Lightbulb Framework - Tools For Auditing Wafs

Lightbulb Framework - Tools For Auditing Wafs - Hi friends mederc, In the article that you read this time with the title Lightbulb Framework - Tools For Auditing Wafs, We have prepared this article well for you to read and retrieve information from it. hopefully fill the posts Article Burp, Article Burp Extension, Article Code Review, Article Configuration, Article Extension, Article Fingerprinting, Article Firewall, Article Framework, Article Lightbulb Framework, Article Linux, Article Privacy, Article Python, Article vulnerabilities, Article Vulnerability, Article XSS, Article XSS Attacks, we write this you can understand. Alright, happy reading.

Title : Lightbulb Framework - Tools For Auditing Wafs
link : Lightbulb Framework - Tools For Auditing Wafs

ALSO READ


Lightbulb Framework - Tools For Auditing Wafs


LightBulb is an opened upwards source python framework for auditing spider web application firewalls as well as filters.

Synopsis
The framework consists of ii top dog algorithms:
  • GOFA: An active learning algorithm that infers symbolic representations of automata inwards the measure membership/equivalence inquiry model.
    Active learning algorithms permits the analysis of filter as well as sanitizer programs remotely, i.e. given simply the mightiness to inquiry the targeted plan as well as honour the output.
  • SFADiff: Influenza A virus subtype H5N1 black-box differential testing algorithm based on Symbolic Finite Automata (SFA) learning
    Finding differences betwixt programs alongside similar functionality is an of import safety work every bit such differences tin live on used for fingerprinting or creating evasion attacks against safety software similar Web Application Firewalls (WAFs) which are designed to give away malicious inputs to spider web applications.

Motivation
Web Applications Firewalls (WAFs) are primal edifice blocks of modern application security. For example, the PCI measure for organizations treatment credit card transactions dictates that whatever application facing the network should live on either protected past times a WAF or successfully transcend a code review process. Nevertheless, despite their popularity as well as importance, auditing spider web application firewalls remains a challenging as well as complex task. Finding attacks that bypass the firewall unremarkably requires proficient domain cognition for a specific vulnerability class. Thus, penetration testers non armed alongside this cognition are left alongside publicly available lists of laid on strings, similar the XSS Cheat Sheet, which are unremarkably insufficient for thoroughly evaluating the safety of a WAF product.

Commands Usage
Main interface commands:
Command Description
core Shows available heart as well as mortal modules
utils Shows available inquiry handlers
info <module> Prints module information
library Enters library
modules Shows available application modules
use <module> Enters module
start <moduleA> <moduleB> Initiate algorithm
help Prints help
status Checks as well as installs required packages
complete Prints bash completion command
Module commands:
Command Description
back Go dorsum to top dog menu
info Prints electrical flow module information
library Enters library
options Shows available options
define <option> <value> Set an choice value
start Initiate algoritm
complete Prints bash completion command
Library commands:
Command Description
back Go dorsum to top dog menu
info <folder\module> Prints requested module information (folder must live on located inwards lightbulb/data/)
cat <folder\module> Prints requested module (folder must live on located inwards lightbulb/data/)
modules <folder> Shows available library modules inwards the requested folder (folder must live on located inwards lightbulb/data/)
search <keywords> Searches available library modules using comma separated keywords
complete Prints bash completion command

Installation

Prepare your system
First yous accept to verify that your scheme supports flex, python dev, pip as well as construct utilities:
For apt platforms (ubuntu, debian...):
    sudo apt-get install flex  sudo apt-get install python-pip  sudo apt-get install python-dev  sudo apt-get install build-essential
(Optional for apt) If yous desire to add together back upwards for MySQL testing:
    sudo apt-get install libmysqlclient-dev
For yum platforms (centos, redhat, fedora...) alongside already installed the extra packages repo (epel-release):
 sudo yum install -y python-pip  sudo yum install -y python-devel  sudo yum install -y wget  sudo yum groupinstall -y 'Development Tools'
(Optional for yum) If yous desire to add together back upwards for MySQL testing:
 sudo yum install -y mysql-devel   sudo yum install -y MySQL-python

Install Lightbulb
In club to utilization the application without consummate packet installation:
git clone https://github.com/lightbulb-framework/lightbulb-framework cd lightbulb-framework brand lightbulb status
In club to perform consummate packet installation. You tin also install it from pip repository. This requires commencement to install the latest setuptools version:
pip install setuptools --upgrade pip install lightbulb-framework lightbulb status
If yous desire to utilization virtualenv:
pip install virtualenv virtualenv env source env/bin/activate pip install lightbulb-framework lightbulb status
The "lightbulb status" dominance volition remove yous to install MySQLdb as well as OpenFst support. If yous utilization virtualenv inwards linux, the "sudo" dominance volition live on required simply for the installation of libmysqlclient-dev package.
It should live on noted that the "lightbulb status" dominance is non necessary if yous are going to utilization the Burp Extension. The argue is that this dominance installs the "openfst" as well as "mysql" bindings as well as the extension past times default is using Jython, which does non back upwards C bindings. It is recommended to utilization the dominance simply if yous desire to modify the Burp extension configuration from the settings as well as enable the native support.
It is also possible to utilization a docker instance:
docker line lightbulb/lightbulb-framework


Install Burp Extension
If yous wishing to utilization the novel GUI, yous tin utilization the extension for the Burp Suite. First yous accept to setup a working environs alongside Burp Proxy as well as Jython
  • Download the latest Jython from here
  • Find your local python packages installation folder*
  • Configure Burp Extender to utilization these values, every bit shown below*


  • Select the novel LightBulb module ("BurpExtension.py") as well as laid the extension type to live on "Python"


*You tin ignore this step, as well as install the standalone version which contains all the required python packages included. You tin download it here

Examples
Check out the Wiki page for usage examples.

Contributors
  • George Argyros
  • Ioannis Stais
  • Suman Jana
  • Angelos D. Keromytis
  • Aggelos Kiayias

References
  • G. Argyros, I. Stais, S. Jana, A. D. Keromytis, as well as A. Kiayias. 2016. SFADiff: Automated Evasion Attacks as well as Fingerprinting Using Black-box Differential Automata Learning. In Proceedings of the 2016 ACM SIGSAC Conference on Computer as well as Communications Security (CCS '16). ACM, New York, NY, USA, 1690-1701. doi: 10.1145/2976749.2978383
  • G. Argyros, I. Stais, A. Kiayias as well as A. D. Keromytis, "Back inwards Black: Towards Formal, Black Box Analysis of Sanitizers as well as Filters," 2016 IEEE Symposium on Security as well as Privacy (SP), San Jose, CA, 2016, pp. 91-109. doi: 10.1109/SP.2016.14




Thus the article Lightbulb Framework - Tools For Auditing Wafs

That's all the article Lightbulb Framework - Tools For Auditing Wafs this time, hopefully can benefit you all. okay, see you in another article posting.

You are now reading the article Lightbulb Framework - Tools For Auditing Wafs with the link address https://mederc.blogspot.com/2019/09/lightbulb-framework-tools-for-auditing.html

Iklan Atas Artikel

Iklan Tengah Artikel 1

Iklan Tengah Artikel 2

Iklan Bawah Artikel