regional resources, you have application load balancer, EPA Gateway as well as App Sync, which
are supported.
So what we need to do in order for us to create a web scale and to test out the rules, we need one
of these resources to be running.
So among this, what will be using will be creating a application load balancer for our testing purposes.
So from the easy to console, let's go to the load balancer and let's go ahead and create a new load
balancer.
So there are multiple types of load balances that are available.
We are interested in the application load balancer, the one that you see.
Horia will go ahead and create a new application.
Load Balancer.
Let those qualities keep Labs Haven LP.
The scheme here would be in then increasing will be selecting some of the availability zones here.
Two of them basically.
And basically it is also showing you that there is a default security group that will be associated
with the LP.
That is fine.
The important part is related to listener's end routing, where you'll have to basically create a new
target group.
So let's go ahead and quickly create a new target group.
Otherwise, basically, this will not allow us to proceed.
So will not be doing much in the target group.
Let's just select the IP address here.
Let's do our next highlight.
We have to give it a name.
Let's call it Escapee Labs Haven, BG.
We'll do a next.
And within here you can just specify any random internal liability.
One 7231 0.5 It necessarily does not need to be associated with the easy two instance, primarily because
we will not be using this year.
Once you add IP, you can just include this and once then you can go ahead and create the target group.
Now do not at this stage, I mean, aim is to learn that we are not really looking in detail about the
application load balancer you.
So once you have done it, you can quickly refresh.
You can select the target group here and you can create the load balancer, all of it.
So once the load balancer is created, basically load balancer will go ahead and send a request to a
specific entity.
Now we'll keep it simple.
We do not really want load balancer to for order request to see two instance and so on.
Instead, what will be doing will go ahead and return a fix of this once.
So basically, what does that mean?
It means that whenever someone open up the load balancer you are in.
So this is basically the load balancer you are in whenever someone opens it up that it should be a fix
response that take it.
So let's go ahead and do that.
So for the listeners, let's go ahead and quickly edit the rules here.
Let's do it and will remove the one that you see over here.
And list click click select return fix response.
And in the fixed response, I'll say to undo.
And in that response body, you can give any message.
I say, hey from Zeid, I think will also include the happy smiley ones.
Then we can go ahead and update this.
So basically what will happen whenever someone visits the URL of the load balancer?
This specific fix a response will be sent back to the user both in grid.
So it has.
Been around 2 minutes and application load balancer is up and running.
So in order to verify that things had working, let's open up the earlier and from a newer tab.
I'll add the DNS here and currently, if you'll see, we're not really getting any response primarily
because of the security group.
So basically a default security group was associated with their application load balancer.
So what we need, we need to allow Port 80 on that security group.
So let's quickly verify if we look into the main modules audit, there is no inbound modules.
So let's quickly add in manually here.
I'll save booted and we'll say 0000 or they will do a save.
Perfect.
And you see, we are getting our fix response here.
Great.
So going back to the Afghan Zulu warrior.
You can go ahead and click on Add a source.
Currently you do not even have the phrase, but an.
Maybe that would help in case if there is a new update.
So let's go ahead and try loading some another region yet so that the explicit refresh happens and yet
even our name vendor anyways.
So let's go back to the C all region.
Let's give it a name.
Let's say keep labs very busy L and this time let's do a added resource will select the application
load balancer warrior.
Let's do a next.
And this is where the magic really happens.
So this is where you can go ahead and create rules in that.
Now, when you go ahead and click on add routes here, there are two options.
First one is add manage rules, and second one is add my own rules and rule group.
So this is where you can go ahead and create your custom rules.
So let's go ahead and understand creating custom rules for this.
So I'll go ahead and select the second option here.
And within here you can go ahead and create things accordingly.
So let's create a new rule.
I I'll set your location rule and you'll see that there are two rules.
First one is a regular rule.
Second one is read to be a rule.
If you select a read business, basically it creates a read limit.
So what is a read limit?
Direct clearly states that it is a maximum number of requests from a single IP address that is allowed
in a five minute period.
So that eight limit is something that we are not interested right now.
Let's go ahead and use it regular within the regular rule.
Under the statement you see, you can create rule based on a lot of components.
