Lecture 228: Hands On: Cross-Site Scripting (XSS) attack simulation and prevention with WAF
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:59
- 来源：Udemy Lecture 30203354
- Slide 数量：8
- 画面切换：01:15、02:52、04:15、05:42、08:39、09:09、11:17
扫描说明
逐条读取了 Udemy 页面中的 262 条英文 Transcript cue，并按时间轴扫描全长约 12:59 的实操视频。依据 EC2/HTTPD 准备、正常页面、XSS 模拟、未防护 URI、ALB 建立、ALB Baseline、Web ACL 创建、403/Metric 验证划分为 8 个小节。8 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 在 Amazon Linux EC2 上准备 HTTPD 与 XSS Demo Application
时间范围：00:00–01:15
总结 / Summary
中文
实验先启动 Amazon Linux EC2，SSH 登录后安装 Apache HTTPD 与 Git，再把示例 Repository 的 index.html、style.css、app.js 放入 /var/www/html，确认 httpd Service 正常运行。这个简单 Application 故意缺少安全的 Input Handling，用来展示 XSS 风险。它仅用于隔离实验环境；真实系统不应直接暴露带漏洞的 Code，也不应长期开放 EC2 Public Access。
English
The lab launches an Amazon Linux EC2 instance, connects over SSH, installs Apache HTTPD and Git, copies the sample repository's index.html, style.css, and app.js into /var/www/html, and verifies that the httpd service is running. The application intentionally lacks safe input handling so the XSS risk is visible. It belongs only in an isolated lab; vulnerable code and direct public EC2 access should not remain in a real system.
Transcript
00:00 Now, let's see WAF in action.
00:04 Now, in this case, what we are going to do is
00:08 we are going to just launch a simple web application, right?
00:11 we'll just create one simple, easy to machine install
00:14 the HTTP server, which is a simple web server,
00:18 and then we'll copy the content from this Git repository,
00:21 XSS example, and then we will just start the HTTPD server,
00:25 and see how an XSS attack happen, right?
00:28 Now, this is a very simple example,
00:29 where XSS is not attacking other users,
00:34 but the one who is really sending that XSS request,
00:39 but, in real world,
00:40 maybe if you have a more sophisticated attack,
00:44 then you can also get data from other users, right?
00:47 So, this is a simple example we'll now get into.
00:51 Okay, so I'm into my AWS console,
00:53 and I already launched EC2 instance
00:56 with Amazon Linux machine.
00:58 I'm sure you know how to do that.
01:02 And what I did is, after I launched this instance,
01:05 I just SSH into it, and just installed the HTTPD server
01:09 as well as I installed Git in order to clone the repository
01:13 that I just told you.
2. 先验证正常 Comment 与 Image URL 的 Application Flow
时间范围：01:15–02:52
总结 / Summary
中文
通过 EC2 Public IP 打开页面，用户可提交 Message 与 Image URL，Application 再把这些值呈现在页面上。普通输入能显示 Comment 与远程 Image，说明 Web Server、Static Asset 与 Client-side Code 已连通。这个 Baseline 很重要：后续出现 Popup 或 Block 时，可以确认差异来自恶意 Payload 或 WAF Rule，而不是 Application 本身不可用。
English
Opening the EC2 public IP exposes a page where a user submits a message and an image URL, which the application renders back into the page. Benign input displays the comment and remote image, confirming the web server, static assets, and client-side code work. This baseline matters because a later popup or block can then be attributed to the malicious payload or WAF rule rather than an unavailable application.
Transcript
01:15 Now, let me take you to my SSH session.
01:20 Okay, so this is my SSH.
01:22 Now, let me just change myself to sudo,
01:25 and then I will just do cd /var/www/html,
01:33 and here you can see that I have index.html.
01:38 Now, this one is the other one.
01:40 I just need to move this to new,
01:44 and just move this to the original one.
01:49 So, when you copy, you will actually see
01:52 style.css, index.html, app.js.
01:56 Under this XSS example repository,
01:59 you just have to move under the /var/www/html directory.
02:02 So, I'm sure you know how to do that.
