Reversing Engineering a Web Application - For Fun, Behavior & WAF Detection
summary
Describes building a whitelist-plus-behavior detection layer on top of traditional WAFs that comes from reverse-engineering CMS traffic, crawling with Burp and saving pcaps for offline analysis with pcap/tshark, and correlating logs and honeypot data. Implementation uses regex rules, header/HTTP-version heuristics, XML-RPC and wp-login signatures, and real-time file monitoring with OSSEC/inotify. Deployed on ~2,500 sites, generates 2–3 million alerts/day with low false positives, blocks mass XML-RPC pingback DDoS (162k hosts) and large brute-force spikes (tens of thousands of attempts).
AI-written summary · about
chapters (35)
- 0:00Intro
- 1:24About Sucuri Security
- 2:25A Note on the Examples
- 2:52Motivations
- 3:38Agenda
- 4:42Reverse Engineering
- 5:20Whitelisting
- 6:30Our Scope: Waf Detection
- 7:46Detection steps Analyze Application Structure
- 10:04The HTTP Protocol
- 10:50Traffic Analysis
- 13:07GET Request
- 19:26Oh wait! Get a job from the headers...
- 21:16Full Request
- 24:28What's wrong here?
- 25:48What about here?
- 27:12Summary of Flow Parsing
- 28:14File Structure
- 28:41The Basic WP Structure
- 30:04xmlrpc.php
- 31:23XMLRPC Login Attempt
- 32:12Brute forcing New Brute Force Attacks Exploiting XMLRPC in
- 33:22Pingback
- 34:33wp-admin/ "Access"
- 35:44Restriction Samples: .htaccess
- 37:27Mitigating Attack Surface
- 37:48Realtime Monitoring w/ OSSEC
- 39:34Threshold Ideas
- 40:29Special File Permissions
- 42:21Counter Intelligence
- 42:51Behavior: How you look at problems
- 44:12GEO IP Block: Top Attack Countries
- 45:15Top Methods
- 45:36HTTP Version 1.0
- 46:32In summary...
related talks
40mWeb Application Firewalls: Analysis of Detection Logic
37mWeb Application Firewall Bypassing
52mKnock Knock: Understanding Who is Using Your Web Applications
47mLive Hacking: Breaking into Your Web App
14mWeb Application Firewalls: A False Sense of Security?
33mOffensive Javascript Techniques for Red Teamers
42mModern web application bugs
31mWeb Application Honeypot Threat Intelligence