怎么用Gotestwaf测试你的WAF检测能力
这篇文章主要讲解了“怎么用Gotestwaf测试你的WAF检测能力”，文中的讲解内容简单清晰，易于学习与理解，下面请大家跟着小编的思路慢慢深入，一起来研究和学习“怎么用Gotestwaf测试你的WAF检测能力”吧！
关于Gotestwaf
创新互联建站是一家集网站建设,潍城企业网站建设,潍城品牌网站建设,网站定制,潍城网站建设报价,网络营销,网络优化,潍城网站推广为一体的创新建站企业，帮助传统企业提升企业形象加强企业竞争力。可充分满足这一群体相比中小企业更为丰富、高端、多元的互联网需求。同时我们时刻保持专业、时尚、前沿，时刻以成就客户成长自我，坚持不断学习、思考、沉淀、净化自己，让我们为更多的企业打造出实用型网站。
Gotestwaf，全称为Go Test WAF，该工具可以使用不同类型的攻击技术和绕过技术来测试你Web应用程序防火墙的检测能力。Gotestwaf是一个基于Go开发的开源项目，它实现了一种三步请求生成过程，可以对编码器和占位符的Payload进行相乘操作。假设你定义了2个Payload、3个编码器（Base64、JSON和URLencode）和1个占位符（HTTP GET变量）。在这种情况下，Gotestwaf将在测试用例中发送2*3*1=6个请求。Payload
你可以发送的Payload字符串，支持比如说或其他更复杂的东西。当前版本的Gotestwaf还不支持类似宏这样的功能，但我们之后会添加相关支持。由于这是一个YAML字符串，因此你还可以使用二进制编码，具体请参考https://yaml.org/type/binary.html。编码器
数据编码器工具应适用于Payload，支持Base64和JSON Unicode编码（\u0027代替’）等。占位符
占位符位于HTTP请求中，用于存放已编码的Payload。比如说URL参数、URI、POST表单参数或JSON POST主体。工具安装DockerHub
最新版本的Gotestwaf可以通过DockerHub库直接获取：https://hub.docker.com/r/wallarm/gotestwaf。
我们可以直接使用下列命令将项目库拉取到本地：docker pull wallarm/gotestwaf本地Docker构建docker build . --force-rm -t gotestwafdocker run -v ${PWD}/reports:/go/src/gotestwaf/reports gotestwaf --url=https://the-waf-you-wanna-test/
运行命令之后，你将会在reports文件夹下查看到waf-test-report-代码构建
Gotestwaf支持在目前常见的操作系统平台上运行，包括Linux、Windows和macOS，我们可以直接在安装了Go环境的系统上进行源码编译和构建：go build -mod vendor工具配置选项Usage of /go/src/gotestwaf/gotestwaf: --blockRegex string Regex to detect a blocking page with the same HTTP response status code as a not blocked request --blockStatusCode int HTTP status code that WAF uses while blocking requests (default 403) --configPath string Path to the config file (default "config.yaml") --followCookies If true, use cookies sent by the server. May work only with --maxIdleConns=1 --idleConnTimeout int The maximum amount of time a keep-alive connection will live (default 2) --maxIdleConns int The maximum number of keep-alive connections (default 2) --maxRedirects int The maximum number of handling redirects (default 50) --nonBlockedAsPassed If true, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatuscode/PassRegExp as blocked --passRegex string Regex to a detect normal (not blocked) web page with the same HTTP status code as a blocked request --passStatusCode int HTTP response status code that WAF uses while passing requests (default 200) --proxy string Proxy URL to use --randomDelay int Random delay in ms in addition to the delay between requests (default 400) --reportPath string A directory to store reports (default "reports") --sendDelay int Delay in ms between requests (default 400) --testCase string If set then only this test case will be run --testCasesPath string Path to a folder with test cases (default "testcases") --testSet string If set then only this test set's cases will be run --tlsVerify If true, the received TLS certificate will be verified --url string URL to check (default "http://localhost/") --verbose If true, enable verbose logging (default true) --wafName string Name of the WAF product (default "generic") --workers int The number of workers to scan (default 200) --wsURL string WebSocket URL to check工具使用样例测试OWASP ModSecurity核心规则集（CRS）
首先，我们需要构建&运行ModSecurity CRS Docker镜像。我们可以使用下列命令自动拉取、构建和运行ModSecurity CRS Docker镜像：make modsec
或者，你也可以手动配置参数并进行测试：docker pull owasp/modsecurity-crsdocker run -p 8080:80 -d -e PARANOIA=1 --rm owasp/modsecurity-crs
你还可以选择PARANOIA等级来提升测试的安全等级，具体请参考https://coreruleset.org/faq/。
接下来，我们需要使用下列命令来对ModSecurity CRS Docker镜像的安全性进行测试：make scan_local (to run natively)make scan_local_from_docker (to run from docker)
