This series is for meant for educational use only, and is intended to be used in a lab environment. These have not been tested in the real world and may cause more problems then they help. It will by no means be an in depth discussion.<\/p>\n
Background<\/strong> Process<\/strong> The main thing we will want to do with our simple web application firewall is to block traffic we suspect as malicious. The usual way to do this is with a firewall.<\/p>\n Unfortunately, the Windows firewall included in Windows 2003 is rather simple and does not make a distinction between inbound and outbound traffic. <\/p>\n Lucky for us, IPSec does<\/p>\n There is a great demo and explanation\u00a0of how\u00a0to setup a policy\u00a0by\u00a0John Strand here As with most things Windows, there are many ways to setup an IPSec policy. You can use the snap in as shown above, via group policy templates, with the command line or even in the registry (under HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec). In addition, there is a dedicated tool, the IPSec Policy Agent, IPSeccmd.exe. IPSeccmd.exe is part of Windows XP Service Pack 2 support tools. We will use command line.<\/p>\n First need to create an IPSec Policy. netsh ipsec static add filterlist name=”Banned IPs” description=”Simple WAF Banned IPs”<\/span> netsh ipsec static add filteraction name=Block description=”Blocks Traffic” action=block<\/span> netsh ipsec static add filter filterlist=”Banned IPs” srcaddr=X.X.X.X dstaddr=The.web.server.ip description=”Banned IPs” protocol=any srcport=0 dstport=80<\/span> netsh ipsec static add rule name=”Banned IP Rule” policy=”Simple WAF” filterlist=”Banned IPs” kerberos=no filteraction=Block<\/span><\/p>\n This rule definition ties together the policy, the filter and the action<\/p>\n Now, let’s check it out using the snap-in. Now play a game of search and click, and see if you can find the screens that match up with screen shot below.<\/p>\n <\/p>\n Once you have verified the rule, right click on it, select assign, and try to access port 80 from the test box you added to the Banned IPs. <\/p>\n You could do something similar using IPSec in Windows 2008, but it is much easier to use the Windows 2008 firewall. <\/p>\n Again, there are many ways to do this. We will run a simple command from the command line Next Steps<\/strong> The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion. PreambleThis series is for meant for educational use only, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,9],"tags":[],"class_list":["post-15","post","type-post","status-publish","format-standard","hentry","category-blue","category-iis"],"_links":{"self":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/15","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=15"}],"version-history":[{"count":0,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/15\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
As mentioned before we will be creating a simple WAF to actively defend against offensive attacks. We are still laying the groundwork for our scenario, this time by taking a look at blocking traffic.<\/p>\n
Please note, I won’t go into a lot of details in these posts. There is a lot of information out there on these topics presented by people much smarter then me.<\/p>\n
http:\/\/www.youtube.com\/watch?v=amHaBmOlfgE<\/a><\/p>\n
netsh ipsec static add policy name=”Simple WAF” description=”Simple WAF” assign=no<\/span>
This creates a Policy named Simple WAF.<\/p>\n
This creates a filter list that we will add the attacking ip’s to.<\/p>\n
Here we create a Block action. <\/p>\n
This will add an IP address to our banned IPs filter so we can test.<\/p>\n
To get to the IPSec MMC Snap-in click on Start | Settings | Control Panel | Administrative Tools | Local Security Policy<\/span>or Start | Run | type<\/span> secpol.msc | OK<\/span><\/p>\n![](\"https:\/\/lh4.googleusercontent.com\/-hyjAwJVL4L8\/TYZ-Qb50KPI\/AAAAAAAAAAY\/d5fgsiQ7QNg\/s320\/ipsecS.jpg\")
<\/a><\/div>\n
netsh advfirewall firewall add rule name=”Bad IPs” protocol=TCP dir=in localport=80 remoteip=x.x.x.x action=block<\/span>
This command creates a new rule called Bad IPs, and blocks access to port 80 from the ip listed in remoteip.
See http:\/\/www.windowsnetworking.com\/articles_tutorials\/Configure-Windows-2008-Advanced-Firewall-NETSH-CLI.html<\/a>\u00a0for some more examples and instuctions on how to use the netsh command to manage the firewall.<\/p>\n
A very quick intro to logparser and a very simple script to use it to look for and then block attackers.<\/p>\n","protected":false},"excerpt":{"rendered":"