Merge pull request #126 from f5devcentral/develop

Appworld Pull to Master
f5devcentral · Feb 14, 2025 · cd9ec42 · cd9ec42
2 parents f4105b3 + bf85712
commit cd9ec42
Show file tree

Hide file tree

Showing 187 changed files with 690 additions and 0 deletions.
diff --git a/docs/waf2025/attackfilters.png b/docs/waf2025/attackfilters.png
diff --git a/docs/waf2025/images/._addcurl.png b/docs/waf2025/images/._addcurl.png
diff --git a/docs/waf2025/images/._annoy.png b/docs/waf2025/images/._annoy.png
diff --git a/docs/waf2025/images/._anomaly.png b/docs/waf2025/images/._anomaly.png
diff --git a/docs/waf2025/images/._attackfilters.png b/docs/waf2025/images/._attackfilters.png
diff --git a/docs/waf2025/images/._goodbot.png b/docs/waf2025/images/._goodbot.png
diff --git a/docs/waf2025/images/._juice.png b/docs/waf2025/images/._juice.png
diff --git a/docs/waf2025/images/._mitver.png b/docs/waf2025/images/._mitver.png
diff --git a/docs/waf2025/images/._xrdp.png b/docs/waf2025/images/._xrdp.png
diff --git a/docs/waf2025/images/A3checked.png b/docs/waf2025/images/A3checked.png
diff --git a/docs/waf2025/images/A3list.png b/docs/waf2025/images/A3list.png
diff --git a/docs/waf2025/images/Agility2018LabDiagram.png b/docs/waf2025/images/Agility2018LabDiagram.png
diff --git a/docs/waf2025/images/Illegalmetachar.png b/docs/waf2025/images/Illegalmetachar.png
diff --git a/docs/waf2025/images/Sessions-logins.png b/docs/waf2025/images/Sessions-logins.png
diff --git a/docs/waf2025/images/a1addsignatures.png b/docs/waf2025/images/a1addsignatures.png
diff --git a/docs/waf2025/images/a1initialreview.png b/docs/waf2025/images/a1initialreview.png
diff --git a/docs/waf2025/images/a3check.png b/docs/waf2025/images/a3check.png
diff --git a/docs/waf2025/images/a9check.png b/docs/waf2025/images/a9check.png
diff --git a/docs/waf2025/images/aboutus_menu.png b/docs/waf2025/images/aboutus_menu.png
diff --git a/docs/waf2025/images/aboutus_page.png b/docs/waf2025/images/aboutus_page.png
diff --git a/docs/waf2025/images/add_ip.png b/docs/waf2025/images/add_ip.png
diff --git a/docs/waf2025/images/add_to_cat.png b/docs/waf2025/images/add_to_cat.png
diff --git a/docs/waf2025/images/addcurl.png b/docs/waf2025/images/addcurl.png
diff --git a/docs/waf2025/images/addvs.png b/docs/waf2025/images/addvs.png
diff --git a/docs/waf2025/images/addvs1.png b/docs/waf2025/images/addvs1.png
diff --git a/docs/waf2025/images/advanced2.png b/docs/waf2025/images/advanced2.png
diff --git a/docs/waf2025/images/annoy.png b/docs/waf2025/images/annoy.png
diff --git a/docs/waf2025/images/anomaly.png b/docs/waf2025/images/anomaly.png
diff --git a/docs/waf2025/images/app_pol.png b/docs/waf2025/images/app_pol.png
diff --git a/docs/waf2025/images/attachlogging1.png b/docs/waf2025/images/attachlogging1.png
diff --git a/docs/waf2025/images/attachlogging2.png b/docs/waf2025/images/attachlogging2.png
diff --git a/docs/waf2025/images/attackfilters.png b/docs/waf2025/images/attackfilters.png
diff --git a/docs/waf2025/images/balanced_bot.png b/docs/waf2025/images/balanced_bot.png
diff --git a/docs/waf2025/images/batch_query.png b/docs/waf2025/images/batch_query.png
diff --git a/docs/waf2025/images/bigiplogin.png b/docs/waf2025/images/bigiplogin.png
diff --git a/docs/waf2025/images/blank_vs.png b/docs/waf2025/images/blank_vs.png
diff --git a/docs/waf2025/images/block_sql_injection.png b/docs/waf2025/images/block_sql_injection.png
diff --git a/docs/waf2025/images/block_xss.png b/docs/waf2025/images/block_xss.png
