Skip to content

Commit a6843b7

Browse files
khangtictockhangtictoc
authored
Add files via upload
0 parents  commit a6843b7

11 files changed

+525
-0
lines changed

Diff for: ‎README.md

+321
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
<img width="350" height="90" src="image/modsec.png" alt="Mod-sec">
2+
3+
# ModSecurity (+DVWA) Research Lab
4+
5+
## 0. Environment/Pre-installing
6+
7+
| Category | Specs |
8+
| --------------- | ---------------------------- |
9+
| OS | Kali Linux 2023.1 (ISO File) |
10+
| VM Platform | VMware |
11+
| Network Adapter | NAT |
12+
| Apache Version | Apache/2.4.55 (Debian) |
13+
| PHP Version | 8.2.2 |
14+
15+
If your PHP version is different, i would like to recommend to use **PHP 8.2**, you should always have the latest PHP and Apache version through the latest [Kali Linux release](https://www.kali.org/get-kali/). For instance, Kali Linux 2021 supports **PHP 7.4**, we should have some step to update it to that version. Go to [script](script) folder, run executable file as `root` user:
16+
17+
```bash
18+
sudo chmod 777 setup-php8.2-environment.sh
19+
sudo ./setup-php8.2-environment.sh
20+
```
21+
22+
Now check PHP version again !
23+
24+
If you know how to set up **DVWA** and **ModSecurity**, please proceed to ... . Otherwise, you can follow my instructions or reference to below links:<br>
25+
DVWA: https://github.com/digininja/DVWA <br>
26+
Modsecurity: https://github.com/SpiderLabs/ModSecurity
27+
28+
## 1. DVWA Intro
29+
30+
DVWA stands for Damn Vulnerable Web Application, it is a PHP/MySQL web application that contains a variety of known vulnerabilities, . It was designed to help web developers and security professionals learn about web application security
31+
32+
The application is divided into different security levels, ranging from low to high
33+
34+
## 2. DVWA basic Set up (Manual)
35+
36+
### 2.1 Build DVWA Apache website:
37+
38+
By defautl, codebase of Apache Server is deployed at `/var/www/html `
39+
40+
```bash
41+
cd /var/www/html
42+
```
43+
44+
Placing all the repo's source code in here.
45+
46+
```bash
47+
git clone https://github.com/digininja/DVWA.git
48+
```
49+
50+
Change permission(full-privileged) for execution:
51+
52+
```bash
53+
sudo chmod 777 DVWA
54+
```
55+
56+
Start `apache2` service:
57+
58+
```bash
59+
sudo service apache2 start
60+
```
61+
62+
Browse to `http://127.0.0.1/`; if you see this, you have successfully deployed the Apache server.
63+
64+
<p align="center"><img width="600" height="200" src="image/apache2_success.png" > </p>
65+
66+
Then following instruction in repo from here, **DVWA** offers a dummy copy of its _config file_ for you to copy into place and then make the appropriate changes
67+
68+
```bash
69+
cd DVWA
70+
sudo cp config/config.inc.php.dist config/config.inc.php
71+
```
72+
73+
Access to `http://127.0.0.1/DVWA`. You should be able to see the **Welcome Page**:
74+
75+
<p align="center"><img width="600" height="80" src="image/dvwa_welcome.png" > </p>
76+
77+
### 2.2 Create DVWA user in local database:
78+
79+
Start `mysql` and `mariadb` service:
80+
81+
```bash
82+
sudo service mysql start
83+
sudo service mariadb start
84+
```
85+
86+
Access user `root` for making changes to database:
87+
88+
```bash
89+
sudo mysql -u root -p
90+
```
91+
92+
Enter your system password. Then go through each of the following command respectively to create user `dvwa` with default password (P@ssw0rd) in `config/config.inc.php`:
93+
94+
```mysql
95+
create database dvwa;
96+
create user dvwa@localhost identified by 'p@ssw0rd';
97+
grant all on dvwa.* to dvwa@localhost;
98+
flush privileges;
99+
use dvwa;
100+
exit;
101+
```
102+
103+
Access `http://127.0.0.1/DVWA/setup.php` for final setup, click on **"Create/Reset database"**. Then you're able to access challenge resources. These are enough for basic WAF testing.
104+
105+
> Note1: Default login credential (username-password): `admin` - `password`
106+
107+
> Note2: In main page, go to "DVWA Security" tab and set the difficulty to `Low` for quick testing. Go to **SQL Injection** and type `1'` in placeholder, if popping up an error message page it means it's working.
108+
109+
### 2.3 (Optional) Completed install remaining component:
110+
111+
After setting up with basic resources, we're good to go and test the demo website; but in case you want all challenge to be avaiable, refer to this section. Go to `http://127.0.0.1/DVWA/setup.php` to check the available function's status:
112+
113+
`PHP function allow_url_include`
114+
115+
Go to PHP configuration file at `/etc/php/{YOUR_PHP_VERSION}/apache2/php.ini`. For example, in my system:
116+
117+
```bash
118+
sudo nano /etc/php/8.2/apache2/php.ini
119+
```
120+
121+
**Ctrl + W** to search -> Type "allow_url_include" -> Enter -> Rewrite "Off" to "On" -> Save
122+
123+
Restart service `apache2`
124+
125+
```bash
126+
sudo service apache2 restart
127+
```
128+
129+
`PHP module gd`
130+
131+
Install `php-gd`
132+
133+
```bash
134+
sudo apt update
135+
sudo apt install php8.2-gd
136+
```
137+
138+
> Note: My current PHP version is 8.2 which supports `php8.2-gd`. Use can examine whether a PHP version support additional module by `apt`, for example:
139+
140+
```bash
141+
sudo apt-cache pkgnames | grep "php8.2"
142+
```
143+
144+
Then find the appropriate version for Apache2
145+
146+
```bash
147+
sudo apt-cache pkgnames | grep "apache2" | grep php
148+
```
149+
150+
`Writable folder /var/www/html/DVWA/hackable/uploads/`
