網頁應用層防火牆滲透威脅實驗模擬環境

Cyber Lab for Penetrating Web Application Firewall

劉上宇(Shang-Yu Liu)

指導教授 ： 許振銘

健行科技大學/電資學院/資訊工程系碩士班/碩士(2020年)

摘要

資訊科技的日新月異與網路的普及，造就了網際網路攻擊行為的快速發展與擴張。然而由於現在的很多攻擊行為皆透過攻擊網站，達到入侵企業組織伺服器來獲取商業機密，但現今網頁應用層防火牆品牌與種類眾多，而且要找到符合企業環境的網頁應用層防火牆也需要經過精挑細選，甚至透過試用該產品的方式才能知道是否採用該產品來保護企業的網站。
為了瞭解網頁應用層防火牆的基本運作模式，因此本論文採用開源的ModSecurity搭配企業網站模擬環境，藉此深入了解如何部署網頁應用層防火牆與其運作方式，另外透過搭配OWASP ModSecurity Core Rule Set的規則是否可以阻擋OWASP TOP 10內的攻擊手法。再藉由本論文所研究出的攻擊語法來滲透測試該受測端，觀察網頁應用層防火牆的效果。

關鍵字

網路攻擊 ； 網頁應用層防火牆 ； 網站安全 ； 滲透測試 ； 網站威脅 ； 攻擊手法

並列摘要

The development of information technology and the popularity of the Internet have caused a rapid expansion of Internet attacks. Since many attackers obtain business secrets by attacking website servers, many companies have successively built firewalls to protect the safety of websites. However, there are many brands and types of web application layer firewalls on the market. If you want to find a web application firewall that meets the corporate environment, you must choose carefully. You may even know if you want to use this product to protect the security of your website after you have tried the product.
In order to understand the basic operation mode of the web application layer firewall, this paper use open source ModSecurity and the corporate website simulation environment to understand how to deploy the web application firewall and its operation method. In addition, we also use the OWASP ModSecurity Core Rule Set rules to test whether it can block OWASP all attacks of TOP 10. Finally, we use the attack scripts developed in this paper to test the website and observe the protective effect of the web application firewall.

並列關鍵字

Cyber attack ； Web Application Firewall ； Website Security ； Penetration Test ； Website Threat ； Attack Technique

參考文獻

(1)卡巴斯基部落格，https://www.kaspersky-member.com.tw/blog/2018/09/11/

(2)Ashikali Hasan,Divyakant Meva(2018).Web Application Safety by Penetration Testing,International Journal of Advanced Studies of Scientific Research, Volume 3, Issue 9, 2018

(3)網路防禦新架構—應用層防火牆，https://www.ithome.com.tw/node/34843

(4)Varsha R Moulia,KP Jevitha(2016.)Web Services Attacks and Security- A Systematic Literature Review.International Conference On Advances In Computing & Communications,September 2016 ,Procedia Computer Science 93,page:870–877

(5)Check Point 2020年度網路安全報告：台企對網路攻擊毫無抵抗力， https://www.chinatimes.com/realtimenews/20200120003698-260412?chdtv