02:04 Once you do that, make sure that
02:06 your HTTPD service is running.
02:09 sudo service httpd status
02:12 Yes, it is running.
02:13 And then, let's get to the browser,
02:15 get the IP address of EC2 machine,
02:16 and see what it looks like.
02:18 Okay, so IP is this.
02:20 I'm just opening another tab now.
02:23 Okay, I got the server IP.
02:26 I'm just putting that.
02:27 And this is a simple web application.
02:29 What I can do is I can say just, "My car,"
02:32 and, for the image, I can provide some random image,
02:36 and I just got one image there.
02:41 From the internet, I just put it there,
02:44 and just sent the message.
02:45 So, what this application is doing,
02:46 just showing my comment and image there in this.
02:50 So, this is so far so good.
3. 未验证 Input 被当作 HTML/JavaScript，触发 XSS Alert
时间范围：02:52–04:15
总结 / Summary
中文
Demo 把用户提供的 Image Value 直接解释为 HTML，攻击者可构造带 Error Handler 的 Payload，在 Image Load 失败时执行 JavaScript Alert。Browser Popup 证明 Input 未经过正确 Validation/Encoding。示例影响的是提交者自己，但真实 Stored/Reflected XSS 可窃取 Session Cookie、读取敏感页面内容或代表其他用户执行操作。根因仍是 Application 把不可信数据插入可执行 Context。
English
The demo interprets a user-supplied image value as HTML, allowing a payload with an error handler to execute JavaScript when image loading fails. The browser alert proves that input was not correctly validated or encoded. This example affects the submitter, but real stored or reflected XSS can steal session data, read sensitive content, or act for other users. The root cause is inserting untrusted data into an executable context.
Transcript
02:52 Now, if we want to just reproduce
02:54 the cross-site scripting attack,
02:57 what you can do is, if you look at the code of this app,
03:00 you will understand why
03:01 this is cross-site scripting is reproducible,
03:05 because everything that we enter here
03:08 is interpreted as HTML text.
03:10 So, now what we are doing is, instead of giving that URL,
03:14 we are just trying to close this example.com/any-image.jpg,
03:21 and then we are saying,
03:22 on error, you have to execute this script,
03:25 which is, "Alert, this computer is hacked."
03:27 Now, the code is written in such a way that
03:29 everything that you provide as image is taken as HTML,
03:32 and that's where, if you do that, say, "My car2,"
03:36 and send the message, you see this pop up here.
03:38 Now, this is because the browser is executing this
03:42 as a JavaScript, right?
03:43 Because not a proper input validation
03:46 has been done for this code.
03:49 Now, this is not very sophisticated attack,
03:51 because this is something you are entering,
03:54 and then you are getting affected by this.
03:56 But imagine that, instead of this script,
03:58 you put something like,
03:59 get me all the cookies of the users currently logged in,
04:03 and probably it displays it here.
04:04 Now, for that, we need to write a different code,
04:07 but we don't want to get into that level of depth here
04:10 as of now.
04:11 But now, this is how you understand
04:13 how the cross-site scripting attacks are done.
4. 用简单页面证明恶意-looking URI 仍会到达 Origin
时间范围：04:15–05:42
总结 / Summary
中文
讲师切换为简单 Hello World 页面，再把含 Script Pattern 的字符串附加到 URL。Application 虽返回 404 Not Found，但 Request 已到达 EC2 Origin，只是没有对应 Resource；404 不等于 Security Control。为了让 AWS WAF 保护该流量，需要把受支持资源放在前面，本实验选择 Internet-facing Application Load Balancer，再把 EC2 注册为 Target。
English
The instructor switches to a simple Hello World page and appends a script-like pattern to the URL. The application returns 404 Not Found, but the request still reached the EC2 origin and merely lacked a matching resource; a 404 is not a security control. To place AWS WAF in the path, the lab adds a supported front-end resource—an internet-facing Application Load Balancer—with EC2 registered as its target.
Transcript
04:15 Now, with that, let's move to another example,
04:18 where we'll see how the Web ACL can prevent
04:21 these kind of attacks.