151+
152+
By default, user `www-data` is used to run the webserver. As above, we've changed permission to `777` and used as `root` user, so this section turned to **Yes**; if not, for properly configured
153+
154+
```bash
155+
sudo chown www-data -R /var/www/html/DVWA/hackable/uploads/
156+
```
157+
158+
`Writable folder /var/www/html/DVWA/config`
159+
160+
```bash
161+
sudo chown www-data -R /var/www/html/DVWA/config
162+
```
163+
164+
`reCAPTCHA key`
165+
166+
This key is only required when you are intending to expose this website to public access. [Follow official repo] This setup is very simple. Edit file `config/config.inc.php`:
167+
168+
```php
169+
$_DVWA[ 'recaptcha_public_key' ] & $_DVWA[ 'recaptcha_private_key' ]
170+
```
171+
172+
These values need to be generated from: https://www.google.com/recaptcha/admin/create
173+
174+
That's all, I just love the "green" color :>
175+
176+
## 3. WAF Intro (ModSecurity)
177+
178+
**ModSecurity** is a web application firewall (WAF) that provides an additional layer of security for web applications. It is an open source module for the Apache, IIS and Nginx HTTP Server that helps protect websites having web vulnerabilities (SQLi, XSS, Path Traversal, ...).
179+
180+
The module works by analyzing incoming HTTP requests and applying a set of rules to identify and block potential attacks. These rules can be customized to meet the specific security requirements of a website or application.
181+
182+
## 4. Feature & Deployment selection:
183+
184+
List of comprehensive functions:
185+
186+
- Prevent attacks to web application (Apache support)
187+
- Open-source
188+
- Logging and monitoring
189+
- SSL/TLS support
190+
- Customizable rules
191+
192+
Deployment method:
193+
194+
- **Embedded** : deploy along with Web Server itself (one VM only)
195+
- **Reverse Proxy** : seperate as a node standing in front of Web Server
196+
197+
## 5. WAF installation (Manual)
198+
199+
### Install ModSecurity
200+
201+
Source: https://www.linode.com/docs/guides/securing-apache2-with-modsecurity/
202+
203+
```bash
204+
sudo apt install libapache2-mod-security2 -y
205+
```
206+
207+
After installing ModSecurity, enable the Apache 2 headers module by running the following command:
208+
209+
```bash
210+
sudo a2enmod headers
211+
```
212+
213+
Restart the service
214+
215+
```bash
216+
sudo systemctl restart apache2
217+
```
218+
219+
### Pre-configuring
220+
221+
Use the default configuration file
222+
223+
```bash
224+
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
225+
```
226+
227+
Edit `/etc/modsecurity/modsecurity.conf`, change the value for `SecRuleEngine` to `On`. Then apply it:
228+
229+
```bash
230+
sudo systemctl restart apache2
231+
```
232+
233+
### Setting Up [the OWASP ModSecurity Core Rule Set](https://github.com/coreruleset/coreruleset) (Official repo).
234+
235+
This is a set of generic attack detection rules for use with **ModSecurity** or compatible web application firewalls. The CRS aims to
236+
protect web applications from a wide range of attacks, including the **OWASP Top 10**, with a minimum of false alerts
237+
238+
Delete the current rule set that comes prepackaged with ModSecurity
239+
240+
```bash
241+
sudo rm -rf /usr/share/modsecurity-crs
242+
```
243+
244+
Clone CRS(Core Rule Set) from repo and save it to `/usr/share/modsecurity-crs`
245+
246+
```bash
247+
sudo git clone https://github.com/coreruleset/coreruleset /usr/share/modsecurity-crs
248+
```
249+
250+
Use `crs-setup.conf.example` as configuration file
251+
252+
```bash
253+
sudo cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf
254+
```
255+
256+
```bash
257+
sudo cp /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
258+
```
259+
260+
### Enabling ModSecurity in Apache 2
261+
262+
Enable **ModSecurity** in the Apache configuration file as a modification module. Edit `/etc/apache2/mods-available/security2.conf` to include it in config file:
263+
264+
```xml
265+
<IfModule security2_module>
266+
SecDataDir /var/cache/modsecurity
267+
Include /usr/share/modsecurity-crs/crs-setup.conf
268+
Include /usr/share/modsecurity-crs/rules/*.conf
269+
</IfModule>
270+
```
271+
272+
Edit `/etc/apache2/sites-enabled/000-default.conf`, add `SecRuleEngine` directive to `On`
273+
274+
```xml
275+
<VirtualHost *:80>
276+
ServerAdmin webmaster@localhost
277+
DocumentRoot /var/www/html
278+
279+
ErrorLog ${APACHE_LOG_DIR}/error.log
280+
CustomLog ${APACHE_LOG_DIR}/access.log combined
281+
282+
SecRuleEngine On
283+
</VirtualHost>
284+
```
285+
286+
Restart the service
287+
288+
```bash
289+
sudo systemctl restart apache2
290+
```
291+
292+
### Testing ModSecurity
293+
294+
```bash
295+
curl http://127.0.0.1/DVWA/?exec=/bin/bash
296+
```
297+
298+
The returning result should be like below
299+
300+
```html
301+
<!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN">
302+
<html>
303+
<head>
304+
<title>403 Forbidden</title>
305+
</head>
306+
<body>
307+
<h1>Forbidden</h1>
308+
<p>You don't have permission to access this resource.</p>
309+
<hr />
310+
<address>Apache/2.4.51 (Debian) Server at 127.0.0.1 Port 80</address>
311+
</body>
312+
</html>
313+
```
314+
315+
## 6. ModSecurity Rule Research
316+
317+
Go to [lab](lab) for research tutorial. There will be more instructions
318+
319+
## 7. (Bonus) Everything-as-scripts
320+
321+
Go to [script](script). There would be also some guides and scripts for automation install everything

