Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be

  • base64Encode

  • html EntityDecode

  • url Encode
  • Remove whitespaces

I want to know how WAF/IDS/IPS deals with payload transformation Pipelines. Such as when multiple/different payload transformation are performed on the payload. Whats WAF/IDS/IPD inherent behavior to deal with such transformation i.e. how many time "URL-decode" is performed for triple URL encoded string (' or 1=1 --). More ever if different different Payload transformation are applied then what will be the behavior of WAF/IPS/IDS?

share|improve this question
up vote 0 down vote accepted

That will depend on the WAF product.

However, if the string is double encoded, it will only be of risk to the application if it performs double decoding. That's an edge case. So I can imagine that most WAFs won't do multiple decodings.

You could test this for free by setting up mod_security by the way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.