Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the different security testing methodologies that can be applied to test Web Application Firewall? I was able to find a free WAF testing framework developed by Imperva, which generates traffic to test how legitimate and illegitimate traffic is handled by WAF for false positives. I think this technique is limited to traffic generator capability. Is this the only way to test WAF?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

To properly test your appliance and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules.

I would also make them test the application which you are protecting without a WAF, as this will purely test the security of your application. (A WAF is not a miracle to protect a badly secured web application)

If you don't have a budget have a look at Burp (not free) or ZAP and gather some custom payloads from the internet yourself to fuzz your application with.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.