diff --git a/docs/waf2025/images/blocked.png b/docs/waf2025/images/blocked.png
diff --git a/docs/waf2025/images/bot-rate-limit.png b/docs/waf2025/images/bot-rate-limit.png
diff --git a/docs/waf2025/images/bot-whitelist.png b/docs/waf2025/images/bot-whitelist.png
diff --git a/docs/waf2025/images/bot_log.png b/docs/waf2025/images/bot_log.png
diff --git a/docs/waf2025/images/bot_prof.png b/docs/waf2025/images/bot_prof.png
diff --git a/docs/waf2025/images/bot_profile.png b/docs/waf2025/images/bot_profile.png
diff --git a/docs/waf2025/images/bot_traf.png b/docs/waf2025/images/bot_traf.png
diff --git a/docs/waf2025/images/burp.png b/docs/waf2025/images/burp.png
diff --git a/docs/waf2025/images/challenge.png b/docs/waf2025/images/challenge.png
diff --git a/docs/waf2025/images/challenge_s.png b/docs/waf2025/images/challenge_s.png
diff --git a/docs/waf2025/images/challenged.png b/docs/waf2025/images/challenged.png
diff --git a/docs/waf2025/images/crypt_check.png b/docs/waf2025/images/crypt_check.png
diff --git a/docs/waf2025/images/curl.png b/docs/waf2025/images/curl.png
diff --git a/docs/waf2025/images/customer_feedback.png b/docs/waf2025/images/customer_feedback.png
diff --git a/docs/waf2025/images/dataguard_off.png b/docs/waf2025/images/dataguard_off.png
diff --git a/docs/waf2025/images/dataguard_on.png b/docs/waf2025/images/dataguard_on.png
diff --git a/docs/waf2025/images/dbwithblocking.png b/docs/waf2025/images/dbwithblocking.png
diff --git a/docs/waf2025/images/deep_recur.png b/docs/waf2025/images/deep_recur.png
diff --git a/docs/waf2025/images/deploy_waf_policy.png b/docs/waf2025/images/deploy_waf_policy.png
diff --git a/docs/waf2025/images/disablestaging.png b/docs/waf2025/images/disablestaging.png
diff --git a/docs/waf2025/images/disablestagingv2.png b/docs/waf2025/images/disablestagingv2.png
diff --git a/docs/waf2025/images/disallow_md_file_type.png b/docs/waf2025/images/disallow_md_file_type.png
diff --git a/docs/waf2025/images/docker_ps_restart.png b/docs/waf2025/images/docker_ps_restart.png
diff --git a/docs/waf2025/images/dtds-in-xml.png b/docs/waf2025/images/dtds-in-xml.png
diff --git a/docs/waf2025/images/dtds-learning-blocking.png b/docs/waf2025/images/dtds-learning-blocking.png
diff --git a/docs/waf2025/images/dtds-steps.png b/docs/waf2025/images/dtds-steps.png
diff --git a/docs/waf2025/images/dvga_stuck.png b/docs/waf2025/images/dvga_stuck.png
diff --git a/docs/waf2025/images/enable_ipi.png b/docs/waf2025/images/enable_ipi.png
diff --git a/docs/waf2025/images/enforcementURLs.png b/docs/waf2025/images/enforcementURLs.png
diff --git a/docs/waf2025/images/evasion.png b/docs/waf2025/images/evasion.png
diff --git a/docs/waf2025/images/evasiontechniques.png b/docs/waf2025/images/evasiontechniques.png
diff --git a/docs/waf2025/images/event_log_xss.png b/docs/waf2025/images/event_log_xss.png
diff --git a/docs/waf2025/images/events.png b/docs/waf2025/images/events.png
diff --git a/docs/waf2025/images/f5-waf-tester-config.png b/docs/waf2025/images/f5-waf-tester-config.png
diff --git a/docs/waf2025/images/f5-waf-tester-installed.png b/docs/waf2025/images/f5-waf-tester-installed.png
diff --git a/docs/waf2025/images/f5student-home.png b/docs/waf2025/images/f5student-home.png
diff --git a/docs/waf2025/images/file_test.png b/docs/waf2025/images/file_test.png
diff --git a/docs/waf2025/images/first.png b/docs/waf2025/images/first.png
diff --git a/docs/waf2025/images/geo_policy.png b/docs/waf2025/images/geo_policy.png