04:22 Now, for that, I'm going to the same EC2 machine,
04:24 but I'm just putting a very simple webpage instead of this,
04:28 because, otherwise, we would have to just play around
04:30 a lot with the code here,
04:32 but let's make a simple single page web application,
04:35 which just says, "Hello world."
04:37 So, let's go to our EC2 instance.
04:39 And, in this directory, I have just made another HTML file,
04:43 so I'm just backing up the earlier one as .xss,
04:47 and I'm just making another file,
04:50 which, if you open, has nothing very interesting, right?
04:55 This is a sample sample, right?
04:58 This is a sample website, and that's it.
05:04 Now, if I refresh my page in the browser,
05:09 then I should see this.
05:11 Okay, so far so good.
05:13 Now, what if you put something in the URL string,
05:15 something like, say, script and alert again,
05:20 say hacked, right?
05:24 Something like this and this, right?
05:27 As of now, we don't expect anything to happen,
05:29 because there is no resource under this URL, right?
05:33 So, not found, but the request has reached the server,
05:37 and it tried to find that resource.
05:40 Now, if you want to play with this,
5. 创建 Internet-facing ALB、Security Group 与 Target Group
时间范围：05:42–08:39
总结 / Summary
中文
创建名为 xss-lb 的 Internet-facing IPv4 ALB，选择正确 VPC，并按 ALB 要求至少选择两个 Availability Zone/Subnet。新建 ALB Security Group，允许实验所需的 TCP/80；创建 Instance Target Group，把 EC2 的 Port 80 注册进去，Health Check 使用 /；Listener 再把 HTTP/80 Forward 到该 Target Group。生产环境应让 EC2 SG 只允许 ALB SG，而不是继续接受 Internet Direct Access。
English
The lab creates an internet-facing IPv4 ALB named xss-lb, selects the correct VPC, and chooses at least two Availability Zone subnets as required. It creates an ALB security group permitting the lab's TCP port 80, builds an instance target group with EC2 on port 80 and health checks on /, and forwards the HTTP listener to that target group. In production, the EC2 security group should allow only the ALB security group rather than continued direct Internet access.
Transcript
05:42 we can probably put a Web ACL in front of our EC2 machine,
05:45 but, for that, we have to use Application Load Balancer.
05:48 Now, we'll create Application Load Balancer
05:51 and add EC2 instance behind that.
05:53 But, before that,
05:53 let's just make sure we are using
05:56 the right availability zone and right VPC,
05:58 so this has been created in this VPC, 0a3,
06:02 and then it is in 1a availability zone.
06:05 So, let's go to the Load Balancer
06:08 and just create a Application Load Balancer.
06:12 Let's call it, say, xss-lb, internet phasing, IPv4,
06:18 the right VPC has been selected, and we'll use same AC
06:23 as our EC2 machine.
06:25 And then, for the security group,
06:29 let's create a new security group.
06:32 And for that, we'll just allow traffic on port 80.
06:39 So, let's do that.
06:42 So, it's lb-sg,
06:46 and this is in this VPC,
06:48 and we'll say HTTP traffic to be allowed
06:52 on port 80 from anywhere.
06:55 And that's it.
07:00 xss-lb as the description, and let's just create that.
07:05 Okay, so security group has been created.
07:08 We can just take its ID and go here, just refresh it,
07:14 and we will just pick the same one.
07:21 Okay, we'll remove the default one.
07:23 And now, listener is port 80,
07:25 and we want to forward it to one target group.
07:28 As you know, we need to create the target group first,
07:31 so let's do that.
07:33 And, for that, let's go here
07:35 and create one new target group.
07:38 So, the target is instances.
07:41 It is also sending the traffic to port 80
07:44 in the default VPC.
07:46 HTTP1 traffic, health check on slash, that is okay.
07:50 And then we are just going to give some name, xss-tg,
07:58 and we are going to add this instance into the target group.
08:03 That's it, we'll just create the target group.
08:06 We'll go back to the load balancer,
08:08 and then we'll just refresh this,
08:12 and select the right target.
08:15 I think we are done with the settings.
08:16 This is what we have to do,
08:19 and just create the load balancer.
