Questions tagged [waf]
WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
140
questions
4
votes
1
answer
1k
views
Avoiding WAF with DirBuster
I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
1
vote
1
answer
73
views
Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?
Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
2
votes
1
answer
154
views
Modsecurity blocks blocks my legit XHR POST request (403 forbidden)
I'm new to modsecurity topic so maybe my question is stupid but...
I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
0
votes
1
answer
2k
views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
1
vote
1
answer
303
views
Modsecurity CRS how to deal with field arrays
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
... ...
3
votes
1
answer
207
views
How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?
Problem
Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*.
...
31
votes
8
answers
10k
views
What's wrong with the use of a WAF (Web Application Firewall)?
My SaaS company recently lost the bid for an enterprise software licensing deal.
One of the reasons the prospect gave for not choosing us as a vendor was:
the use of a WAF
I'm not an information ...
2
votes
1
answer
695
views
Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?
For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER.
I wanted to find out if there are any benefits of placing WAF ...
1
vote
3
answers
532
views
Port scanning against assets that are behind a WAF
I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
1
vote
1
answer
316
views
ModSecurity CRS, allow header `accept-charset`
I have ModSecurity v2 on apache with CRS v3.
Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
0
votes
1
answer
47
views
Can Caching cause my WAF logged events to drop?
I've been using Ninjafirewall on WordPress websites for a while.
I recently installed a new caching plugin on my main website and I noticed the firewall log which usually has around 5000 blocked ...
0
votes
2
answers
444
views
What is Method Enforcement. How to simulate this attack?
I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules.
How to test this attack on magento website? What is security best practice to prevent this?
21
votes
2
answers
5k
views
Which IP address would be most safe and suitable to use as a placeholder in a live system?
Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?
e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
0
votes
0
answers
243
views
CVE-2021-22123 fortiweb bypass?
As a cybersecurity enthusiast, I tried to do the following exercise :
A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
0
votes
2
answers
548
views
Check for special characters in request parameters
Our system is accepting requests including special characters, see parameter2.
Request [
{
"reqHeader": {
"parameter1": "abc",
"...
1
vote
2
answers
3k
views
How do I scan a WordPress website which blocks WPSCAN from scanning the website?
I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
2
answers
152
views
Can a WAF transform HTTP response
I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
1
vote
2
answers
2k
views
String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403
Details
I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
1
vote
0
answers
118
views
WAF checking username/password before passing to app [closed]
I want to protect a web app behind some other application.
This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it ...
1
vote
2
answers
2k
views
Bypass WAF to perform XSS?
I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed.
Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
3
votes
1
answer
311
views
Sqlmap Manual Vulnerability Assessment
I am trying penetration testing for one of my clients.
The platform is Code ignitor.
There is an endpoint /find/1.
The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
1
vote
1
answer
510
views
Single and double Encoding of parameters to bypass security filters
I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.
How ...
-4
votes
1
answer
282
views
Secure Traffic model for Web application Protection
Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
1
vote
0
answers
152
views
Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?
I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity.
Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.
The question here is ...
-1
votes
1
answer
931
views
Do WAFs block base64 encoded inputs?
Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually ...
3
votes
1
answer
854
views
Bypassing "OR" SQLi filter
I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.
To get the OR keyword, I use ||.
...
1
vote
0
answers
1k
views
Bypass sql injection filtering (whitespace, /, *) [closed]
I want to bypass a sql injection waf that replaces /,* and whitespaces.
This is a payload I want use :
?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table--
But the ...
1
vote
1
answer
142
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
1
vote
0
answers
578
views
Azure WAF support for OData
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. ...
3
votes
1
answer
369
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
11
votes
1
answer
2k
views
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
0
votes
1
answer
344
views
Why is my SecAction rule being ignored?
I'm trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
1
vote
0
answers
184
views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
2
votes
2
answers
44k
views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
0
votes
0
answers
736
views
What will happen if https traffic goes through the WAF? [duplicate]
A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
1
vote
1
answer
3k
views
Can a firewall appliance block http requests? [closed]
Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this:
Internet > router > Firewall > webserver
Can the firewall act as a WAF and block ...
2
votes
2
answers
2k
views
What is the best material for building an web application firewall? [closed]
I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application ...
0
votes
1
answer
720
views
Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]
I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
1
answer
2k
views
Layer7 DDoS Protection vs WAF, which should I use?
I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;
...
1
vote
2
answers
426
views
Do I need a WAF in front of an API exposed by Google Cloud Endpoint
I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
2
votes
1
answer
571
views
Custom response for Web Application Firewall (WAF)
What should be the custom response code when WAF blocks a request due to matched rules or policy violation.
We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
1
vote
1
answer
12k
views
Xss filter bypass ><script>alert(1);</script> [duplicate]
As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
2
votes
0
answers
357
views
Mod-security and WordPress WAF
On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence.
I was wondering if a better practice would be to replace them with a host-based ...
2
votes
3
answers
265
views
Stop User Enumeration requests on AJAX endpoints
I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
1
vote
1
answer
2k
views
XSS in a variable assignment when <>" are escaped
SCENARIO:
user input is reflected inside a variable.
For example
url.com/?a=hello
is reflected as shown below
var test="hello";
I tried to evade from the variable with payload like hello&...
0
votes
1
answer
218
views
How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]
I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases.
So the WAF thinks some ...
0
votes
1
answer
254
views
How does Cloudflare firewall work?
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So ...
1
vote
0
answers
1k
views
Do we need SSL Certificate on both Firewall and WAF for inbound traffic?
We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
0
votes
1
answer
337
views
Cloudflare Full Strict HTTPS flow
I would like to understand Cloudflare full(strict) SSL flow.
Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...