diff --git a/docs/waf2025/images/geo_violation.png b/docs/waf2025/images/geo_violation.png
diff --git a/docs/waf2025/images/global_event.png b/docs/waf2025/images/global_event.png
diff --git a/docs/waf2025/images/global_ipi.png b/docs/waf2025/images/global_ipi.png
diff --git a/docs/waf2025/images/global_policy.png b/docs/waf2025/images/global_policy.png
diff --git a/docs/waf2025/images/goodbot.png b/docs/waf2025/images/goodbot.png
diff --git a/docs/waf2025/images/graphiql.png b/docs/waf2025/images/graphiql.png
diff --git a/docs/waf2025/images/hamburger_menu.png b/docs/waf2025/images/hamburger_menu.png
diff --git a/docs/waf2025/images/illegal_check.png b/docs/waf2025/images/illegal_check.png
diff --git a/docs/waf2025/images/image001.png b/docs/waf2025/images/image001.png
diff --git a/docs/waf2025/images/image002.png b/docs/waf2025/images/image002.png
diff --git a/docs/waf2025/images/inql.png b/docs/waf2025/images/inql.png
diff --git a/docs/waf2025/images/ipi.png b/docs/waf2025/images/ipi.png
diff --git a/docs/waf2025/images/ipi_global.png b/docs/waf2025/images/ipi_global.png
diff --git a/docs/waf2025/images/ipi_global_log.png b/docs/waf2025/images/ipi_global_log.png
diff --git a/docs/waf2025/images/ipi_options.png b/docs/waf2025/images/ipi_options.png
diff --git a/docs/waf2025/images/ipi_waf.png b/docs/waf2025/images/ipi_waf.png
diff --git a/docs/waf2025/images/js.png b/docs/waf2025/images/js.png
diff --git a/docs/waf2025/images/juice.png b/docs/waf2025/images/juice.png
diff --git a/docs/waf2025/images/juice_shop_address.png b/docs/waf2025/images/juice_shop_address.png
diff --git a/docs/waf2025/images/juice_shop_basket.png b/docs/waf2025/images/juice_shop_basket.png
diff --git a/docs/waf2025/images/juice_shop_cc.png b/docs/waf2025/images/juice_shop_cc.png
diff --git a/docs/waf2025/images/juice_shop_crackstation.png b/docs/waf2025/images/juice_shop_crackstation.png
diff --git a/docs/waf2025/images/juice_shop_delivery.png b/docs/waf2025/images/juice_shop_delivery.png
diff --git a/docs/waf2025/images/juice_shop_encryptionkeys.png b/docs/waf2025/images/juice_shop_encryptionkeys.png
diff --git a/docs/waf2025/images/juice_shop_ftp.png b/docs/waf2025/images/juice_shop_ftp.png
diff --git a/docs/waf2025/images/juice_shop_pay.png b/docs/waf2025/images/juice_shop_pay.png
diff --git a/docs/waf2025/images/juice_shop_users.png b/docs/waf2025/images/juice_shop_users.png
diff --git a/docs/waf2025/images/juice_shop_xss.png b/docs/waf2025/images/juice_shop_xss.png
diff --git a/docs/waf2025/images/legit.png b/docs/waf2025/images/legit.png
diff --git a/docs/waf2025/images/list.png b/docs/waf2025/images/list.png
diff --git a/docs/waf2025/images/list_dis_stage.png b/docs/waf2025/images/list_dis_stage.png
diff --git a/docs/waf2025/images/log_file_access.png b/docs/waf2025/images/log_file_access.png
diff --git a/docs/waf2025/images/log_file_access_1.png b/docs/waf2025/images/log_file_access_1.png
diff --git a/docs/waf2025/images/log_profile.png b/docs/waf2025/images/log_profile.png
diff --git a/docs/waf2025/images/log_sql_injection.png b/docs/waf2025/images/log_sql_injection.png
diff --git a/docs/waf2025/images/login_enforcement_16_1_2.png b/docs/waf2025/images/login_enforcement_16_1_2.png
diff --git a/docs/waf2025/images/loginenforcement.png b/docs/waf2025/images/loginenforcement.png
diff --git a/docs/waf2025/images/loginenforcementtab.png b/docs/waf2025/images/loginenforcementtab.png
diff --git a/docs/waf2025/images/loginform.png b/docs/waf2025/images/loginform.png
