Longjing WAF is written in Python and It is not designed for the high performance in mind. Only Linux is supported.
Longjing WAF can protect your web application from being scanned by Burp Suite, SQLMap, OWASP ZAP, XSSER and Commix even your web application has SQL injection vulnerability. Meanwhile, reflected Cross Site Scripting (XSS) can be detected too.
SQL injection is on the top position of the OWASP Top 10 2017 which can lead to data leakage and/or system compromised. It is a critical vulnerability.
Longjing WAF is a PARTIALLY Open Source Project under GPLv3 License by Samiux. Training and Modelling are NOT open sourced. Demo may be provided when necessary.
The training requires about 3 hours on Intel i7-5500U with 16GB RAM. The accuracy rate is over 99%. The Longjing requires about 3GB RAM to run.
Requirement
- Ubuntu Linux Server 16.04.4 LTS
- Anaconda3
- mitmproxy
- web server
- web application
- SSD is recommended
- at least 8GB RAM
Installation
(A) Install Anaconda
sudo apt install build-essential libssl-dev libffi-dev python3-dev
wget https://repo.continuum.io/archive/Anaconda3-5.1.0-Linux-x86_64.sh
chmod +x Anaconda3-5.1.0-Linux-x86_64.sh
sudo -sH
./Anaconda3-5.1.0-Linux-x86_64.sh
install anaconda3 to
/etc/anaconda3
and then answer "yes" to allow change the .bashrc
of root.source /root/.bashrc
(B) Update Anaconda
sudo -sH
conda update --prefix /etc/anaconda3 anaconda
conda update -n base conda
(B) Install mitmproxy
sudo -sH
conda install pip
pip install mitmproxy
The current version of mitmproxy at this writing is 3.0.3.
Exit to normal user by entering
exit
.(C) Update mitmproxy
sudo -sH
cd /etc/anaconda3
pip install mitmproxy --upgrade
(D) Install Longjing
wget https://www.infosec-ninjas.com/files/longjing-0.8.0.tar.gz
tar -xvzf longjing-0.8.0.tar.gz
cd longjing
nano config.conf
where :
- NET_INF is the network interface of the mitmproxy to be listening
- PORT is port number of the mitmproxy to be listening, e.g. 8080
- CERT is the location path of the private key TLS/SSL certificate of the domain when available. It should be starting with
--certs
.Please read mitmproxy "about certificate" documents for details - Using a custom certificate.
sudo ./install.sh
Finally, make sure to copy
index.html
to the web application root directory.(D) Running
sudo systemctl restart longjing.service
(E) Testing with Tools
Longjing is well tested on Damn Vulnerable Web Application (DVWA) with the following tools :
- Burp Suite on DVWA (sqli and xss blocked except DOM)
- sqlmap on DVWA (tamper also blocked)
- OWASP ZAP on DVWA (sqli and xss blocked)
- xsser on DVWA (xss blocked)
- Commix on DVWA (blocked and Commix will hang in the middle)
That's all! See you.