The one that we're interested since we are working on a geolocation based rule is originate from a country.
So let's see.
And in the country gold, you can just provide your country code, the one where you are currently living
in.
So currently I'm in Dubai for a project.
So I just give United Arab Emirates.
Alright, so this is the country and yet you have if the request matches this statement.
Now if you'll open it, you have a and or not.
So let's see if I select not.
So that basically means that if any request that does not match this statement.
And what is this?
The statement statement is originating from United Arab Emirates.
So if a user is coming from any other country apart from the UAE, what do you want to do with it?
And what we want is something that is defined in the action.
Whether you want to allow.
You want to block.
You want to count that request or you want to add a CAPTCHA.
So I'll say I want to block that request.
So what this will do just to do it, this is a geolocation rule.
So any request that does not originate from this country of United Arab Emirates will be blocked.
So I'll go ahead.
And I do welfare.
So you see that one rule is currently added.
Now along with this, you will see one more thing which is VIB equal rule capacity unit used.
So basically the total capacity unit that you can have for a web scale cannot exceed 1500.
So this specific rule that we have added has a capacity unit of one.
So now let's go ahead and add one more rule to keep things more exciting.
All right.
So within here, under this statement, let's go ahead and specify that you are right.
But and this time, let's say, contains string.
I'll say I demand an eight.
So any request that goes to this, you are a part of admin.
What do we want yet?
We want to either block it.
We want to count it, we want to contain it or we want to allow it.
So let's go ahead and use block audio.
Now, before we try this out, let me quickly show you how it looks.
So we will basically add admin to edit.
You see, we're basically getting a fix at this point.
So what we want, we want to block it.
And I like to do whoops, we forgot to give it a name.
Let this call it as you are, a bad rule and an ideal ball effect.
So now there are two rules there.
Now, if you look into the capacity unit total of 11, W Q is completed and the next part is the default
action.
So basically any request that does not match any of these rules, what do you want of that request?
So that request will set it to allow because both of the rules are in the blocking state.
So I'll do a next.
I'll do a next, I'll do a next.
It will give you a review screen and we'll go ahead.
And Greta, there we see it.
Great.
So it basically states that we have successfully created out of ABC.
So now the next thing that we want to do is we want to test if it really works.
So the best to me is to test it.
We had to select.
So let me go ahead and copy the DNS name of our load balancer.
Now from this here, let's do a good I'll add the DNS name and we should get hey from zeal.
So this is working perfectly as expected.
Now the next thing, let's verify if we're able to open up the admin page and immediately you see we
are getting a4034.
We then edit as expected.
So this part is being blocked over half limit.
Now how do we verify if a geolocation is really working or not?
Because we have already allowed it from our own country.
So let's try it out.
So what you can do in Google, you can basically type online Google and there are multiple websites
that are available.
One of the good ones that I've seen is this attic bin.
So you can just open this up and within you can just specify your call.
Come on.
So I'll circle followed by their DNS name.
Now this website is not based in UAE, so you should be able to see a4034 with an edit if ideal location
rule is working.
So you see we are basically getting a4034 brilliant error because the request is not coming from the
UAE country.
Perfect.
So I hope at this stage you understood the basics on what it is that allows you to do.
Now, when we open our website, you'll basically see some request.
Let me quickly show you.
So you see there are some sample requests.
One of the requests basically you see this is the one that was coming from this website.
So this is the source API and it basically also shows it action.
So the action associated was a block and there was one more request that we had made over here on the
admin page.
And again, the action was blocked.
So this is one of the great ways if you want to quickly identify what are the requests that are getting
blocked.
So this is one approach.
The second thing that I wanted to show you was the place manager who says we're discussing there were
two rules.
First one is the managed rules.
Second one is way we can go ahead and create our own custom rules.
So let's go ahead and select the manage rules for you.
And if you will see that a lot of manage rules, sets that are available know some of the rules.
It's a really great because you no longer have to write the rules from scratch.
So if you look into the IWC managed rule group, so here you have a B rule group, you also have a free
rule group here and if you go big down, some of them are very interesting.
Like you have a rule group associated with WordPress application, sequel database, etc. So let's do
one thing.
