For security reasons, and so that Scanner stays within its scope, including when an error in Scanner would send a request outside that scope, it is strongly recommended to limit Scanner access to the resources it needs.
Using Scanner for unlawful purposes is strictly prohibited.
Enable time synchronization and set your preferred time zone:
timedatectl set-ntp yes
timedatectl set-timezone %YOUR TIMEZONE%
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb https://s.mikiri.ai/repo/stable/debian trixie mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-scanner
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb [arch=amd64] https://s.mikiri.ai/repo/stable/ubuntu resolute mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-scanner
setenforce 0
then bring the file /etc/selinux/config to the form:
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
/etc/yum.repos.d/mikiri-waf.repo look like:[MikiriWAF]
name=Mikiri WAF Packages for RHEL
baseurl=https://s.mikiri.ai/repo/stable/rhel/$releasever/$basearch/
gpgkey=https://s.mikiri.ai/repo/gpg.key
enabled=1
gpgcheck=1
dnf update
dnf install epel-release
dnf config-manager --set-enabled crb
dnf install mikiri-waf-scanner
During the installation of the module, the following pip packages are additionally installed:
wheel beautifulsoup4 cdifflib chardet logutils psutil pyparsing PyYAML requests soupsieve url-normalize
Scanner is available only for the
Enterpriseplan.
Deployment as a Docker container is described in Deploying Scanner Docker container.
For security reasons, it is recommended to prohibit external incoming connections to network services. Scanner opens only outgoing connections: to the scanned application, to API and to the license service.
After installing the module, the initial configuration must be performed. The configuration file /etc/mikiri-waf-scanner/scanner.conf contains the parameters of Scanner that cannot be configured using an API request:
The Mikiri WAF license key. The agent does not start if the value is empty.
waf_product_key = 1234567890
The address of the API. The agent receives the scan settings from this address and sends the detected vulnerabilities and the recheck status. The agent does not start if the value is empty.
waf_api_url = http://api.example.com:8080
Debugging mode.
Default value:
debug = false
The proxy server address for access to external resources: the license check and the download of scan payloads.
waf_sys_proxy = http://proxy.example.com:3128
It is allowed to use authentication parameters when using a proxy server, for example:
waf_sys_proxy = http://%USER%:%PASSWORD%@proxy.example.com:3128
The proxy server address for access to the API.
waf_api_proxy = http://proxy.example.com:3128
It is allowed to use authentication parameters when using a proxy server, for example:
waf_api_proxy = http://%USER%:%PASSWORD%@proxy.example.com:3128
After making the changes, execute the script for correcting the permissions:
/bin/bash /etc/mikiri-waf-scanner/venv/set_permissions.sh
Restart the service and check its operation:
systemctl restart mikiri-waf-scanner
systemctl status mikiri-waf-scanner
After performing the initial configuration of the module, it is necessary to check for errors in the event logs of the agent:
/var/log/mikiri-waf/scanner/scanner.log - the classic scan;/var/log/mikiri-waf/scanner/recheck.log - recheck.The scan targets, the schedule, the proxy for scan requests and the disabled modules are set through the API. These parameters are not stored in scanner.conf.
The service mikiri-waf-scanner runs continuously. Each cycle loads the settings from API. If the API does not answer, the last saved copy from /etc/mikiri-waf-scanner/db/settings.json is used. The next cycle starts 30 seconds after the previous one finishes. While a cycle is running, the classic scan schedule is reloaded from API every 30 seconds. The targets of that cycle stay as they were when the cycle started.
Requests to the target are sent with the User-Agent header Mikiri WAF Scanner (<id>). <id> is the MD5 hash of /etc/machine-id. The TLS certificate of the target is not verified.
The classic scan is started by scan_schedule. The time is the local time of the server where the Scanner is running. An empty schedule means the classic scan is not started.
The service remembers the moment it started watching the schedule. A slot that already passed before that moment is not started a restart does not catch it up. The next slot starts when its time is reached. This state is kept in memory for the life of the process.
Only one classic scan can run at a time. If a scan is still running when another slot is due, the start waits until the running scan exits only the latest due slot is started. A scheduled start is written to scanner.log.
WMC can also ask for one target through set_scan. The service reads that queue about every 30 seconds and starts the oldest queued target when no classic scan is running. A scheduled start is taken first. The child scans only that target, including a target whose active is false. The start and the finish are reported with set_scan_status. A running row left behind after the process has gone is dropped on the next check.
A configuration with active set to false a target with active set to false, are not scanned. The Scanner collects links on each active target, including API paths and query parameters published in OpenAPI documents and in the application scripts. A JSON body declared by the document is sent as JSON. These links are checked with the scanning modules. A module listed in exclude_modules is not used for that target. When authorization parameters are set, the Scanner signs in and checks the sections that require authentication.
Detected vulnerabilities are sent to API. The list is available through get_vulns.
Recheck checks whether an event previously recorded by Mikiri WAF can be reproduced. It is always enabled. There is no settings flag to turn it off. Recheck does not use scan_schedule and can run while a classic scan is running.
Events are placed in the queue by set_recheck. An empty queue ends the cycle without requests to the application. The result is read by get_recheck_status: true means the vulnerability is confirmed, false means it is not.
An event is confirmed only by the module that checks its type: SQLi by sqli, XSS by xss, LFI and UFU by lfi, RFI by rfi, RCE and OSCI by rce, NoSQLi by nosqli, SSTI by ssti, Archive access and Source code disc. by sde. Each module retests only the events of its type. A finding of another type is stored as a new vulnerability and does not confirm the event. sde requests the path the event recorded and confirms it when that file is served and a made-up file beside it is not. An Archive access or Source code disc. event in another zone stays false. An event of any other type, for example Injection, Susp. access or one recorded by MLA, stays false, and recheck.log names it. The attack types are listed in Attack types. An event also stays false when its module is in exclude_modules of the target.
If scan_proxy is set, both the classic scan and recheck send requests through that proxy. When the host of a queued event is also a configured target, recheck uses the authorization parameters and the excluded modules of that target.
For the agent to work correctly, the following files and directories are located on the server:
/etc/mikiri-waf-scanner/scanner.conf - the configuration file of the initial setup;/etc/mikiri-waf-scanner/db/settings.json - the last settings received from API;/etc/mikiri-waf-scanner/tmp/ - the process identifiers scanner.pid and recheck.pid;/etc/mikiri-waf-scanner/sys/ - the agent files, including the certificate ca.crt used for the license check;/var/log/mikiri-waf/scanner/ - the event logs scanner.log and recheck.log.