diff --git a/docs/waf2025/images/loginpageslist.png b/docs/waf2025/images/loginpageslist.png
diff --git a/docs/waf2025/images/ltm_geo.png b/docs/waf2025/images/ltm_geo.png
diff --git a/docs/waf2025/images/mitig.png b/docs/waf2025/images/mitig.png
diff --git a/docs/waf2025/images/mitver.png b/docs/waf2025/images/mitver.png
diff --git a/docs/waf2025/images/mod1lab2-xss-orderhistory.png b/docs/waf2025/images/mod1lab2-xss-orderhistory.png
diff --git a/docs/waf2025/images/mod1lab2-xss-uricompare.png b/docs/waf2025/images/mod1lab2-xss-uricompare.png
diff --git a/docs/waf2025/images/mod1lab2-xss-uricompare2.png b/docs/waf2025/images/mod1lab2-xss-uricompare2.png
diff --git a/docs/waf2025/images/mod3lab1-xss.png b/docs/waf2025/images/mod3lab1-xss.png
diff --git a/docs/waf2025/images/mod4lab1-xff.png b/docs/waf2025/images/mod4lab1-xff.png
diff --git a/docs/waf2025/images/my_bad_ips.png b/docs/waf2025/images/my_bad_ips.png
diff --git a/docs/waf2025/images/my_bad_ips_log.png b/docs/waf2025/images/my_bad_ips_log.png
diff --git a/docs/waf2025/images/old_geo_policy.png b/docs/waf2025/images/old_geo_policy.png
diff --git a/docs/waf2025/images/old_waf_ipi.png b/docs/waf2025/images/old_waf_ipi.png
diff --git a/docs/waf2025/images/pol_build.png b/docs/waf2025/images/pol_build.png
diff --git a/docs/waf2025/images/prof_types.png b/docs/waf2025/images/prof_types.png
diff --git a/docs/waf2025/images/py_term.png b/docs/waf2025/images/py_term.png
diff --git a/docs/waf2025/images/rate-limit.png b/docs/waf2025/images/rate-limit.png
diff --git a/docs/waf2025/images/rdp-ubuntu.png b/docs/waf2025/images/rdp-ubuntu.png
diff --git a/docs/waf2025/images/rdp.png b/docs/waf2025/images/rdp.png
diff --git a/docs/waf2025/images/ready_to_deploy.png b/docs/waf2025/images/ready_to_deploy.png
diff --git a/docs/waf2025/images/reject.png b/docs/waf2025/images/reject.png
diff --git a/docs/waf2025/images/repeater.png b/docs/waf2025/images/repeater.png
diff --git a/docs/waf2025/images/securitymisconfig.png b/docs/waf2025/images/securitymisconfig.png
diff --git a/docs/waf2025/images/securitymisconfig1.png b/docs/waf2025/images/securitymisconfig1.png
diff --git a/docs/waf2025/images/servertechnologies.png b/docs/waf2025/images/servertechnologies.png
diff --git a/docs/waf2025/images/sql_test.png b/docs/waf2025/images/sql_test.png
diff --git a/docs/waf2025/images/support_id.png b/docs/waf2025/images/support_id.png
diff --git a/docs/waf2025/images/support_id_1.png b/docs/waf2025/images/support_id_1.png
diff --git a/docs/waf2025/images/support_id_file.png b/docs/waf2025/images/support_id_file.png
diff --git a/docs/waf2025/images/support_id_file_1.png b/docs/waf2025/images/support_id_file_1.png
diff --git a/docs/waf2025/images/trust_xff.png b/docs/waf2025/images/trust_xff.png
diff --git a/docs/waf2025/images/ua-irule.png b/docs/waf2025/images/ua-irule.png
diff --git a/docs/waf2025/images/ua-spoof-log.png b/docs/waf2025/images/ua-spoof-log.png
diff --git a/docs/waf2025/images/udf-juiceshop.png b/docs/waf2025/images/udf-juiceshop.png
diff --git a/docs/waf2025/images/udf_add_key.png b/docs/waf2025/images/udf_add_key.png
diff --git a/docs/waf2025/images/udf_create_key.png b/docs/waf2025/images/udf_create_key.png
diff --git a/docs/waf2025/images/udf_juice_shop.png b/docs/waf2025/images/udf_juice_shop.png
diff --git a/docs/waf2025/images/udf_juice_shop_account.png b/docs/waf2025/images/udf_juice_shop_account.png