08:21 We have to select at least two ACs for load balancer,
08:24 you know that.
08:25 I missed that.
08:26 So, that's it.
08:27 The load balancer has been created.
08:29 It will take maybe a minute or so
08:31 for load balancer to be active,
08:33 and then we'll just check
08:34 if we can access the application
08:36 through the load balancer URL.
6. ALB Baseline 仍返回 404：Load Balancing 本身不会过滤 XSS
时间范围：08:39–09:09
总结 / Summary
中文
ALB Active 后通过其 DNS Name 访问正常页面，证明 Listener、Target Group 与 Health Check 工作；再次发送含 Script Pattern 的 URI，Origin 仍返回 404，说明 ALB 只完成 Layer 7 Load Balancing，并不会自动拦截 XSS。必须显式建立并关联 Web ACL，才能在 Request 到达 Target 前执行 Security Inspection。
English
Once the ALB is active, its DNS name serves the normal page, confirming that the listener, target group, and health check work. Sending the script-like URI again still returns the origin's 404, showing that ALB provides Layer 7 load balancing but does not automatically block XSS. A web ACL must be created and associated explicitly to inspect requests before they reach targets.
Transcript
08:39 Okay, so load balancer is active.
08:41 Just let's grab the DNS name, and try to hit that.
08:46 Okay, so it is working.
08:47 My website is visible.
08:48 Now, as you know,
08:49 if you put some kind of script there,
08:51 again, the same result I'm expecting,
08:54 where it will say the resource not found,
08:59 and this is expected, right?
09:01 But this is not really preventing any kind of attack
09:05 as of now.
09:06 It is reaching to the server,
09:06 and then it's not finding the right resource.
7. 创建 Regional Web ACL，并加入 AWS Managed Core Rule Set
时间范围：09:09–11:17
总结 / Summary
中文
在 AWS WAF v2 中创建名为 xss-waf 的 Web ACL。因为保护对象是 Mumbai Region 的 ALB，Scope 选择 Regional，再关联 xss-lb。随后添加 AWS Managed Rules 的 Core Rule Set（AWSManagedRulesCommonRuleSet），其中包含常见 Web Attack 的 XSS 等防护；画面中的 700 是该 Rule Group 的 WCU Capacity，而不是 700 条 Rule。保持 Default Allow 后创建 Web ACL，并等待配置传播。
English
In AWS WAF v2, the lab creates a web ACL named xss-waf. Because the protected ALB is in the Mumbai Region, the scope is regional, and the ACL is associated with xss-lb. It then adds the AWS Managed Rules Core Rule Set (AWSManagedRulesCommonRuleSet), which includes XSS and other common web-attack protections. The displayed 700 is the rule group's WCU capacity, not 700 individual rules. The ACL is created with default allow and given time to propagate.
Transcript
09:09 Now, let's find the web application firewall service.
09:12 Here it is, and let's open that.
09:17 Make sure you are using the latest version of the firewall,
09:22 which is WAF v2,
09:24 and now let's create the Web ACL.
09:28 Okay, let's give it name xss-waf, or anything.
09:37 And then we want to have it applied to
09:40 the Application Load Balancer,
09:41 that's where we'll select that,
09:42 and the region we want to put is in AP South 1,
09:47 that is Mumbai.
09:47 Now, Web ACLs are global in that sense,
09:50 but then you can apply it to the particular region,
09:52 as you can see here.
09:56 Okay, our names are gone for some reason, but that's okay.
10:01 And now, here, you have to associate that
10:02 with a particular AWS service.
10:05 So, we are just going to select
10:07 the Application Load Balancer,
10:09 and this is what our load balancer is.
10:11 So, I'm just adding that.
10:13 Now, once that is done, we have to define the rules.
10:16 And, as of now, we will just add the existing rule.
10:20 So, manage rule groups, which are owned by AWS.
10:25 So, let's select the core rule group,
10:28 which contains the XSS as well.
10:30 So, AWS manage rule groups,
10:32 and, under that, we will select the core rule set, right,
10:37 which has 700 plus rules already,
10:39 and it covers the OWAS vulnerabilities as well.
