# Az - Front Door

{{#include ../../../banners/hacktricks-training.md}}

## RemoteAddr Bypass

This **[blog post](https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass)** verduidelik hoe, wanneer jy sekere netwerkbeperkings met Azure Front Door konfigureer, jy kan filter op **`RemoteAddr`** of **`SocketAddr`**. Die hoofverskil is dat **`RemoteAddr`** die waarde uit die **`X-Forwarded-For`** HTTP-kop gebruik, wat dit baie maklik maak om te bypass.

Om hierdie reël te bypass kan outomatiese gereedskap gebruik word wat **brute-force IP addresses** totdat dit 'n geldige een vind.

Dit word in die [Microsoft documentation](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction) genoem.

## Credential Skimming via WAF Custom Rules + Log Analytics

Misbruik Azure Front Door (AFD) WAF Custom Rules in kombinasie met Log Analytics om cleartext credentials (of other secrets) wat deur die WAF traverse, vas te vang. Dit is nie 'n CVE nie; dit is misbruik van wettige funksies deur enigiemand wat die WAF-beleid kan wysig en die logs kan lees.

Key behavior enabling this:
- AFD WAF Custom Rules can match on request elements including headers and POST parameters.
- When a Custom Rule uses the action Log traffic only, evaluation continues and traffic proceeds (no short-circuit), keeping the flow normal/stealthy.
- AFD writes verbose diagnostics to Log Analytics under Category FrontDoorWebApplicationFirewallLog. Matched payload details are included in details_matches_s along with the rule name in ruleName_s.

### Einde-tot-einde werkvloei

1. Identify target POST parameters
- Inspekteer die login form en noteer parametername (e.g., username, password).

2. Enable diagnostics to Log Analytics
- In your Front Door profile > Monitoring > Diagnostic settings, stuur logs na 'n Log Analytics workspace.
- At minimum, enable the category: FrontDoorWebApplicationFirewallLog.

3. Create a malicious Custom Rule
- Front Door WAF Policy > Custom rules > New rule:
- Name: onskuldige naam, e.g., PasswordCapture
- Priority: lae nommer (e.g., 5) sodat dit vroeg evalueer
- Match: POST arguments username and password with Operator = Any (match any value)
- Action: Log traffic only

4. Genereer gebeure
```bash
curl -i -X POST https://example.com/login \
-H "Content-Type: application/x-www-form-urlencoded" \
--data "username=alice&password=S3cret!"
```
5. Haal credentials uit Log Analytics (KQL)
```kusto
AzureDiagnostics
| where Category == "FrontDoorWebApplicationFirewallLog"
| where ruleName_s == "PasswordCapture"
| project TimeGenerated, ruleName_s, details_matches_s
| order by TimeGenerated desc
```
Ek het die lêerinhoud nodig. Plak asseblief die volledige inhoud van src/pentesting-cloud/azure-security/az-services/az-front-door.md en ek vertaal dit na Afrikaans terwyl ek alle markdown- en HTML-tags, kodeblokkies, skakels en paths onveranderd laat.
```kusto
AzureDiagnostics
| where Category == "FrontDoorWebApplicationFirewallLog" and ruleName_s == "PasswordCapture"
| extend m = parse_json(details_matches_s)
| mv-expand match = m.matches
| project TimeGenerated, ruleName_s, match.matchVariableName, match.matchVariableValue
| order by TimeGenerated desc
```
Die matched values verskyn in details_matches_s en sluit die cleartext waardes in wat by jou reël gepas het.

### Why Front Door WAF and not Application Gateway WAF?
- Application Gateway WAF custom-rule logs sluit nie die lasterende POST/header waardes op dieselfde manier in nie; AFD WAF diagnostics sluit matched content in details in, wat credential capture moontlik maak.

### Stealth and variants
- Stel Action op 'Log traffic only' om te voorkom dat versoeke gebreek word en om ander reëls normaal te laat evalueer.
- Gebruik 'n lae numeriese Priority sodat jou logging rule evalueer voordat enige latere Block/Allow reëls.
- Jy kan enige sensitiewe name/liggings teiken, nie net POST params nie (bv. headers soos Authorization of API tokens in body fields).

### Prerequisites
- 'n Bestande Azure Front Door instance.
- Magtigings om die AFD WAF policy te wysig en die geassosieerde Log Analytics workspace te lees.

## References

- [https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass](https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass)
- [Skimming Credentials with Azure's Front Door WAF](https://trustedsec.com/blog/skimming-credentials-with-azures-front-door-waf)
- [Azure WAF on Front Door monitoring and logging](https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor)

{{#include ../../../banners/hacktricks-training.md}}
