Question for use of Azure WAF for Thesis

Question

Good afternoon, I hope you are well. I am a final year student currently studying for my Bachelor's degree in Computing and Business and for my thesis I was aiming to create and use a virtual testing environment using Oracle VirtualBox to be able to host various web applications extracted from OWASP Juice shop. The locally hosted testing environment will be made available on the internet and be given a domain from GoDaddy. Furthermore, the testing environment will be exposed to several predefined attacks using Kali Linux, which include but are not limited to SQL Injection, DoS attacks and broken authentication. These attacks will be launched against three different web application firewalls, Cloudflare, Azure WAF and NAXSI. Hence, in total there will be 3 domains which will be public, one for each. Kindly note that the virtual machines will be hosted locally on my laptop. Would this be allowed please since it is for educational purposes and hosted locally?

Answer 1

@Ismael Magro

The list of allowed and prohibted tests can be found on Penetration Testing Rules of Engagement:

RULES OF ENGAGEMENT TO PERFORM PENETRATION TESTING ON THE MICROSOFT CLOUD

The goal of this program is to enable customers to test their services hosted in Microsoft Cloud services without causing harm to any other Microsoft customers. The following activities are prohibited: Scanning or testing assets belonging to any other Microsoft Cloud customers. Gaining access to any data that is not wholly your own. Performing any kind of denial of service testing. Performing network intensive fuzzing against any asset except your Azure Virtual Machine Performing automated testing of services that generates significant amounts of traffic. Deliberately accessing any other customer’s data. Moving beyond “proof of concept” repro steps for infrastructure execution issues (i.e. proving that you have sysadmin access with SQLi is acceptable, running xp_cmdshell is not). Using our services in a way that violates the Acceptable Use Policy, as set forth in the Microsoft Online Service Terms. Attempting phishing or other social engineering attacks against our employees.

The following activities are encouraged:

• Create a small number of test accounts and/or trial tenants for demonstrating and proving cross-account or cross-tenant data access. However, it is prohibited to use one of these accounts to access the data of another customer or account.
• Fuzz, port scan, or run vulnerability assessment tools against your own Azure Virtual Machines.
• Load testing your application by generating traffic which is expected to be seen during the normal course of business. This includes testing surge capacity.
• Testing security monitoring and detections (e.g. generating anomalous security logs, dropping EICAR, etc).
• Attempt to break out of a shared service container such as Azure Websites or Azure Functions. However, should you succeed you must both immediately report it to Microsoft and cease digging deeper. Deliberately accessing another customer’s data is a violation of the terms.
• Applying conditional access or mobile application management (MAM) policies within Microsoft Intune to test the enforcement of the restriction enforced by those policies.

Hope this answers your question. Let me know if you need further assistance.

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts. If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!