Lab 1 - Explore DVGA Attack Types and Execute Some Attacks

Objective

Familiarize yourself with DVGA and Challenge Solutions

Connect to the Linux Client

Note

All steps in this lab exercise will be performed from the Linux jump host.

1. On your UDF page, go to your Client component, click the Access drop down menu and choose RDP
2. RDP to the Linux Client by choosing the RDP access method from your UDF environment page.

user: f5student password: f5DEMOs4u!

Note

you should only need to enter the password, the username should be auto-populated.

Explore DVGA

1. Once logged in, launch Chrome Browser and go to http://dvga.f5appworld.com.
2. Scroll down to “Got Stuck?” section and click “Solutions” link.

3. Select an attack type…in this case select “Batch Query Attack”

4. Click the green “Show” button.

Note

Each solution may show a script or just a graphQL payload to use to execute the attack. If it shows a script, you will find a script file matching that attack type in the /graphql directory in the user’s home directory. If the solution shows a GraphQL payload you may choose either the GraphiQL Chrome extension or Burp Suite to execute the attack. After each attack you should review the WAF logs to see the results and which violations triggered. See the “Review Waf Logs” section at the end of Lab 2 for instructions.

Execute an attack via a python script

1. Open Terminal on the Linux jump host
2. cd graphql
3. python3 <script name>

Execute an attack using the GraphiQL Chrome extension

1. Copy the graphQL payload from the Solution

2. Open GraphiQL Chrome extension
3. Enter http://dvga.f5appworld.com/graphql into the target field
4. 4. Paste the graphql payload from solution
5. Send the request

Execute an attack using the Burp Suite

1. Open Burp Suite from the desktop icon

2. Click “Next” and “Start Burp”.
3. Go to the “InQL” Burp extension tab.
4. Enter http://dvga.f5appworld.com/graphql in the GraphQL Endpoint field.
5. Click “Analyze”

Note

This will run introspection on DVGA and return the entire schema. You should see violations in the WAF logs for this.

6. You should now see a directory for DVGA in the schema folders below.
7. Expand the DVGA folder and the date-specific folder.
8. Select the request type that best matches the attack payload youa re trying to use.
9. In the GraphQL paylod area to the right, right-click and select “Send to Repeater”

10. Select the “Repeater” tab
11. Paste the attack paylod from the SOlution into the Request area.
12. Click “Send”
13. Review the response.

Review WAF Logs

1. In Chrome on the Linux jump host, go to the F5 Advanced WAF shortcut and Login

user: admin

password: f5demos4u!

2. Navigate to the WAF Request Logs screen
3. Select the request with your most recent attack
4. Review the request and any GRAPHQL violations that may have triggered.

Congratulations! You have just completed Module 3