{"id":19745528,"url":"https://github.com/cossacklabs/acra-censor-demo","last_synced_at":"2025-04-30T07:34:30.667Z","repository":{"id":45956708,"uuid":"156824096","full_name":"cossacklabs/acra-censor-demo","owner":"cossacklabs","description":"AcraCensor (SQL firewall) example project: see how to configure AcraCensor to prevent SQL injections in vulnerable OWASP web application.","archived":false,"fork":false,"pushed_at":"2021-11-24T16:34:03.000Z","size":3695,"stargazers_count":6,"open_issues_count":1,"forks_count":5,"subscribers_count":9,"default_branch":"master","last_synced_at":"2023-08-19T17:12:31.976Z","etag":null,"topics":["acra","data-protection","data-security","database","docker","encryption","firewall","mutillidae","owasp","playground","sql","sqlfirewall","sqlinjection","waf"],"latest_commit_sha":null,"homepage":"https://www.cossacklabs.com/acra/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cossacklabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-11-09T07:10:14.000Z","updated_at":"2023-05-12T16:52:53.000Z","dependencies_parsed_at":"2022-08-23T19:00:29.466Z","dependency_job_id":null,"html_url":"https://github.com/cossacklabs/acra-censor-demo","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cossacklabs%2Facra-censor-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cossacklabs%2Facra-censor-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cossacklabs%2Facra-censor-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cossacklabs%2Facra-censor-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cossacklabs","download_url":"https://codeload.github.com/cossacklabs/acra-censor-demo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224202862,"owners_count":17272807,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acra","data-protection","data-security","database","docker","encryption","firewall","mutillidae","owasp","playground","sql","sqlfirewall","sqlinjection","waf"],"created_at":"2024-11-12T02:09:21.786Z","updated_at":"2024-11-12T02:09:22.742Z","avatar_url":"https://github.com/cossacklabs.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# What is this?\n\nThis project illustrates how to use [AcraCensor](https://docs.cossacklabs.com/pages/documentation-acra/#acracensor-acra-s-firewall) as SQL firewall to prevent SQL injections. Target application is a well-known vulnerable web application [OWASP Mutillidae 2](https://github.com/webpwnized/mutillidae). \n\nAcraCensor – is a built-in SQL firewall of [Acra data protection suite](https://cossacklabs.com/acra/). This project is one of numerous Acra's example applications. If you are curious about other Acra features, like transparent encryption, intrusion detection, load balancing support – [Acra Example Applications](https://github.com/cossacklabs/acra-engineering-demo/).\n\n# What's inside?\n\nThe demo project has a [Docker compose file](docker-compose.acra-censor-demo.yml) that runs the following web infrastructure:\n- OWASP Mutillidae web application,\n- [Acra encryption suite](https://github.com/cossacklabs/acra).\n\nAcra works as a proxy between web and database. AcraCensor inspects every SQL query that runs from the web application to the database, and back.\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"images/acra-censor-scheme.png\" alt=\"Protecting OWASP web application: Acra architecture with AcraCensor\" width=\"700\"\u003e\u003c/p\u003e\n\nThis is a slide from [a talk by Cossack Labs' security software engineer Artem Storozhuk](https://speakerdeck.com/storojs72/building-sql-firewall-insights-from-developers) on building SQL firewalls, which illustrates how SQL firewalls can prevent more SQLi than WAF.\n\n\u003cimg src=\"images/SQL-firewall-vs-WAF.png\" width=\"600\"\u003e\n\n\n## Screencast\n\n\u003ca href=\"https://youtu.be/ABjIfx2_hJk\" target=\"_blank\"\u003e\u003cimg src=\"images/youtube-video.png\" alt=\"Watch the video\" width=\"700\"\u003e\u003c/a\u003e \n\n\n## How to run the demo\n\n1. Use docker-compose command to set up and run the whole infrastructure: \n\n```\ndocker-compose -f docker-compose.acra-censor-demo.yml up\n```\n\n\u003cimg src=\"images/image_1.png\" width=\"700\"\u003e\n\n\n2. Check that the containers are up and running: \n\n```\ndocker ps -a\n``` \n\n\u003cimg src=\"images/image_2.png\" width=\"700\"\u003e\n\n3. Open Mutillidae web portal at `localhost:8080`:\n\n\u003cimg src=\"images/image_3.png\" width=\"700\"\u003e\n\n4. The database is still empty so we need to fill it first by clicking on `setup/reset the DB`. \n\nIn the Docker console you should see SQL queries in Acra logs. After resetting the database, the main page of Mutillidae application looks like this:\n\n\u003cimg src=\"images/image_4.png\" width=\"700\"\u003e\n\n## How to perform SQL injections\n\n1. Start with selecting a vulnerable web page. In the menu on the left, go to \"OWASP 2017\" -\u003e \"A1 - Injection (SQL)\" -\u003e \"SQLi - Extract data\" -\u003e User Info (SQL).