Forum Discussion

SSHSSH_97332's avatar
SSHSSH_97332
Icon for Nimbostratus rankNimbostratus
Jan 26, 2012

Forceful Browsing attack

i wanted to show the customer sample of detecting this attack , i have Vs directing to a pool member = 10.10.10.1 ( which is a switch )

i access this switch using its Vs ip : http://11.11.11.1

 

to simulate forecful browsing attack , i defined allowed URLs to be http://11.11.11.1 , then tried to access http://11.11.11.1/test , but nothing was logged under reports> charts , please advise ?

 

 

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jan 26, 2012
    SSHSSH

     

     

    I'm not 100% certain on this but in Policy - Blocking - Settings and under Access Violations, do you need to have the boxes for "Login Object Bypassed" ticked e.g. Learn, Alarm or Block?

     

     

    Just a thought on this one.

     

     

    N
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 26, 2012
    Also, if you're new to ASM and want to demo it to one of your customers, you might try talking with your local F5 or partner SE. They should be able to give you some vulnerable applications and sample ASM policies.

     

     

    Aaron