10:44 So, I think this is sufficient for our Web ACL as of now.
10:47 We'll just say add rules, and that's it.
10:52 We will just give the right IM rule,
10:56 and we'll just go with the rest of the things as default.
11:03 Okay, everything is done.
11:04 Let's create the Web ACL.
11:07 So, as I said, once you create the Web ACL,
11:09 it takes up to one minute for the Web ACLs to be active.
11:13 And let's pause this video for one minute.
8. 通过 ALB 的 XSS Request 返回 403，并在 WAF Metric 中验证 Block
时间范围：11:17–12:59
总结 / Summary
中文
Web ACL Active 后，普通 ALB URL 仍可访问；在 URI 中加入 XSS Pattern 时，Managed Rule 命中并由 WAF 返回 403 Forbidden。WAF Overview/CloudWatch Metric 可看到 Matched/Blocked Request 及命中的 Rule，形成验证证据。直接访问 EC2 Public IP 仍绕过 ALB 与 WAF，因此真实架构必须关闭 Origin Direct Path：移除 Public Exposure，或让 EC2 SG 仅允许 ALB SG。
English
After the web ACL becomes active, the normal ALB URL remains accessible. Adding the XSS pattern to the URI matches the managed rule and AWS WAF returns 403 Forbidden. WAF overview and CloudWatch metrics expose the matched or blocked request and rule for verification. Direct access to the EC2 public IP still bypasses both ALB and WAF, so a real architecture must close that origin path by removing public exposure or allowing only the ALB security group.
Transcript
11:17 Okay, so my Web ACL is active now.
11:19 You can see here, if you click here,
11:21 it will also show you which rules it matches,
11:23 and it collects a lot of metrics from the CloudWatch.
11:27 So, here you can see that
11:28 I tried just once this rule, and it has matched,
11:31 but then, let's see it again, right?
11:34 So, as of now, let's go to our EC2 instance.
11:38 I pinned this script, as you know,
11:39 this will still give the resource not found,
11:42 because it is not going through the Web ACL, right?
11:44 Because we applied Web ACL or a WAF rule
11:47 to the load balancer.
11:49 So, in that case, let's get to the load balancer,
11:52 let's pick the IP address, and just put it here.
11:56 So, as of now, you can access it,
11:59 because this is not a cross-site scripting attack.
12:01 But, as soon as you try to do something like this
12:05 with the URI string here, and append this string here,
12:11 you should get the forbidden error.
12:14 That's what it does, right?
12:15 403 forbidden, because Web ACL has found that
12:19 there is some kind of XSS attack.
12:22 And what you can do is
12:23 you can go here into the WAF overview,
12:25 and just refresh these metrics once,
12:29 and it will show you that you are trying to execute
12:32 this URI, which it detected as blocked,
12:36 because it detected as an XSS.
12:39 So, this is what the Web ACL can do,
12:42 and this is a very simple example.
12:43 In real life, you can do a lot more.
12:46 You can match actual string,
12:47 or Regex, SQLs, everything, right?
12:51 So, we'll stop here with these demos,
12:53 and now we'll move to the next security service.
12:56 So, thanks for watching.
整讲总结 / Overall Summary
中文
本讲先在 EC2/HTTPD 上演示未编码 Input 如何触发 XSS，再把 Application 放到 ALB 后，并为该 Regional ALB 关联 AWS WAF Web ACL 与 AWSManagedRulesCommonRuleSet。验证结果是正常 Request 继续通过，XSS URI 被 403 Block 且产生 WAF/CloudWatch Metric。最重要的架构补充是锁死 Origin：如果 EC2 仍可直接访问，攻击者可以绕过 WAF。
English
The lab first demonstrates how unencoded input triggers XSS on an EC2 and HTTPD application, then places the application behind an ALB and associates a regional AWS WAF web ACL containing AWSManagedRulesCommonRuleSet. Normal requests continue to work, while the XSS URI is blocked with 403 and appears in WAF or CloudWatch metrics. The critical architecture requirement is origin lockdown: if EC2 remains directly reachable, attackers can bypass WAF.