\n\n\u003cimg src=\"images/image_5.png\" width=\"700\"\u003e\n\u003cimg src=\"images/image_5a.png\" width=\"700\"\u003e\n\n2. Now, let's run an SQL injection. Try to login any name and password `' or 1='1`. \n\nThis will construct an SQL query `SELECT * FROM accounts WHERE username='' AND password='' or 1='1'` — containing a typical SQL injection — to the database. \n\n\u003cimg src=\"images/image_6.png\" width=\"700\"\u003e\n\n\n## How AcraCensor prevents SQL injections\n\n1. Now, let's fine-tune AcraCensor for preventing this injection. \n\nThere are configuration files in `./.acraconfigs/acra-server/` folder:\n- `acra-censor.norules.yaml` (minimal configuration that simply creates valueless AcraCensor);\n- `acra-censor.ruleset01.yaml` (example: ruleset based on typical allowlist - allow some / deny any other);\n- `acra-censor.ruleset02.yaml` (example: ruleset based on typical denylist - deny some / allow any other);\n- `acra-censor.yaml` (active config, used by AcraCensor).\n\nAcraCensor uses empty configuration file by default (no rules setup at all). We need to update the configuration file to change that.\n\nReplace the active config with `acra-censor.ruleset01.yaml` (or `acra-censor.ruleset02.yaml`) and restart the `acra-server` container:\n\n```bash\ncp ./.acraconfigs/acra-server/acra-censor.ruleset01.yaml ./.acraconfigs/acra-server/acra-censor.yaml\ndocker restart \u003cname or ID of acra-censor-demo_acra-server container\u003e\n```\n\nIn the docker log, you will see that AcraServer has restarted with an updated configuration file:\n\n```bash\nacra-server_1_979c50cd7b3e | time=\"2019-02-05T18:53:22Z\" level=info msg=\"Server graceful shutdown completed, bye PID: 1\"\nacra-censor-demo-master_acra-server_1_979c50cd7b3e exited with code 0\n```\n\n\n2. Test if the new AcraCensor configuration prevents injections.\n\nOn the same web page, try to login again using the password `' or 1='1`. \n\nYou should see that the response from MySQL server is blocked. In Acra's console, you can see that the malicious query is forbidden: \n\n\u003cimg src=\"images/image_7.png\" width=\"700\"\u003e\n\n3. Try other SQL injections.\n\nYou can also test the process of blocking other injections (if applies to any of the provided rulesets):\n- into Name or Password textbox: `qwerty' OR 6=6 -- `;\n- into Password textbox: `' union select ccid,ccnumber,ccv,expiration,null,null,null from credit_cards -- `.\n\n4. Try other vulnerable web pages. Select one of the following:\n\n- OWASP 2017 -\u003e A1 Injection (SQL) -\u003e SQLi Bypass Authentication -\u003e Login\n- OWASP 2017 -\u003e A1 Injection (SQL) -\u003e Blind SQL via Timing -\u003e Login\n- OWASP 2017 -\u003e A2 Broken authentication ... -\u003e Authentication bypass -\u003e via SQL injection -\u003e Login\n\nand try to use `admin` as a username and `' or 1='1` as a password.\n\n## Learn more\n\n1. Read more about [how SQL firewall works and how it is different from WAF](https://www.cossacklabs.com/blog/sql-firewall-vs-waf-against-sqli.html).\n2. Read out blog post [how we built AcraCensor](https://www.cossacklabs.com/blog/how-to-build-sql-firewall-acracensor.html).\n3. Watch the slides about the developers' perspective on [building SQL firewall](https://speakerdeck.com/storojs72/building-sql-firewall-insights-from-developers).\n4. Check [Mutillidae repository](https://github.com/webpwnized/mutillidae).\n5. Check [Mutillidae docker image by @edoz90](https://github.com/edoz90/docker-mutillidae).\n\n# Further steps\n\nLet us know if you have any questions by dropping an email to [dev@cossacklabs.com](mailto:dev@cossacklabs.com).\n\n1. [Acra features](https://cossacklabs.com/acra/) – check out full features set and available licenses.\n2. Other [Acra example applications](https://github.com/cossacklabs/acra-engineering-demo/) – try other Acra features, like transparent encryption, SQL firewall, load balancing support.\n\n# Need help?\n\nNeed help in configuring Acra? Our support is available for [Acra Pro and Acra Enterprise versions](https://www.cossacklabs.com/acra/#pricing).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcossacklabs%2Facra-censor-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcossacklabs%2Facra-censor-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcossacklabs%2Facra-censor-demo/lists"}