Azure Sentinel – Detectar SQL Injection

What is Azure Web Application Firewall on Azure Application Gateway? - Azure  Web Application Firewall | Microsoft Docs

Azure Web Application Firewall es un servicio nativo de nube que protege las aplicaciones web frente a técnicas comunes de pirateo web, como la inyección de código SQL, y vulnerabilidades de seguridad, como los scripts entre sitios. Implemente el servicio en cuestión de minutos para obtener una visibilidad completa de su entorno y bloquear los ataques malintencionados.

El monitoreo de Azure WAF se puede realizar a través de:

  • Azure Monitor
  • Azure Security Center (predeterminado)
  • Azure Sentinel ( Azure WAF Data Connector requiere la configuración de diagnóstico de Application Gateway para enviar los datos a Azure Sentinel Log Analytics )
Leer más

Cyberdefenders – DetectLog4j writeup


For the last week, log4shell vulnerability has been gaining much attention not for its ability to execute arbitrary commands on the vulnerable system but for the wide range of products that depend on the log4j library. Many of them are not known till now. We created a challenge to test your ability to detect, analyze, mitigate and patch products vulnerable to log4shell.


Leer más

Cyberdefenders – Bucket writeup


Welcome, Defender! As an incident responder, we’re granting you access to the AWS account called «Security» as an IAM user. This account contains a copy of the logs during the time period of the incident and has the ability to assume the «Security» role in the target account so you can look around to spot the misconfigurations that allowed for this attack to happen.


Your IAM credentials for the Security account:

  • Login:
  • Account ID: 322079859186
  • Username: security
  • Password: password
  • Secret Key: paVI8VgTWkPI3jDNkdzUMvK4CcdXO2T7sePX0ddF


The credentials above give you access to the Security account, which can assume the role of «security» in the Target account. You also have access to an S3 bucket, named flaws2_logs, in the Security account, that contains the CloudTrail logs recorded during a successful compromise

Leer más