First, I'll demonstrate that NGINX is in...

Audio by Paper2Audio

First, I'll demonstrate that nginx is installed and managed as a service. I'll stop the service, confirm that it is inactive. then start it again and confirm that it is running. Next, I'll verify that P.H.P-FPM is running.nginx does not process P.H.P directly, so P.H.P-FPM is used to execute P.H.P files. This P.H.P information page confirms that nginx is successfully passing P.H.P requests to P.H.P-FPM. Next, I'll demonstrate that D.V.W.A is being served through nginx. I'll open the D.V.W.A login page and log in using the default credentials. The D.V.W.A welcome page confirms that the application is working correctly through nginx and P.H.P-FPM. I'll now demonstrate NAXSI operating as the web application firewall.Learning Mode is currently disabled, so suspicious requests should be blocked. After running the X.S.S curl. The request returns H.T.T.P 403 Forbidden, showing that NAXSI has blocked the suspicious request. Again in D.V.W.A, after injecting xss script.

We see that NAXSI has blocked the suspicious request. In the nginx error log, NAXSI has recorded the request and identified an X.S.S score of eight. Similarly for sqli , We see that NAXSI has blocked the suspicious request. I'll now enable NAXSI Learning Mode. In Learning Mode, suspicious requests are still detected and logged, but NAXSI does not actively block them.

After restarting njinx, I'll repeat the same X.S.S request used earlier.This time, the request is not blocked. It receives a normal application response rather than H.T.T.P 403. The alert box confirms that the reflected X.S.S payload has reached D.V.W.A and executed successfully. Same goes for the sqli.

NAXSI still detects the S.Q.L and X.S.S injection pattern and records it in the error log, but Learning Mode allows the request to continue.