Custom Rule
Scenario
Just when you think you have blocked attacks from the Milkshake group, more attack requests are coming to your application. These attacks are becoming more dangerous. However, you can confidently block these attacks with custom rules for your WAF Web ACL.
All attacks seem to have a strange header X-TomatoAttack and you need to block requests with this header to stop this attack wave.
Create Custom Rule
WAF allows you to create custom rules to handle requests. This is very useful when you want to customize according to your application context. Along with introducing custom rules, this section will familiarize you with sampling requests and Web ACL Capacity Units.
- On your Web ACL information page. Select the web ACL you just created. Select Manage rules.
- Proceed to Add rule:
- Select Custome rule, click Next
- Scroll down to continue, select Custome rule, click Next.
- Enter the information:
- In the Rule name field, enter
MyCustomRule-X-TomatoAttack. - In If a request, select matches the statement.
- Next, select Single header.
- In the Statement section:
- In the Name field, enter
X-TomatoAttack. - Next, select Size greater than or equal to.
- Finally, select Add rule.
- Confirm the rule has been created successfully
- Run the command.
# This will be blocked
curl -H "X-TomatoAttack: Red" "<Your Juice Shop URL>"
We will see Request blocked.
6. Run the command.
# This will be blocked
curl -H "X-TomatoAttack: Green" "<Your Juice Shop URL>"
We will see Request blocked.
7. On your Web ACL information page.
- Click on your Web ACL.
- Select View dashboard, logs and samples request.
- Here we will see the names of blocked requests.
