Tutorial Overview: Azure Web Application Firewall Security Protection and Detection Lab

Introduction

Customers often want to test and validate the capabilities of products before using them in mission critical environments.  Same is true for Azure Web Application Firewall (WAF), where customers often have a need to test its security capabilities and validate their effectiveness before deciding to secure their production workloads with it.

To enable customers in rapidly validating the effectiveness of Azure WAF against real world web application attacks, we have designed this four-part lab tutorial.  Part one of the tutorial provides guidance to quickly deploy a test environment with all required components.  Parts two through four provide step by step walkthroughs for attacking a vulnerable web application with common, real-world, publicly available hacking and attack tools.

Tutorial Overview

The purpose of the Azure WAF security protection and detection lab tutorial is to demonstrate Azure Web Application Firewall (WAF) capabilities in identifying, detecting, and protecting against suspicious activities and potential attacks against your Web Applications.  In this four-part tutorial, you will learn how to

1. Configure the working environment to test Azure WAF protection against web application attacks
2. Emulate an adversary by attacking and exploiting a vulnerable web application using step by step instructions
3. Review Azure Monitor Workbook for WAF to understand WAF detection and processing logic for specific attack patterns used in every tutorial

The lab tutorials provide walkthroughs for running successful attacks against the vulnerable OWASP Juice Shop web application when it is exposed to the internet directly, without Azure WAF.  The tutorials then also demonstrate effectiveness of Azure WAF on Application Gateway in blocking the same attacks against the same instance of the vulnerable OWASP Juice Shop Application when it is protected by Azure WAF.

This lab focuses on the OWASP protection ruleset and logging capabilities of Azure WAF.  The lab does not include advanced application security concepts and is not intended to be a reference for application security testing as these areas are broader than the use cases demonstrated herein.

Part 1 - Lab Setup

The first tutorial in this four-part series walks you through deploying/creating a lab environment for testing Azure WAF protection and logging capabilities.  The tutorial includes information about machines and tools that are needed to set up the lab and complete its playbooks.  The instructions assume you are comfortable with deploying and administering resources in Azure and have some familiarity with web application security concepts.  The closer your lab is to the suggested lab setup, the easier it will be to follow Azure WAF testing procedures.  When your lab setup is complete, use the Azure WAF Security Protection and Detection playbooks for testing.

Setup an Azure WAF Attack Testing Lab 

Part 2 - Reconnaissance Playbook

The second tutorial in this four-part series is a reconnaissance playbook.  Reconnaissance activities allow attackers to gain a thorough understanding and complete mapping of your web application for later use.  The playbook shows Azure WAF capabilities in identifying, detecting, and protecting against suspicious activities from potential recon attacks using examples from common, publicly available hacking and attack tools.

Reconnaissance Playbook

Part 3 - Vulnerability Exploitation Playbook

The vulnerability exploitation playbook is third in the four-part tutorial series.  In the exploitation phase, an attacker attempts to exploit known or a previously identified vulnerability with intent to elevate privileges.  As you run through this playbook, you will see Cross Site Scripting (XSS) detections and rules get triggered on Azure WAF from the attack you will simulate in your lab.

Cross Site Scripting (XSS) attacks are performed against web applications with the intent of compromising end users or the application itself.

Vulnerability Exploitation Playbook 

Part 4 - Data Disclosure and Exfiltration Playbook

The last tutorial in the four-part series is the data exfiltration playbook. During the data exfiltration phase, an attacker has already gained access to your application backend and attempts to disclose and copy sensitive data.  You will simulate an SQL Injection (SQLi) attack to see the attack detection and protection capability of Azure WAF.

SQL Injection (SQLi) attacks are performed against web applications with the intent of exposing/exfiltrating sensitive application and user data.

Data Disclosure and Exfiltration Playbook

Next: Setup an Azure WAF Attack Testing Lab