WAF stands for Web Application Layer Firewall. WAF is a application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
1
vote
1answer
90 views
WAF SQL evasion using HPF technique
I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discuss two techniques
HPP (HTTP parameter ...
0
votes
1answer
61 views
Writing application specfic rules for WAF?
I was reading an article on "Protocol-Level Evasion of Web Application Firewalls" and the article insist on writing application specific rules in this manner:
<Location /index.php>
...
-1
votes
1answer
124 views
Using ModSecurity as transparent mode
I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not ...
4
votes
1answer
182 views
Securing a simple webservice against brute-force with mod-security
I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
1
vote
1answer
89 views
How to filter https traffic in mod-security WAF?
I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
1
vote
3answers
224 views
Testing Web Application Firewall Configuration (ModSecurity)
What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
10
votes
3answers
205 views
Application security training for developers
I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
-4
votes
1answer
163 views
Secure Traffic model for Web application Protection
Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
2
votes
2answers
275 views
Anomaly based web application Firewall
How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
1
vote
1answer
107 views
IDS/WAF scenario for 2 web servers
I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
12
votes
1answer
160 views
What is a “Trailing Host Header”, and how can I test for it?
My team's been doing some research into WAF protections based upon a WAF testing tool released at Black Hat this year. In the tool, there's a list of hostname evasion tests - that are really just an ...
6
votes
3answers
493 views
Evasion techiques for WAFs
Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
2
votes
2answers
180 views
Web Application Firewall Rules
For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
1
vote
1answer
145 views
Web Application Firewall Rule Optimization
Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
1
vote
1answer
145 views
Working of WAF/IDS/IPS payload normalization schemes?
I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be
base64Encode
html EntityDecode
url Encode
Remove whitespaces
I want to know how WAF/IDS/IPS ...
2
votes
1answer
455 views
Mod Security for apache2 blocks curl!
I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
9
votes
1answer
259 views
Is there a web application firewall equivalent of virustotal?
I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
2
votes
2answers
204 views
ip-fragmentation and mod_security?
is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?
the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
7
votes
5answers
995 views
Master thesis topic - mod_security
I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
12
votes
1answer
603 views
What is a Web Application Firewall?
What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
7
votes
2answers
963 views
How do I get started using ESAPI WAF?
I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
