Hacking Articles Tips Tricks Videos Tutorials

Cross-origin resource sharing (CORS) Explanation & Exploitation ☠

Hi! My name is Hashar Mujahid and today we will talk about Cross-origin resource sharing (CORS).Continue reading on InfoSec Write-ups »
Read more...

5 views11:36

5 views11:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
NGWAF - First Iteration Of ML Based Feedback WAF

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifQrF26QZsvmuKO1KWzzaYy8m5J_8B_S46d5b_dtYGB_bcm0SlOgRhbIZlQE91QmhEaFM3ypt8xMTfrVzSXGV3d2He3qQJXljJl_OMMa7lKq9Ewa2CNF9OfIesa3aZ181BtZaqgjeRcueKSdT3PzonNjZt5l9IUNXyB_sKpgPDei968ysvI3zIxK5xRQ/w640-h466/NGWAF_1_Architecture.jpeg The Motivation | What is the N3XT ST3P?With the explosive growth of web applications since the early 2000s, web-based attacks have progressively become more rampant. One common solution is the Web Application Firewall (WAF). However, tweaking rules of current WAFs to improve the detection mechanisms can be complex and difficult. NGWAF seeks to address these drawbacks with a novel machine learning and quarantine-to-honeypot based architecture.

Inspired by actual pain points from operating WAFs, NGWAF intends to simplify and reimagine WAF operations through the following processes:
Pain point NGWAF Feature Maintenance of detection mechanisms and rules can be complex Leverage machine learning to automate the process of creating and updating detection mechanisms Immediate blocking of malicious traffic reduces chances of learning from threat actor behavior for future WAF improvements Threat elimination through redirected quarantine as opposed to conventional dropping and blocking of malicious traffic
To make deployment simple and portable, we have containerised the different components in the architecture using docker and configured them in a docker-compose file. This allows running it on a fresh install to be quick and easy as the dependencies are handled by docker automatically. The deployment can be expanded to be deployed into a local or cloud provider based kubernetes cluster, making scalabe as users can increase the number of nodes/pods to handle large amounts of traffic.

The deployment have been tested on macOS (Docker desktop), linux (ubuntu).

Check out our demo video here

NGWAF is created by @yupengfei, @zhangbosen, @matthewng and @elizabethlim

Special shoutout to @ruinahkoh for her contributions to the initial stages of NGWAF. How does NGWAF work?NGWAF runs out-of-the-box with three key components, these components as mentioned above are all containerised and are scalable according to desired usage. The protected resource can be customised by making a deployment change within the setup. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifQrF26QZsvmuKO1KWzzaYy8m5J_8B_S46d5b_dtYGB_bcm0SlOgRhbIZlQE91QmhEaFM3ypt8xMTfrVzSXGV3d2He3qQJXljJl_OMMa7lKq9Ewa2CNF9OfIesa3aZ181BtZaqgjeRcueKSdT3PzonNjZt5l9IUNXyB_sKpgPDei968ysvI3zIxK5xRQ/w640-h466/NGWAF_1_Architecture.jpeg High level architecture of NGWAF with expected traffic flows from different partiesKey BenefitsNGWAF was engineered with the following key user benefits in mind: 1. Rule Complexity ReductionNGWAF replaces traditional rulesets with deep learning models to reduce the complexity of managing and updating rules. Instead of manually editting rules, NGWAF's machine learning automates the pattern learning process from malicious data. Data collected from the quarantine environment are automatically scrubbed and batched, allowing it to be retrained into our detection model if desired. 2. Cyber DeceptionNGWAF adopts a novel architecture consisting an interactive and quarantine environment built to isolate potential hostile attackers. Unlike conventional WAFs which blocks upon detection, NGWAF diverts threat actors to emulated systems, trapping them to soften the impact of their malicious actions. The environment also act as a sinkhole to gather current attack methods, enabling the observation and collection of malicious data. These data can be used to further improve NGWAF's detection capability. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSPPvwQcqpDBqGZgS83fC6zZRKfTE8up_R40JZ80Ab-lLpki22XPcI82iTjII[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

NGWAF - First Iteration Of ML Based Feedback WAF

5 viewsedited 11:53

About

Blog

Apps

Platform