Diff for: ‎image/apache2_success.png

57.8 KB
Loading

Diff for: ‎image/dvwa_welcome.png

36.5 KB
Loading

Diff for: ‎image/modsec.png

34.2 KB
Loading

Diff for: ‎image/recaptcha_key.png

19.1 KB
Loading

Diff for: ‎image/result_final_dvwa.png

205 KB
Loading

Diff for: ‎image/test_sqli.png

49.2 KB
Loading

Diff for: ‎script/README.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Instruction
2+
3+
Here are some information when ultilizing these scripts.
4+
5+
------
6+
7+
> Important: All the scripts need to run as `root` privileges
8+
9+
## `setup-php8.2-environment.sh` (Optional)
10+
11+
If your PHP version is not support `php-gd`, you may need a latter version. This script will ask you to indicate the **old PHP version** (for removing) and **new PHP version** (for installing), I suggest that the new one should be `8.2` (the latest at this time) and the old one is your choice.
12+
13+
## `dvwa-full-install.sh`
14+
15+
Fully installing the *DVWA web server*, there would be a phase to prompt you to enter password to **MySQL database** as `root` user. By default, use the same password for `root` user in system. The final result comes up like below:
16+
17+
<p align="center"> <img src="../image/result_final_dvwa.png"> </p>
18+
19+
Also, the status for each phase should be all `OK`
20+
21+
## `modsec-basic-install.sh`
22+
23+
Install the basic configuration for ModSecurity. When finished, try to SQLi the web. For example:
24+
25+
<p align="center"> <img src="../image/test_sqli.png"> </p>
26+
27+
Also, the status for final phase should be all `OK`.

0 commit comments

Comments
 (0)