Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be

  • base64Encode

  • html EntityDecode

  • url Encode
  • Remove whitespaces

I want to know how WAF/IDS/IPS deals with payload transformation Pipelines. Such as when multiple/different payload transformation are performed on the payload. Whats WAF/IDS/IPD inherent behavior to deal with such transformation i.e. how many time "URL-decode" is performed for triple URL encoded string (' or 1=1 --). More ever if different different Payload transformation are applied then what will be the behavior of WAF/IPS/IDS?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

That will depend on the WAF product.

However, if the string is double encoded, it will only be of risk to the application if it performs double decoding. That's an edge case. So I can imagine that most WAFs won't do multiple decodings.

You could test this for free by setting up mod_security by the way.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.