Testing with attack tooling

After setting up the Next-Gen WAF, we recommend testing your setup by running attack tooling against your website to verify that attack data is being captured and blocking is working correctly.

While you can use any attack tooling for testing, we recommend using Nikto which tests a wide variety of vulnerabilities. While Nikto is running, Next-Gen WAF agents will identify any malicious or anomalous requests and send relevant metadata to our backend, after redacting any sensitive information.

This guide explains how to set up Nikto and run three different testing scenarios:

1. Testing attack tooling detection
2. Testing attack detection
3. Testing attack blocking

Before you begin

Nikto requires Perl to be installed. Run perl -v to check if you have Perl installed on your system. If Perl is not found, you can download and install it from the Perl website.

Setting up Nikto

Nikto is a common open source tool used for running security tests against web servers. It can run on Linux, OS X, and Windows platforms. To set up Nikto:

1. Download the latest version of Nikto.
2. Using command prompt, navigate to the directory where you downloaded Nikto.
3. Enter unzip nikto-master.zip to unzip the file.
4. Enter cd nikto-master/program/ to change directories to the program directory.
5. Run ./nikto.pl to verify you are able to run Nikto. A default help message appears.

If you receive a permission denied error message, you can resolve the error by running chmod +x nikto.pl which makes the script executable. Then run ./nikto.pl again.

Testing attack tooling detection

Using Nikto, you can test the attack tooling detection feature.

To run this test:

Testing attack detection

After verifying that attack tooling has been detected, you can use Nikto to modify an attack to demonstrate an IP address being flagged due to injection attacks. You can do this by modifying the User-Agent string that is sent with each request.

To run this test:

Testing attack blocking

Next-Gen WAF lets you take a different approach to blocking compared to other products. Instead of being limited to blocking individual requests that match a particular signature, you can implement threshold-based blocking. With threshold-based blocking, we look for spikes in malicious traffic from a particular IP (aggregated across all of our agents) and flag that IP if it exceeds specific thresholds in a 1, 10, or 60 minute window. Once an IP is flagged, we block all malicious traffic from that IP. Traffic is blocked for a default 24 hours. You can use attack thresholds to adjust the thresholds and decrease the blocking time period. During the blocking time period, requests that don’t contain an attack will be allowed, preventing the Next-Gen WAF from breaking normal traffic.

For the final test, enable blocking mode and use Nikto to demonstrate how to allow legitimate traffic to continue accessing the website while blocking malicious traffic from the same IP address. To perform this test, you will need to use a web browser that is on the same system you are running the scan from.

To run this test:

Related content

• Setting up the Next-Gen WAF
• About the protection mode (agent mode)