{"id":73,"date":"2025-06-16T20:31:04","date_gmt":"2025-06-16T18:31:04","guid":{"rendered":"https:\/\/borjor.org.es\/?p=73"},"modified":"2025-06-16T20:31:48","modified_gmt":"2025-06-16T18:31:48","slug":"firewall-para-aplicaciones-web","status":"publish","type":"post","link":"https:\/\/borjor.org.es\/?p=73","title":{"rendered":"Firewall para aplicaciones Web"},"content":{"rendered":"\n<p>Vamos a instalar la versi\u00f3n de prueba de <a href=\"https:\/\/github.com\/chaitin\/SafeLine\">SafeLine<\/a>.<\/p>\n\n\n\n<p>Con un s\u00f3lo comando descarga las im\u00e1genes de Docker y las levanta.<\/p>\n\n\n\n<p><em>sudo bash -c \u00ab$(curl -fsSLk https:\/\/waf.chaitin.com\/release\/latest\/setup.sh)\u00bb<\/em><\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"290\" data-id=\"75\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859-1024x290.png\" alt=\"\" class=\"wp-image-75\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859-1024x290.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859-300x85.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859-768x218.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859-1536x435.png 1536w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-194859.png 1599w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/figure>\n\n\n\n<p>Como aplicaci\u00f3n web de prueba usaremos <a href=\"https:\/\/github.com\/juice-shop\/juice-shop?tab=readme-ov-file#docker-container\">Juicy Shop<\/a> que est\u00e1 llena de vulnerabilidades y tambi\u00e9n se puede usar desde Docker.<\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-2 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"583\" data-id=\"76\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-1024x583.png\" alt=\"\" class=\"wp-image-76\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-1024x583.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-300x171.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-768x438.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-1536x875.png 1536w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/Captura-de-pantalla-2025-06-16-195246-2048x1167.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/figure>\n\n\n\n<p>Configuramos la protecci\u00f3n<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"726\" height=\"584\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen.png\" alt=\"\" class=\"wp-image-77\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen.png 726w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-300x241.png 300w\" sizes=\"auto, (max-width: 726px) 100vw, 726px\" \/><\/figure>\n\n\n\n<p>Y para probar recurriremos a un <a href=\"https:\/\/github.com\/realad\/waf-testing\">script<\/a> que nos haga unos test sencillos.<\/p>\n\n\n\n<p>Primero sin pasar por el WAF:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"574\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-1-1024x574.png\" alt=\"\" class=\"wp-image-78\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-1-1024x574.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-1-300x168.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-1-768x431.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-1.png 1400w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Ahora activamos el modo de defensa<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"860\" height=\"299\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-2.png\" alt=\"\" class=\"wp-image-79\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-2.png 860w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-2-300x104.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-2-768x267.png 768w\" sizes=\"auto, (max-width: 860px) 100vw, 860px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"461\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-3-1024x461.png\" alt=\"\" class=\"wp-image-80\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-3-1024x461.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-3-300x135.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-3-768x346.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-3.png 1267w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>No est\u00e1 mal, pero a\u00fan se han colado cosas. Ponemos la protecci\u00f3n anti-bot.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"663\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-4-1024x663.png\" alt=\"\" class=\"wp-image-81\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-4-1024x663.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-4-300x194.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-4-768x497.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-4.png 1143w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"521\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-5-1024x521.png\" alt=\"\" class=\"wp-image-82\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-5-1024x521.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-5-300x153.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-5-768x391.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-5.png 1397w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Se ha utilizado un CAPTCHA ante el script, pero como no ha bloqueado la petici\u00f3n con un error 403, considera que la protecci\u00f3n no es buena.<\/p>\n\n\n\n<p>Para mejorar un poco m\u00e1s la protecci\u00f3n, vamos a poner todos los modos de bloqueo en modo estricto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"995\" height=\"1024\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-6-995x1024.png\" alt=\"\" class=\"wp-image-83\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-6-995x1024.png 995w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-6-291x300.png 291w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-6-768x791.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-6.png 1252w\" sizes=\"auto, (max-width: 995px) 100vw, 995px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"663\" src=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-7-1024x663.png\" alt=\"\" class=\"wp-image-84\" srcset=\"https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-7-1024x663.png 1024w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-7-300x194.png 300w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-7-768x497.png 768w, https:\/\/borjor.org.es\/wp-content\/uploads\/2025\/06\/imagen-7.png 1234w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>A\u00fan se nos han colado 4 ataques, deber\u00edamos crear reglas personalizadas pero no est\u00e1n disponibles en la versi\u00f3n de prueba.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Vamos a instalar la versi\u00f3n de prueba de SafeLine. Con un s\u00f3lo comando descarga las im\u00e1genes de Docker y las levanta. sudo bash -c \u00ab$(curl -fsSLk https:\/\/waf.chaitin.com\/release\/latest\/setup.sh)\u00bb Como aplicaci\u00f3n web de prueba usaremos Juicy Shop que est\u00e1 llena de vulnerabilidades y tambi\u00e9n se puede usar desde Docker. Configuramos la protecci\u00f3n Y para probar recurriremos a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-73","post","type-post","status-publish","format-standard","hentry","category-waf"],"_links":{"self":[{"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borjor.org.es\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=73"}],"version-history":[{"count":1,"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/posts\/73\/revisions"}],"predecessor-version":[{"id":85,"href":"https:\/\/borjor.org.es\/index.php?rest_route=\/wp\/v2\/posts\/73\/revisions\/85"}],"wp:attachment":[{"href":"https:\/\/borjor.org.es\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borjor.org.es\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borjor.org.es\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}