You are the sole developer for the start up Juice Shop. Your website is a simple web application backed by a SQL Database. For some reason, a group of Milkshake bandits have started attacking your site!
Luckily, you recently attended a workshop on AWS WAF. You decide to implement your own WAF to protect your site.
At this time, you don’t have much time, so you decide to deploy two AWS Managed Rule groups to your WebACL. This will protect your website from the common attacks the milkshake bandits are using.
Web ACLs (Web Access Control List) is the core resource in an AWS WAF deployment. It contains rules that are evaluated for each request that it receives. A web ACL is associated to your web application via either an Amazon CloudFront distribution, AWS API Gateway API or an AWS Application Load Balancer.
Managed rule groups are a set of rules, created and maintained by AWS or third-parties on the AWS Marketplace. These rules provide protections against common types of attacks, or are intended for particular application types.
This workshop uses the latest version of AWS WAF. Make sure you do not use WAF Classic.
waf-workshop-juice-shop
.Web ACL for the aws-waf-workshop
.
# This imitates a Cross Site Scripting attack
# This request should be blocked.
curl -X POST <Your Juice Shop URL> -F "user='<script><alert>Hello></alert></script>'"
15. Run command
# This imitates a SQL Injection attack
# This request should be blocked.
curl -X POST <Your Juice Shop URL> -F "user='AND 1=1;"