Background:
Sharing some intro about AWS WAF. If you are designing applications on AWS eco-system it worths to explore to use WAF.
Usually AWS suggests to use application load balancer and configure WAF.
Below are the technicalities:
1- Always, make sure if you have admin page on your website, /admin ensure there is access control preventing unauthorized users from reaching the page.
2- A fast test to ensure if your website accepts malicious user. A very nice tool that you can use which can ensure you have WAF in place or if you want to trigger the logging and test is below two commands:
Leveraging curl and sqlmap:
curl -v -H "User-Agent: sqlmap/1.5" "http://globomantics-alb-576723268.eu-west-1.elb.amazonaws.com/"
Sqlmap: Familiarize yourself with SQLmap it is a free, open-source penetration testing tool that automates finding and exploiting SQL injection flaws in web applications.
-v: for verbose
Leveraging the internal address that AWS gives http://169.254.169.254/ for finding internal metadata
curl "http://<ALB_DNS>/search.php?q=http://169.254.169.254/latest/meta-data/iam/security-credentials/"
Ok for the above if you are getting responses: 200 then your WAF is not configured:
So, for the sake of understanding I will just add the points, they are generic and usually it can be configured through infrastructure as a code.
But below are the main points to keep in mind:
1- WAF is firewall, and firewall has rules so you need to add them (rules and rule groups).
2- AWS WAF Managed Rule Groups: AWS has managed group rules and you can utilise them:
a) Core Rule Set: Catches common general attacks like SQL injection, XSS, and malformed requests — it's the baseline "seatbelt" protection almost every app should have.
b) Known Bad Inputs: Blocks specific request patterns already known from real-world exploits, like SSRF payloads (e.g. 169.254.169.254) or log4j-style strings.
c) Admin Protection: Blocks public access to admin/management paths (like /admin or /wp-admin) that shouldn't be reachable from outside.
3- Build your own rules. For the /admin rule you can go to rule builder and add your own rules, string match / admin.
Conclusion:
Validate, test and validate and check logging also what things are kept in the log. Traffic overview and traffic metrics are also important to keep in mind.
Regulators, auditors always ask for these rules that they are configured, logged and periodically reviewed. So make sure you have the evidences at least for a period of 1 year depending on the criticality.
Top comments (0)