WAF Policy OWASP — Bảo Vệ Web App

RG="rg-lab26-appgw"

# Upgrade AppGW từ Standard_v2 lên WAF_v2
az network application-gateway update \
  --resource-group $RG \
  --name appgw-lab26 \
  --sku WAF_v2

# Xác nhận SKU đã đổi
az network application-gateway show \
  --resource-group $RG \
  --name appgw-lab26 \
  --query "{sku:sku.name,tier:sku.tier,state:provisioningState}" \
  --output table

RG="rg-lab26-appgw"

# Tạo WAF Policy với OWASP CRS 3.2, chế độ Detection
az network application-gateway waf-policy create \
  --resource-group $RG \
  --name waf-policy-lab27 \
  --location southeastasia

# Cập nhật managed rule set: OWASP 3.2
az network application-gateway waf-policy managed-rule rule-set add \
  --resource-group $RG \
  --policy-name waf-policy-lab27 \
  --type OWASP \
  --version 3.2

# Đặt mode Detection (log nhưng không block, để baseline trước)
az network application-gateway waf-policy policy-setting update \
  --resource-group $RG \
  --policy-name waf-policy-lab27 \
  --mode Detection \
  --state Enabled \
  --max-request-body-size-kb 128

# Lấy AppGW resource ID
APPGW_ID=$(az network application-gateway show \
  --resource-group $RG --name appgw-lab26 --query id --output tsv)

# Gắn WAF Policy vào AppGW
az network application-gateway update \
  --resource-group $RG \
  --name appgw-lab26 \
  --waf-policy waf-policy-lab27

# Xác nhận WAF Policy đã gắn
az network application-gateway show \
  --resource-group $RG --name appgw-lab26 \
  --query "firewallPolicy.id" --output tsv

RG="rg-lab26-appgw"

# Tạo Log Analytics Workspace (nếu chưa có)
az monitor log-analytics workspace create \
  --resource-group $RG \
  --workspace-name law-lab27 \
  --location southeastasia \
  --sku PerGB2018 \
  --retention-time 30

LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group $RG --workspace-name law-lab27 \
  --query id --output tsv)

APPGW_ID=$(az network application-gateway show \
  --resource-group $RG --name appgw-lab26 --query id --output tsv)

# Bật WAF Firewall log gửi về Log Analytics
az monitor diagnostic-settings create \
  --resource "$APPGW_ID" \
  --name diag-appgw-waf \
  --workspace "$LAW_ID" \
  --logs '[
    {"category":"ApplicationGatewayFirewallLog","enabled":true},
    {"category":"ApplicationGatewayAccessLog","enabled":true},
    {"category":"ApplicationGatewayPerformanceLog","enabled":true}
  ]' \
  --metrics '[{"category":"AllMetrics","enabled":true}]'

echo "Diagnostic settings created. WAF logs will flow to Log Analytics."

# Lấy AppGW Public IP
APPGW_IP=$(az network public-ip show \
  --resource-group rg-lab26-appgw --name pip-appgw-lab26 \
  --query ipAddress --output tsv)

echo "AppGW IP: $APPGW_IP"

# Test 1: Request bình thường — phải trả về HTTP 200
echo "--- Normal request ---"
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://$APPGW_IP/

# Test 2: SQL Injection — WAF phải block (HTTP 403)
echo "--- SQL Injection test ---"
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  "http://$APPGW_IP/?id=1%27%20OR%20%271%27=%271"

# Test 3: XSS payload — WAF phải block (HTTP 403)
echo "--- XSS test ---"
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  "http://$APPGW_IP/?q="

# Test 4: Path traversal — WAF phải block (HTTP 403)
echo "--- Path traversal test ---"
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  "http://$APPGW_IP/../../etc/passwd"

# Test 5: User-Agent injection (HTTP Header attack)
echo "--- Header injection test ---"
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -H "User-Agent: () { :;}; echo Content-Type: text/html; echo; /bin/cat /etc/passwd" \
  http://$APPGW_IP/

RG="rg-lab26-appgw"

# Thêm custom rule: block một IP cụ thể (ví dụ block 1.2.3.4)
# Priority thấp hơn = ưu tiên hơn managed rules (priority 1 = first)
az network application-gateway waf-policy custom-rule create \
  --resource-group $RG \
  --policy-name waf-policy-lab27 \
  --name block-bad-ip \
  --priority 1 \
  --rule-type MatchRule \
  --action Block

# Thêm match condition: RemoteAddr equals 1.2.3.4
az network application-gateway waf-policy custom-rule match-condition add \
  --resource-group $RG \
  --policy-name waf-policy-lab27 \
  --rule-name block-bad-ip \
  --match-variables RemoteAddr \
  --operator IPMatch \
  --values "1.2.3.4/32"

# Xem danh sách custom rules
az network application-gateway waf-policy custom-rule list \
  --resource-group $RG \
  --policy-name waf-policy-lab27 \
  --output table