Starting VasPatchAfter installation, please ensure that:
Running At First TimeAfter starting the above services, open a browser and access VasPatch Web UI. The path of the login page should be http://localhost:<port>/login.aspx. Note that, for the first time successful login, you must access the login page locally on the local server. You can only login the Web UI remotely after the default password is changed. In the login page, use the following default username and password for the first time. Username: admin After login, you will be asked to change the password. Enter the new password and confirm password to process to the next step. After changing the password, you need to login again with the new password. Note: you cannot use the functions unless you have changed the password. After login, you will see several menu items, sample rules, custom rules, alerts and system setting, on the menu bar. The items will be further explained in the following sections. There should be no rules in the system after first installation. There are 3 ways to create rules:
Sample RulesSample Rules are a set of predefined sample rules from VasPatch Repository. These sample rules are created by MileSCAN or web application vendors. Using these sample rules can protect your web application from known vulnerabilities. On the top menu, click “Sample Rules” to view the Rule List page. For first time running, this page will not show anything as there are no rules in the system. You could following the next section "Import Rule" to add some sample rules from VasPatch Repository. Afterwards, a list of rules would be shown in this page. For each rule, there are several control actions:
Administrator may also search the sample rules in VasPatch Repository by rule name, Bugtraq ID, CVE or attack type. Import Rule Using Patch Rule ID (PRID)On the
top menu, mouse over “Sample Rule” and there is a submenu for importing new predefined
rules from VasPatch Repository. In the
import rule page, enter the PRID of a rule and click Search button. PRID is a
unique Patch Rule ID which is assigned to each rule added to VasPatch Repository. You can search a known vulnerability from VasPatch Repository using CVE ID or Bugtraq ID, and then find out the corresponding PRID. The rule details will be shown if the inputted PRID can be found on the VasPatch Repository. If the rule is the one you want to import, press the Confirm button and save the rule to the system. If the rule you want to import is already existed in your system, you would be asked to update the previous rule or not.
Custom RulesSometimes there may not be any predefined sample rules which can patch your web application vulnerabilities. Then user can still create a custom rule to virtually patch your specific web application. On the top menu, click “Custom Rules” to access Rule List page. For first time running, this page will not show anything as there are no rules in the system. After some rules were added to the system, a list of rules will be shown in this page. In the list, there are some basic information and several controls for each rule.
Administrator may also search the rules by rule name, domain or action type. Add RuleOn the top menu, mouse over “Custom rule” and there are two submenu, Basic and Advanced, for creating new rules. Create Basic RuleThis is a create rule wizard that help administrators, who are not familiar with the rule syntax, to create a custom rule easily. Using the basic rule creation wizard, administrators can create rules to filter the two common types of vulnerabilities, i.e., Cross site scripting and SQL Injection. In Create Basic Rule page, administrator has to provide the following information:
Save the setting, then the rule will be created and enabled. In order to customize the Filter Action, it is allowed to Edit the rule in Rule List page. Create Advanced RuleFor IT security professionals, this function can provide a higher degree of customization to create complex rules. Rules created by this could be customized to fix vulnerabilities of custom web applications. Before using this function to create a rule, administrator may have to understand the syntax of our rule Conditions and Filter Actions. Please refer to Rule Syntax for more information. In Create Advanced Rule page, administrator has to specify the following information:
Save the setting, then the rule will be created. AlertsOn the top menu, select “Alerts” to access alert list page. In this
page, a list of alerts will be shown. Whenever a request matches the
conditions of a rule in Action Mode or Log Mode, it will trigger an alert and add to this alert list. Within the list, summary including alert date, request URL, action and rule ID was shown. Clicking the detail hyperlink will show the alert detail. Administrator may also search the alerts by Request URL, Action Type, Rule name.
System SettingOn the top menu, select “System” to access system setting page. In this
page, administrator can change the global setting and login password. Change PasswordAdministrator can change the login password here. Enter old password, new password and confirm new password to change the password of administrator. Note: The system will be redirected to the login page after changing the password. You need to login with the new password. Global SettingAdministrator can change the mode of all rules. Here are the modes that can be selected:
|
|
|
|
User Guide >
Getting Started |