Each directory will correspond to the attack type used to exploit the application we want to protect. Each directory will contain test client vectors triggering the correponding attack type, in addition to the App Protect policy used to mitigate the attack.

• NGINX App Protect Version 4
• A backend application (We use the juicebox application for testing)

Run the client attack script inside the attack type directory. For example, run the brute force attack.

cd Brute_Force_Attack
/bin/bash client_attacks <NGINX-ENDPOINT>

Reference the policy inside the nginx config.

cp Brute_Force_Attack/BruteForceAttack.json /etc/app_protect/conf

Reload NGINX Plus

nginx -s reload