diff --git a/docs/waf2025/images/udf_juice_shop_link.png b/docs/waf2025/images/udf_juice_shop_link.png
diff --git a/docs/waf2025/images/udf_juice_shop_signup.png b/docs/waf2025/images/udf_juice_shop_signup.png
diff --git a/docs/waf2025/images/udf_prefs.png b/docs/waf2025/images/udf_prefs.png
diff --git a/docs/waf2025/images/udf_ssh_external.png b/docs/waf2025/images/udf_ssh_external.png
diff --git a/docs/waf2025/images/untrust.png b/docs/waf2025/images/untrust.png
diff --git a/docs/waf2025/images/virtual_servers.png b/docs/waf2025/images/virtual_servers.png
diff --git a/docs/waf2025/images/vs.png b/docs/waf2025/images/vs.png
diff --git a/docs/waf2025/images/waf111_lab_diagram.png b/docs/waf2025/images/waf111_lab_diagram.png
diff --git a/docs/waf2025/images/waf_ipi.png b/docs/waf2025/images/waf_ipi.png
diff --git a/docs/waf2025/images/waf_log.png b/docs/waf2025/images/waf_log.png
diff --git a/docs/waf2025/images/waf_policy.png b/docs/waf2025/images/waf_policy.png
diff --git a/docs/waf2025/images/web_shell_internal_lamp.png b/docs/waf2025/images/web_shell_internal_lamp.png
diff --git a/docs/waf2025/images/web_shell_server.png b/docs/waf2025/images/web_shell_server.png
diff --git a/docs/waf2025/images/webappbutton.png b/docs/waf2025/images/webappbutton.png
diff --git a/docs/waf2025/images/webapptemplate.png b/docs/waf2025/images/webapptemplate.png
diff --git a/docs/waf2025/images/with_bot.png b/docs/waf2025/images/with_bot.png
diff --git a/docs/waf2025/images/xrdp.png b/docs/waf2025/images/xrdp.png
diff --git a/docs/waf2025/images/xss_cust_feedback_form.png b/docs/waf2025/images/xss_cust_feedback_form.png
diff --git a/docs/waf2025/images/xss_test.png b/docs/waf2025/images/xss_test.png
diff --git a/docs/waf2025/labinfo/labinfo.rst b/docs/waf2025/labinfo/labinfo.rst
@@ -0,0 +1,44 @@
+Lab Environment & Topology
+===========================================================
+
+..  |lab-diag| image:: ../images/waf111_lab_diagram.png
+
+Environment
+-----------
+
+**External Jump Server**
+
+WAF Policy Assessment Tool:
+
+* `F5 WAF Tester <https://github.com/f5devcentral/f5-waf-tester>`_ - WAF Assessment Tool
+
+**Internal LAMP Server**
+
+Docker Containers:
+
+* Juice Shop - Extremely Vulnerable Web Application
+* DVGA - Vulnerable GraphQL Application
+
+**F5 BIG-IP**
+
+* Version 17.1.2 Build 0.0.8
+* Best Bundle (LTM, AFM, APM, ASM, DNS)
+
+Lab Topology
+------------
+
+The network topology implemented for this lab is very simple. The following
+components have been included in your lab environment:
+
+-  1 x F5 BIG-IP VE (v17.1) licenced with Best Bundle
+    - external interface (external subnet)
+    - management interface (management subnet)
+    - internal interface (internal subnet)
+-  1 x Ubuntu Linux 18.04 External Jump Server
+    - interface connected to external subnet
+-  1 x Ubuntu Linux 18.04 Internal LAMP Server
+    - interface connected to internal subnet
+
+A network diagram of the lab:
+
+|lab-diag|
diff --git a/docs/waf2025/module1/lab1.rst b/docs/waf2025/module1/lab1.rst
@@ -0,0 +1,63 @@
+Lab 1 – Introduction to the Juice Shop
+--------------------------------------
+
+Objective
+~~~~~~~~~
+
+- Navigate the site
+
+- Create an account
+
+- Make a purchase
+
+
+Task – Navigate the Juice Shop Site
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To access the site navigating to the ``Components`` tab and using the ``Access`` dropdown in the ``F5-AdvWAF-v17.1`` box under the ``F5 Products`` column click on the ``JUICESHOP_VS`` option.