或者，在Docker中手动执行：docker run -v ${PWD}/reports:/go/src/gotestwaf/reports --network="host" gotestwaf --url=http://127.0.0.1:8080/ --verbose
或者，使用下列命令手动运行测试（本地）：go run ./cmd --url=http://127.0.0.1:8080/ --verbose
我们还可以通过wsURL和verbose参数来添加额外的WebSocket URL检测，其中会包含目标进程的详细信息：docker run -v ${PWD}/reports:/go/src/gotestwaf/reports gotestwaf --url=http://172.17.0.1:8080/ --wsURL=ws://172.17.0.1:8080/api/ws --verbose
Gotestwaf的检测结果输出如下：GOTESTWAF : 2021/03/03 15:15:48.072331 main.go:61: Test cases loading startedGOTESTWAF : 2021/03/03 15:15:48.077093 main.go:68: Test cases loading finishedGOTESTWAF : 2021/03/03 15:15:48.077123 main.go:74: Scanned URL: http://127.0.0.1:8080/GOTESTWAF : 2021/03/03 15:15:48.083134 main.go:85: WAF pre-check: OK. Blocking status code: 403GOTESTWAF : 2021/03/03 15:15:48.083179 main.go:97: WebSocket pre-check. URL to check: ws://127.0.0.1:8080/GOTESTWAF : 2021/03/03 15:15:48.251824 main.go:101: WebSocket pre-check: connection is not available, reason: websocket: bad handshakeGOTESTWAF : 2021/03/03 15:15:48.252047 main.go:129: Scanning http://127.0.0.1:8080/GOTESTWAF : 2021/03/03 15:15:48.252076 scanner.go:124: Scanning startedGOTESTWAF : 2021/03/03 15:15:51.210216 scanner.go:129: Scanning Time: 2.958076338sGOTESTWAF : 2021/03/03 15:15:51.210235 scanner.go:160: Scanning finished Negative Tests:+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| TEST SET | TEST CASE | PERCENTAGE, % | BLOCKED | BYPASSED | UNRESOLVED |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| community | community-lfi | 66.67 | 4 | 2 | 0 || community | community-rce | 14.29 | 6 | 36 | 0 || community | community-sqli | 70.83 | 34 | 14 | 0 || community | community-xss | 91.78 | 279 | 25 | 0 || community | community-xxe | 100.00 | 4 | 0 | 0 || owasp | ldap-injection | 0.00 | 0 | 8 | 0 || owasp | mail-injection | 0.00 | 0 | 6 | 6 || owasp | -injection | 0.00 | 0 | 12 | 6 || owasp | path-traversal | 38.89 | 7 | 11 | 6 || owasp | shell-injection | 37.50 | 3 | 5 | 0 || owasp | sql-injection | 33.33 | 8 | 16 | 8 || owasp | ss-include | 50.00 | 5 | 5 | 10 || owasp | sst-injection | 45.45 | 5 | 6 | 9 || owasp | xml-injection | 100.00 | 12 | 0 | 0 || owasp | xss-scripting | 56.25 | 9 | 7 | 12 || owasp-api | graphql | 100.00 | 1 | 0 | 0 || owasp-api | rest | 100.00 | 2 | 0 | 0 || owasp-api | soap | 100.00 | 2 | 0 | 0 |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| DATE: | WAF NAME: | WAF AVERAGE SCORE: | BLOCKED (RESOLVED): | BYPASSED (RESOLVED): | UNRESOLVED: || 2021-03-03 | GENERIC | 55.83% | 381/534 (71.35%) | 153/534 (28.65%) | 57/591 (9.64%) |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+ Positive Tests:+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| TEST SET | TEST CASE | PERCENTAGE, % | BLOCKED | BYPASSED | UNRESOLVED |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| false-pos | texts | 50.00 | 1 | 1 | 6 |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+| DATE: | WAF NAME: | WAF POSITIVE SCORE: | FALSE POSITIVE (RES): | TRUE POSITIVE (RES): | UNRESOLVED: || 2021-03-03 | GENERIC | 50.00% | 1/2 (50.00%) | 1/2 (50.00%) | 6/8 (75.00%) |+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+ PDF report is ready: reports/waf-evaluation-report-generic-2021-March-03-15-15-51.pdf项目地址Gotestwaf：
https://github.com/wallarm/gotestwaf
新闻名称：怎么用Gotestwaf测试你的WAF检测能力
网站路径：http://myzitong.com/article/icjdhj.html