Let's use the one associated with sequel database.
So if you'll see what it does, it basically contains rules to block the request patterns which are
basically related to sequel database exploitation, like the sequel injection and so on.
So this seems to be an exciting one.
We can go ahead and add it to our web ACL.
Correct?
Once you have done that, you can go ahead and add the rule.
Let's do a save.
Great.
So now we have three rules that are available.
One among them is the managed rule.
So let's go ahead and verify if our managed rule really works.
So from this year, let's go ahead.
And basically, instead of this will add a new user which basically contains the sequel related parameters
already.
So let's see if our managed rule really works or not.
So you see immediately it states for zero three, four two we didn't and basically this is blocked add
up manage rule level.
So this is again quite useful specifically if you're getting sequel indexing really.
This is something that can really help you.
So if I quickly go to overview over here and if you will see this is basically you are and it is blocked
area you see it it comes as part of the sequel rules or idea.
Great.
So I hope with this you understood the basics of vibration.
Now a few more things I wanted to show you.
To keep things a little more exciting is that you can also let us or one of the other part rule ones.
Let's quickly edit it.
And instead of blocking, you can even add a capture.
Would you like it?
So let's do a save rule.
How elusive.
Great.
So let's do a control essay on this piece, which is basically going to determine the idea.
And immediately now you see you are basically getting a CAPTCHA.
So let's go ahead and quickly try to solve it.
So this is interesting CAPTCHA would it.
So what it states like this image to complete the queue.
So basically you have to slide this image and we have to ensure that we get this cuboid here.
So let's go ahead and slide it a little bit.
I hope this is the queue.
Let's do a submit.
And yes, it is a success.
So once this is a success, you will basically get whatever response that this admin page's allowed
you to give.
So this is one part.
Second interesting thing that you can also do about that is you can have a custom response body.
So if you will see, we're you're getting a little boring, four, zero, three, four bit.
And so in case if you want to go ahead and customize this, you can create a custom response body as
well.
Let me quickly show you let's call it as scape labs custom response.
And in the content type, let us see plain text and we'll see.
Zeal is watching you.
Okay, let's do a save.
Great.
So now let's go back to the rules here.
Let's open up the geolocation rule.
This thing will, Gordon added.
And within the if you'll see under the action, you have a custom response, which is optional.
You can select this, you can go ahead and enable it.
And within it, you can select the key epilepticus, the response that we have obtained, which has
this specific response body and a response code.
You can just give it as for zero three and it will go ahead and save this one.
Great.
So for this geolocation, you see, we're basically giving out the custom response.
So within here, let's go ahead and use some different euro.
But hopefully this is not cached.
I'll do a run.
And you see, instead of 4034 written, you are getting a custom response body layer.
So this is pretty exciting.
So this is the high level overview about the working of aid of this valve.
Now one thing that I'd like to share is that you should not be excited and implement many of the many
rules set directly within this production environment.
I still remember in one of the organization where I was working that we had a compliance related requirement
where we needed a valve to be implemented in production.
And the order timeline was very, very small.
Otherwise, the auditor would not really cleared IDA complaints certification.
So we had to implement the ref, we had to use the blocking as the action audit, and then the auditor
was happy.
But during that time, we had many sleepless nights because the SRT team was really angry at our security
and compliance team, because these this specific rules that I remember, because we had this exact
rule said that was enabled and there was some issue with the application and some of the others were
getting blocked.
So some of the sleepless nights, some of the troubleshooting, and then we were able to fix the issue.
So whenever you want to implement IWC Vaf, you have to ensure that you do it at the dev environment
level or testes environment level or at the UAE level.
So at least, you know, what are the others that are getting blocked and maybe one of the best teams
that can take it off key WCF is not the Devsecops guy or not.
The inference guys.
The best team that can look into this and take care of the entire service would be the one who is doing
a code review for your application.
So mostly the application security guys who are also doing good reviews for the application, they are
the best team that can be responsible for taking care of that.
And even in the organization, we had later handed it over to the application security because they
know how exactly the code is designed and they can quickly also identified issues.
So that's the high level.
What do you about the VAV in terms of practical and with this will conclude today's video.