NGWAF in action: Upon detection of SQL injection, NGWAF redirects to our quarantine environment, instead of dropping or blocking the attempt. 3. Compliance to Internationally Recognised Standards The guiding principal behind the creation of NGWAF is to guard against the risks highlighted from the Open Web Application Security Project's standard awareness document - The (https://owasp.org/www-project-top-ten/)OWASP Top 10 (https://www.kitploit.com/search/label/OWASP%20Top%2010) 2021. Training data and compliance checks for NGWAF are collected and conducted based on this requirement. The Components of NGWAF 1. The Brains - Machine-Learning based WAF | Who needs manual when we can go NEURAL Instead of traditional rulesets which require analysts to manually identify and add rules as time goes by, NGWAF leverages end-to-end machine learning pipelines for the detection mechanism, greatly reducing the complexity in WAF rule management, especially for detecting complex payloads. Base Model To do so, we needed to first create a base model and architecture that users can start off with, before they later use data collected from their own applications for retraining and fine-tuning: We collected malicious and non-malicious payloads from various application logs (total of ~40k observations) Instead of manually identifying rules, we leverage machine and deep learning to automate the process of learning patterns from previous malicious data. We then experimented with several model architectures, and our final model utilized a sequential neural network to predict whether an incoming payload was malicious or not. Performance Our model was able to achieve 99.6% accuracy on our training dataset. Maintenance & Retraining Although we have included logs from various applications in order to improve the generalizability of the base model, further maintenance and retraining of the model will be important to: Tune the model for better performance (https://www.kitploit.com/search/label/Performance) on traffic from the user's specific application Reduce model degradation over time, as threat actors discover new methods and opportunities To address this, users of NGWAF benefit from our packaged end-to-end model retaining pipeline, and can easily trigger model maintenance with a few simple steps without having to dig under the hood. (See Section 3 (https://github.com/FA-PengFei/NGWAF#3-the-library---retraining-sequence-to-reinforce-the-brains--smart-isnt-really-smart-till-you-can-keep-learning) below). 2. The Looking Glass - Scalable Interactive Quarantine Environment | Don't let them go, DETAIN THEM! Contrary to traditional WAFs where malicious traffic are blocked or dropped right away. NGWAF is going with a more flexible approach. Whereby, it redirects and detains malicious actors within a quarantine environment. This environment consists of various interactive emulated honeypots to try and gather more attack methods/data, these data will be utilised to potentially enhance NGWAF's detection rate of more modern and complex attacks. Capturing of Malicious data and Auto-Scrubbing for retraining purposes Currently, NGWAF's quarantine environment forwards all data submitted by the trapped attacker to our ELK stack for analysis and visualisation. The data are auto-scrubbed into different components of the HTTP request, then packaged internally on the environment's backend in JSON format before forwarding. This helps to lower the manpower cost required to clean and index the data when we kickstart the retraining process. Creating your customised quarantine environment NGWAF currently provides users to make changes to the look and feel of the front-end aspect of our honeypots within the quarantine environment (based off a customised version of drupot). Users simply have to replace the assets folder within the docker volume with their front-end assets of choice. NGWAF is also accommodating to users who would like to link

___________________________
@hacking_Attack
@Hacking_Video

their own honeypots as part of the quarantine environment. Users just have to forward the honeypot's HTTP requests to the environment's backend server (backend processes will automatically scrub and forward data to the analysis dashboard - ELK stack). 3. The Library - Retraining Sequence to Reinforce the Brains | Smart isn't really smart till you can keep learning. As new payloads and attack vectors emerge, it is important to upgrade detection capabilities in order to ensure security. Hence, a retraining function is built into NGWAF to ensure defenders are able to train the machine learning model to detect those newer payloads. Retraining of datasets is one of the main features in NGWAF. On our dashboard, users can insert new dataset for retraining, to strengthen and improve the quality of NGWAF detection of malicious payloads.

___________________________
@hacking_Attack
@Hacking_Video

This can be achieved in the following steps: Create a new dataset (.csv) for upload in the following format (empty column, training data, label). You can refer to patch_sqli.csv as an example. Navigate to http://localhost:8088 to view NGWAF admin panel. Select the "Import Dataset" tab and upload the training set you have created

___________________________
@hacking_Attack
@Hacking_Video

Confirm that the training set have been uploaded successfully under the "Manage Datasets" tab.

___________________________
@hacking_Attack
@Hacking_Video

Under "Manage Model" tab, select the dataset(s) you want to retrain the model on and click on the "UPDATE WAF MODEL" button. 

___________________________
@hacking_Attack
@Hacking_Video

Congrats! The model should finish re-training after some time.

___________________________
@hacking_Attack
@Hacking_Video

4. Additional Features: NGWAF uses ELK stack to capture logs of network data that passes through NGWAF, allowing users to monitor the traffic that passes through the NGWAF for further analysis.

___________________________
@hacking_Attack
@Hacking_Video

Google VRP (Acquisitions) — [Insecure Direct Object Reference] 2nd
https://caesarevan23.medium.com/google-vrp-acquisitions-insecure-direct-object-reference-2nd-2ece9b185ade?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi All!, Yuuppp…It’s me again! XD. As the title suggests, I will share how I found the [Insecure Direct Object Reference] vulnerability in…Continue reading on Medium » (https://caesarevan23.medium.com/google-vrp-acquisitions-insecure-direct-object-reference-2nd-2ece9b185ade?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Templates (thm) writeup

https://cdn-images-1.medium.com/max/600/1*D0GhtgkWWS3p7uwHSH1Htw.png
Starting with nmap:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Round Up Your Posse

A Saturday Serial Series:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video