# 模拟攻击测试防护效果

## 使用 [OWASP Juice Shop ](https://owasp.org/www-project-juice-shop/)

OWASP Juice Shop 可能是最现代、最复杂的不安全网络应用程序！它可用于安全培训、安全意识演示、CTF，还可作为安全工具的 "小白鼠"！Juice Shop 涵盖了整个 OWASP 十大漏洞以及现实世界应用程序中发现的许多其他安全漏洞！

demo：<https://juice-shop.herokuapp.com/#/>

可以参考此Github对Juice Shop尝试里面的攻击：

<https://github.com/bsqrl/juice-shop-walkthrough>

## 使用[Stratus Red Team](https://github.com/DataDog/stratus-red-team#stratus-red-team)

使用 Stratus Red Team 工具完成的攻击模拟，该工具可模拟 32 种不同的攻击技术。下图显示了我们测试环境的设置。

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FoIOq2zpo9vQtaubuq5Lc%2Fimage.png?alt=media&#x26;token=3f941553-a1aa-4d5a-a0be-047811bfd485" alt=""><figcaption></figcaption></figure>

使用外部攻击机器通过 AWS CLI 模拟攻击。AWS 环境已启用 GuardDuty，这使我们能够比较 Sigma 和 GuardDuty。这些活动记录在 CloudTrail 中，并将这些日志流式传输到 S3。[CloudTrail 日志流](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging.html)是事件响应的最佳实践，因为它使您能够拥有更长的保留期，并能一次性查询所有区域的所有日志。最后，AWS Athena 被用作 SIEM 解决方案，用于查询 CloudTrail 事件。可以开启Security Lake收集CloudTrail日志，Security Lake将会自动生成Athena数据库和表结构，方便使用，并且将日志集中保存至S3存储桶。

我用的是Ubuntu系统，安装脚本如下：

wget -o my\_stratus [stratus-red-team\_Linux\_arm64.tar.gz](https://github.com/DataDog/stratus-red-team/releases/download/v2.10.0/stratus-red-team_Linux_arm64.tar.gz)

tar -xzf v2.10.0.tar.gz

用./stratus list测试效果，可以看到以下输出证明安装成功：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2Fm3ocrvxSjJvtvrWy6kgw%2FScreenshot%202023-11-12%20at%2015.51.52.png?alt=media&#x26;token=92a208ee-40f6-4413-993a-45c2b22edc5d" alt=""><figcaption></figcaption></figure>

## 参考资料

[Unauthorized IAM Credential Use – Security Event Simulation and Detection](https://catalog.workshops.aws/aws-cirt-unauthorized-iam-credential-use)

[Ransomware on S3 – Security Event Simulation and Detection](https://catalog.workshops.aws/aws-cirt-ransomware-simulation-and-detection)

[Cryptominer Based Security Events – Simulation and Detection](https://catalog.workshops.aws/aws-cirt-cryptominer-simulation-and-detection)

[SSRF on IMDSv1 – Simulation and Detection](https://catalog.workshops.aws/aws-cirt-ssrf-imdsv1-simulation-and-detection)

[AWS CIRT Toolkit For Automating Incident Response Preparedness](https://catalog.workshops.aws/aws-cirt-toolkit-for-incident-response-preparedness)

[AWS CIRT announces the release of five publicly available workshops](https://aws.amazon.com/blogs/security/aws-cirt-announces-the-release-of-five-publicly-available-workshops/)

[Automated First-Response in AWS using Sigma and Athena](https://invictus-ir.medium.com/automated-first-response-in-aws-using-sigma-and-athena-615940bedc56)

[Introducing Stratus Red Team, an Adversary Emulation Tool for the Cloud](https://blog.christophetd.fr/introducing-stratus-red-team-an-adversary-emulation-tool-for-the-cloud/)
