Create Credentials Protection WAF Child Policy

Task 1 - Simulate credential attacks.

1. Open browser and go to https://<Elastic IP>/user/login

2. For Username enter f5student

3. For Password. enter random incorrect password. Repeat 5 consecutive times using different password to simulate brute force attack

   Note

   This is a common brute force attack. In this case the application allowed repeated attempts without lockout. Some applications will send “account locked” for a period of time, however user can continue to repeated attempts to elongate lockout period.

4. Open new incognito browser and open developer tools. (In Chrome for example: View -> Developer ->Developer Tools)

5. Browse to https://<Elastic IP>/user/login and login with username f5student and password password

6. Once successfully logged in, review log on Developer Tool.

   • Select Network tab
   • Highlight login?return_url=
   • On right panel click Headers and scroll to bottom of Form Data to view Username and Password.
   

Task 2 - Create new waf policy to mitigate the vulnerabilities using info on table below:

Policy Name	waf_baseCredentials
Policy Type	Security
Parent Policy	waf_base
Virtual Server	none
Enforcement Mode	Blocking

1. Select the Security -> Application Security -> Security Policies -> Policies List page

2. Click Create New Policy then click Advanced and enter info as shown in image below.

   

3. Click Create Policy

   

Task 3 - Configure Brute Force Protection

1. Select Security -> Application Security -> Sessions and Logins -> Login Pages List page

2. Click Create

   

3. Fill in the details as in the image above and click on Create

4. Select Security -> Application Security -> Anomaly Detection -> Brute Force Attack Prevention then click Create

5. Change Login Page drop down box to [HTTPS]/user/login then click Create

6. Click Apply Policy then OK to commit changes

   

Task 4 - Configure Credential Encryption

1. Select Security -> Data Protection -> DataSafe Profiles

2. Click Create

   

3. For Profile Name enter protect_credentials

   

4. Click on the `>` next to Create New Profile to expand menu.

5. Select URL List and click Add

   

6. For the URL path enter /user/login

7. Expand the Menu again and Select Parameters

8. In the Parameter Name enter username and click Add

9. Check Identify as Username and Encrypt check boxes

10. In the Parameter Name enter password and click Add

11. Check Encrypt check box

    

12. Click Login Page Properties

13. For URL is Login Page check Yes box

14. For A string should appear enter My Account

15. For A string that should NOT appear enter Username or password are incorrect

    

16. Click Create

Task 5 - Assign policies to protect Hackazon App

1. Select Local Traffic -> Virtual Servers -> Virtual Servers List and click on hackazon_vs

2. Select Security then Policy tab

3. Change Application Security Policy to waf_baseCredentials

4. Enable Anti-Fraud Profile and select protect_credentials

5. Click Update

   

Task 6 - Repeat simulated credential attacks

1. Open browser and go to https://<Elastic IP>/user/login

2. For Username enter f5student

3. For Password enter random incorrect password. Repeat multiple times using different password to simulate brute force attack. You should receive a captcha challenge after 3 failed attempts.

4. Enter captcha challenge then enter correct credentials to login in successfully.

5. Open new incognito browser and open developer tools. (View->Developer-Developer Tools)

6. Browse to https://<Elastic IP>/user/login and login with username f5student and password password

7. Once successfully logged in, review log on Developer Tool.

   • Select Network tab
   • Highlight login?return_url=
   • On right panel click Headers and scroll to bottom of Form Data to view Username and Password.