[Autogenerated] Credential stuffing is a type of brute force attack
that uses stolen credentials and unfortunately a large globomantics
partner just reported a breach of over 300,000 customer user names
and passwords in response.
The Globomantics security engineers have deployed mod security
in an attempt to mitigate credential stuffing attacks against
Globomantics web applications.
I'm going to use a brute force tool called Hydra and the breached
credentials to attack a Globomantics web application login page.
It's okay if you're unfamiliar with this tool,
we just need to see if mod security can detect and block
the technique at the bottom of the screen is a route tail
on the mod security audit log.
And hopefully when I execute this script to run
hydra we should see some activity.
Okay, there is a large volume of events being logged.
I'm going to stop hydra so we can take a look at the logs.
Hmm It looks like hydra has a well known user agent string
that triggered one of the old hospitals.
This is something that would fall towards the bottom
of David bianco's pyramid of pain,
which means it's not going to impose any significant cost to an adversary who
can just easily modify the observed to user agent string.
Let's return to the Cali terminal,
I have a second version of the hydra script that
uses a custom user agent stream.
I'm going to run the script again.
Now let's watch the root tail at the bottom.
Nothing happens.
So it seems like a default mod security and core rule set are
not going to mitigate this style of attack.
Not to worry.
This is a case where researching and developing your
own rule can help solve this problem.
The good news is I've already done the research and created a custom rule file.
I've also included the file in the course.
Resources.
Let me start by saying that this is not a universal solution.
It's only for demonstrating the power of mod security.
You'll have to adapt this or any other rules to
your environment At a high level.
This rule file does not restrict users that log in successfully.
However,
it will count how many times they have submitted the login form within Valley
credentials and if the user crosses the predefined threshold,
which is 10 attempts in this case,
then the offended IP address is blocked for five minutes.
I wish I had a lot of time to go over all the details in this rule file,
but there's just too much detail.
I'd rather spend the time we have showing you how it works.
So let's go ahead and open the centralized configuration file that I created at
the beginning of this course in the custom rules section,
I'm going to add our brute force rule,
which I called zero one dash brute blocker dot com.
Now let's save exit and restart our web server.
I'm going to use the brute force to script that spoofs the
user agent to avoid triggering the os bruls.
Let's see what happens this time.
Hmm.
We can already see some feedback and there we go.
Our rule block the scanner.
We also have a good amount of details in our logs.
I'm going to perform one last check to try to access the Web app
login page from Firefox on the Cali system.
Good stuff looks like our rule works as expected.
The Cali IP is blocked from accessing the Globomantics Web application.