+
+    .. image:: ../images/udf_juice_shop_link.png
+
+A new browser tab should pop open and the Juice Shop should load
+
+    .. image:: ../images/udf_juice_shop.png
+
+
+Task – Create an Account on the Juice Shop Site
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You will notice that as you click on each product you can't add the product to a basket. You will need to create an account to add products to the basket and make a purchase. Please use fake information for the login credentials. Click on the ``Account`` link and the ``Login`` in the top right of the page.
+
+    .. image:: ../images/udf_juice_shop_account.png
+
+Then click on the ``Not yet a customer`` link
+
+    .. image:: ../images/udf_juice_shop_signup.png
+
+Complete the registration and log in with your new username and password.
+
+
+Task – Make a Purchase
+~~~~~~~~~~~~~~~~~~~~~~
+
+Click on any product and add it to you basket then click on ``Your Basket`` in the top right of the page.
+
+    .. image:: ../images/juice_shop_basket.png
+
+Click ``Checkout`` and create a new shipping address making sure to use fake information again.
+
+Select the new address and click the ``Continue`` button.
+
+    .. image:: ../images/juice_shop_address.png
+
+Choose any of the delivery options and click the ``Continue`` button.
+
+    .. image:: ../images/juice_shop_delivery.png
+
+Add a new (fake) credit card (use ``1111111111111111`` for the credit card number), select it and click the ``Continue`` button.
+
+    .. image:: ../images/juice_shop_cc.png
+
+Then click ``Place your order and pay``
+
+    .. image:: ../images/juice_shop_pay.png    
diff --git a/docs/waf2025/module1/lab2.rst b/docs/waf2025/module1/lab2.rst
@@ -0,0 +1,83 @@
+Lab 2 – Hacking the Juice Shop
+------------------------------
+
+Objective
+~~~~~~~~~
+
+- Demonstrate the vulnerabilities in the Juice Shop web application.
+
+- Demonstrate a cross site scripting (XSS) vulnerability.
+
+- Demonstrate a SQL injection vulnerability.
+
+- Demonstrate a privilege escalation vulnerability.
+
+- Demonstrate an unauthorized file access.
+
+Task – Demonstrate a cross site scripting (XSS) vulnerability
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This hack we will cause a simple reflected XSS attack on the Juice Shop application by compromising a parameter value in the URL. First go to **Account** in the upper right corner, then to **Orders and Payment**, select **Order History**.
+
+.. image:: ../images/mod1lab2-xss-orderhistory.png
+
+Click on the truck. This will take you to an expected delivery page with search results. Carefully look at the URI and notice that it is not encoded or using a trusted html link for the parameter value. 
+
+
+.. image:: ../images/mod1lab2-xss-uricompare.png
+
+Paste the following code after **yourhost.access.udf.f5.com/#/track-result?id=** in the URI. 
+
+.. code-block:: none
+    
+    <iframe src="javascript:alert(`data all over this screen that wasnt planned`)">
+
+The full URL will look like this after encoding is done by the browser. Dont paste this code below into the browser. This is meant for reference since you will have a different host. 
+
+.. code-block:: none
+    
+    https://ea06dc66-bfd7-4aa2-a99c-72137fd3ea1a.access.udf.f5.com/#/track-result?id=%3Ciframe%20src%3D%22javascript:alert(%60data%20all%20over%20this%20screen%20that%20wasnt%20planned%60)%22%3E
+
+
+
+.. image:: ../images/mod1lab2-xss-uricompare2.png
+
+Task – Demonstrate a SQL injection vulnerability
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Paste the following path in your browser's location bar after the FQDN of the Juice Shop:
+
+
+.. code-block:: none
+   
+    /rest/products/search?q=qwert%27%29%29%20UNION%20SELECT%20id%2C%20email%2C%20password%2C%20%274%27%2C%20%275%27%2C%20%276%27%2C%20%277%27%2C%20%278%27%2C%20%279%27%20FROM%20Users--
+
+The location bar should look something like (don't copy this since your FQDN will be different):
+
+.. code-block:: none
+
+    https://ba3eff45-2f23-49ab-8122-2e3bdc1ed9ad.access.udf.f5.com/rest/products/search?q=qwert%27%29%29%20UNION%20SELECT%20id%2C%20email%2C%20password%2C%20%274%27%2C%20%275%27%2C%20%276%27%2C%20%277%27%2C%20%278%27%2C%20%279%27%20FROM%20Users--
+
+The result should be a list of all the users in the database including their hashed passwords.
