Advanced Custom Rule

Scenario

The Milkshake gang continues to attack your application. They have changed their attack method once again! You need to update the rule to block these malicious requests while still allowing legitimate customers to send requests.

Create Advanced Custom Rule

All WAF Rules are defined as a JSON Object. For complex rules, you will find it easier to work directly in JSON format instead of using the Rule Editor on the console. You can get the current rule information defined in JSON by using the API, CLI, or Console using the get-rule-group command. Edit them using your preferred JSON editor and upload them with the update-rule-group command using API, CLI, or Console.
Defining rules using JSON allows you to apply version management to easily review how, when, and why a set of complex rules was changed.

  1. On your Web ACL information page.
  • Select your Web ACL.
  • Click Manage rules.
  • Click Add rule.

Create the sample web app

Create the sample web app

  • Select Custome rule, click Next.
  • Scroll down, continue to select Custome rule and click Next.

Create the sample web app

Create the sample web app

  1. This rule will block all requests that meet one of two conditions:
  • Contains header x-milkshake: chocolate and header x-favourite-topping: nuts
  • Contains query parameter milkshake=banana and query parameter favourite-topping=sauce
  1. On your Web ACL information page.
  • Select the comnplex-rule-challenge just created.
  • In the JSON field, enter
{
  "Name": "complex-rule-challenge",
  "Priority": 3,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "complex-rule-challenge"
  },
  "Statement": {
    "OrStatement": {
      "Statements": [
        {
          "AndStatement": {
            "Statements": [
              {
                "ByteMatchStatement": {
                  "FieldToMatch": {
                    "SingleHeader": {
                      "Name": "x-milkshake"
                    }
                  },
                  "PositionalConstraint": "EXACTLY",
                  "SearchString": "chocolate",
                  "TextTransformations": [
                    {
                      "Type": "NONE",
                      "Priority": 3
                    }
                  ]
                }
              },
              {
                "ByteMatchStatement": {
                  "FieldToMatch": {
                    "SingleHeader": {
                      "Name": "x-favourite-topping"
                    }
                  },
                  "PositionalConstraint": "EXACTLY",
                  "SearchString": "nuts",
                  "TextTransformations": [
                    {
                      "Type": "NONE",
                      "Priority": 3
                    }
                  ]
                }
              }
            ]
          }
        },
        {
          "AndStatement": {
            "Statements": [
              {
                "ByteMatchStatement": {
                  "FieldToMatch": {
                    "SingleQueryArgument": {
                      "Name": "milkshake"
                    }
                  },
                  "PositionalConstraint": "EXACTLY",
                  "SearchString": "banana",
                  "TextTransformations": [
                    {
                      "Type": "NONE",
                      "Priority": 3
                    }
                  ]
                }
              },
              {
                "ByteMatchStatement": {
                  "FieldToMatch": {
                    "SingleQueryArgument": {
                      "Name": "favourite-topping"
                    }
                  },
                  "PositionalConstraint": "EXACTLY",
                  "SearchString": "sauce",
                  "TextTransformations": [
                    {
                      "Type": "NONE",
                      "Priority": 3
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}
  • Confirm the rule has been created successfully

Create the sample web app

  1. Run the command
# This will be allowed
curl -H "x-milkshake: chocolate" "<Your Juice Shop URL>"

This command will allow us to access the web Create the sample web app

  1. Run the command
# This will be allowed
curl  "<Your Juice Shop URL>?milkshake=banana"

This command will allow us to access the web Create the sample web app

  1. Run the command
# This will be blocked
curl -H "x-milkshake: chocolate" -H "x-favourite-topping: nuts" "<Your Juice Shop URL>"

This command will be blocked Create the sample web app

  1. Run the command
# This will be blocked
curl  "<Your Juice Shop URL>?milkshake=banana&favourite-topping=sauce"

This command will be blocked Create the sample web app

In this section, you have learned how to define WAF rules in JSON format. Complex logic needs to be defined using AND, OR, and NOT operators.