+
+.. image:: ../images/juice_shop_users.png
+
+
+Task - Demonstrate a privilege escalation vulnerability
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Use a rainbow lookup table to expose the admin user's password by navigating to https://crackstation.net/ and entering the hash
+
+
+.. image:: ../images/juice_shop_crackstation.png
+
+
+Task - Demonstrate an unauthorized file access vulnerability
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Navigate to /encryptionkeys to expose an unwanted directory listing
+
+.. image:: ../images/juice_shop_encryptionkeys.png
+
+Click on the file ``premium.key`` and attempt to download it.
+
+The files in this directory can be downloaded. A good WAF policy should block access to sensitive file types.
diff --git a/docs/waf2025/module1/module1.rst b/docs/waf2025/module1/module1.rst
@@ -0,0 +1,10 @@
+Module 1 - Intro and Hacking the Juice Shop Web Application
+===========================================================
+
+In this module you will get to know the Juice Shop web Application and use your web browser to launch successful attacks.
+
+.. toctree::
+   :maxdepth: 1
+   :glob:
+
+   lab*
diff --git a/docs/waf2025/module2/lab1.rst b/docs/waf2025/module2/lab1.rst
@@ -0,0 +1,83 @@
+Lab 1 - Use the Secure Guided Configuration to Build a WAF Policy
+------------------------------------------------------------------------
+Objective
+~~~~~~~~~~~~~~~~
+
+- Log into the BIG-IP
+
+- Create a blocking policy using the guided configuration utiliy
+
+- Apply the security policy to an existing virtual server
+
+- Apply a security logging profile to the virtiual server
+
+Create security policy using the Guided Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#. On your UDF page, go to your BIG-IP component, click the **Access** drop down menu and choose **TMUI** (traffic management user interface).  This is a link to your configuration utility.  
+
+    .. image:: ../images/bigiplogin.png
+
+#. Login to the BIG-IP with the ever so secure credentails of Username  ``admin`` and Password ``f5demos4u!``.  
+
+#. On the Main tab to your left, select **Security > Guided Configuration**. This opens the Guided Configuration screen.
+
+    .. image:: ../images/webappbutton.png
+
+#. Click on the **Web Application Protection** template button.
+
+    .. image:: ../images/webapptemplate.png
+
+#. The guided configuration now provides an overview of what will be configured. Click the  **Next** button.
+
+#. Give your configuration the name ``juice_shop_waf`` this will also name your security policy.
+
+#. Under **Select Enforcement Mode** select **Blocking**
+
+    .. Note:: Typically you would deploy a new policy in a transparent mode so you can observe the logs before blocking to help avoid false positives.  But come on....this is a lab.  We are going to block stuff!  
+
+#. Click on **Show Advanced Settings** button in the upper right hand corner of your page.
+
+    .. image:: ../images/advanced2.png
+
+#. Under **Server Technologies** add the following to the selected window.  Adding these technologies will assist in building a more precise policy.
+
+    - AngularJS
+    - Express.js
+    - JavaScript
+    - JQuery
+    - MongoDB
+    - Node.js
+    - SQLite
+
+#. Press the **Save & Next** Button below.  
+
+    .. image:: ../images/servertechnologies.png
+
+    .. Note:: We are adding these technologies since we know what the application is using.  There is also a feature that can be turned on that can allow the policy to learn these technologies.
+
+#. Check off **Assign Policy to Virtual Server**, under **Virtual Server** choose **Use Existing**, and move the Juice_Shop_VS to the selected window.  Press **Save & Next**
+
+    .. image:: ../images/addvs1.png
+
+#. The next page will summarize the objects and policy configuration.  Review, and take note that you can also go back and edit if required.  When done click **Deploy** at the bottom of the screen.  It will take a few moments to complete the policy build.
+
+    .. image:: ../images/ready_to_deploy.png
+
+#. Click Finish on the next screen.
+
+#.  After the policy is created, we will want to apply a logging profile to our new security policy.
+
+    - Go to **Securirty -> Overview -> Summary**, and the policy you just created should be listed. 
+    - Place a check to the left of the **Virtual Server** name that your new security policy is applied to.  
+    - Now click the blue **Attach** button above and select **Logging Profile**
+
+    .. image:: ../images/attachlogging1.png
+
+    - Select **Log illegal requests** and press the other **Attach** button below.
+
+    .. image:: ../images/attachlogging2.png
+
+    - You will now see the logging profile is added under the Application Security column.  
+
+#.  You now have an active application security policy that is learning, staging, and logging protections against the ``Juice_Shop`` virtual server.  
diff --git a/docs/waf2025/module2/lab2.rst b/docs/waf2025/module2/lab2.rst
@@ -0,0 +1,59 @@
+Lab 2 – Discover the OWASP Dashboard
+-------------------------------------------------------
+Objective
+~~~~~~~~~~~~~~~~
+
+**BIG-IP 17.1 includes updates to the OWASP Compliance Dashboard bringing the list of controls in line with the 2021 top 10 list.**
+
+
+- Open up and view the OWASP Compliance Dashboard
+
+- Apply some basic attack signatures using the Dashboard
+
+- Disable the staging of the security policy
+
+Discover and learn to operate the Dashboard
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#. On the Main tab, click **Security -> Overview -> OWASP Compliance**. This opens the OWASP Dashboard.  Highlight your new policy ``juice_shop_waf``.  You will see that your score is 0/10 for securing against the OWASP top 10.  Though you will see partial % scores for some.
+    .. image:: ../images/list.png
+
+#. Click on the expand arrow next to **A3 Injection**.  This will display the attack signature types and required protections you need to secure yourself against this risk.
+
+    .. image:: ../images/A3list.png
+
+#. Notice that each signature type shows the number of signatures in **Staging/Enforced/Total**.  Just because signatures are enabled, it does not mean they are enforced. Now let's enforce some signatures.
+
+#. On that same screen in the OWASP Dashboard, hover your pointer over **SQL-Injection** and select the **checkmark**.  Also hover over **Server Side Code Injection** and select the **checkmark**.  These checkmarks apply the protections to the policy.  Notice your potential A1 Injection protection % increased.
+
+    .. Note::  In the dashboard, if you see the checkmark available, it will enforce any protections required to be compliant for that vector.
+
+    .. image:: ../images/A3checked.png
+
+#. Press the blue **Review & Update** button below.  On the pop up window press the blue **Save & Apply Policy** button.  
+
+    .. Note:: While all attack signatures in this policy are in staging, we just used the OWASP dashboard to directly enforce (skip staging) those 2 categories.  This would be a typical approach to secure an application immediatly against a certain catagory of injection attacks.  These attack types are now blocked, while staging (learning and alarming) the rest of the attack categories.  
+
+#. Now for the sake of expediting the policy blocking malicious traffic, we will turn off signature staging. This will simulate a user waiting out the default 7 days of staging your attack signatures.
+
+    - Go to **Security -> Application Security -> Policy Building -> Learning and Blocking Settings**
+    - Make sure you select the **juice_shop_waf** policy at the top.
+        .. image:: ../images/pol_build.png
+    - Expand **Attack Signatures**
+    - Uncheck the box next to **Enable Signature Staging**
+    - Press **Save** at the bottom or the top right of that screen.
+    - Press **Apply Policy** button at the top right corner of your screen
+
+    .. Note:: For those of you looking for the attack signature list, you may have now noticed the location of attack signatures has changed in the most recent release. 
+
+    .. image:: ../images/disablestagingv2.png
+
+#. Go back to your OWASP Dashboard **Security -> Overview -> OWASP Compliance**.  Select your policy ``juice_shop_waf``..  You can now see a lot more OWASP protections now.
+
+    .. image:: ../images/list_dis_stage.png
+
+    .. Note:: When we disabled the staging, we represented a user waiting out the enforcement readiness period.  We basically just time traveled to the future!!  https://youtu.be/8qrriKcwvlY
+
+#. Congratulations!  You now have a protected app, and you have visibility into how well you are protected against the OWASP Top 10.  In the following labs we will work to get you even more protection against the OWASP Top 10.
+
+    .. Note:: While working towards the goal of applying more security, each use-case is different and the dashboard may not always be at 100% in all categories.  The dashboard gives you a visual guide and documentation of progress towards OWASP Compliance with each technical security policy change as well as corporate governance.