Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
4 votes
1 answer
1k views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
1 vote
1 answer
73 views

Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?

Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
2 votes
1 answer
154 views

Modsecurity blocks blocks my legit XHR POST request (403 forbidden)

I'm new to modsecurity topic so maybe my question is stupid but... I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
1 vote
1 answer
1k views

OWASP CRS Anomaly scoring, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines: setvar:'tx....
0 votes
1 answer
2k views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
1 vote
1 answer
303 views

Modsecurity CRS how to deal with field arrays

I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following: ... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]" ... ...
3 votes
1 answer
207 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
31 votes
8 answers
10k views

What's wrong with the use of a WAF (Web Application Firewall)?

My SaaS company recently lost the bid for an enterprise software licensing deal. One of the reasons the prospect gave for not choosing us as a vendor was: the use of a WAF I'm not an information ...
2 votes
1 answer
695 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
1 vote
3 answers
532 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
1 vote
1 answer
316 views

ModSecurity CRS, allow header `accept-charset`

I have ModSecurity v2 on apache with CRS v3. Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
0 votes
1 answer
47 views

Can Caching cause my WAF logged events to drop?

I've been using Ninjafirewall on WordPress websites for a while. I recently installed a new caching plugin on my main website and I noticed the firewall log which usually has around 5000 blocked ...
0 votes
2 answers
444 views

What is Method Enforcement. How to simulate this attack?

I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules. How to test this attack on magento website? What is security best practice to prevent this?
21 votes
2 answers
5k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
0 votes
0 answers
243 views

CVE-2021-22123 fortiweb bypass?

As a cybersecurity enthusiast, I tried to do the following exercise : A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
0 votes
2 answers
548 views

Check for special characters in request parameters

Our system is accepting requests including special characters, see parameter2. Request [ { "reqHeader": { "parameter1": "abc", "...
1 vote
2 answers
3k views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0 votes
2 answers
152 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
1 vote
2 answers
2k views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
1 vote
0 answers
118 views

WAF checking username/password before passing to app [closed]

I want to protect a web app behind some other application. This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it ...
1 vote
2 answers
2k views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
3 votes
1 answer
311 views

Sqlmap Manual Vulnerability Assessment

I am trying penetration testing for one of my clients. The platform is Code ignitor. There is an endpoint /find/1. The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
1 vote
1 answer
510 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
-4 votes
1 answer
282 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
1 vote
0 answers
152 views

Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag. The question here is ...
-1 votes
1 answer
931 views

Do WAFs block base64 encoded inputs?

Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually ...
3 votes
1 answer
854 views

Bypassing "OR" SQLi filter

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target. To get the OR keyword, I use ||. ...
1 vote
0 answers
1k views

Bypass sql injection filtering (whitespace, /, *) [closed]

I want to bypass a sql injection waf that replaces /,* and whitespaces. This is a payload I want use : ?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table-- But the ...
1 vote
1 answer
142 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
1 vote
0 answers
578 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
3 votes
1 answer
369 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
0 votes
1 answer
344 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
1 vote
0 answers
184 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
2 votes
2 answers
44k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
0 votes
0 answers
736 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
1 vote
1 answer
3k views

Can a firewall appliance block http requests? [closed]

Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this: Internet > router > Firewall > webserver Can the firewall act as a WAF and block ...
2 votes
2 answers
2k views

What is the best material for building an web application firewall? [closed]

I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application ...
0 votes
1 answer
720 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1 vote
1 answer
2k views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
1 vote
2 answers
426 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
2 votes
1 answer
571 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
1 vote
1 answer
12k views

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt; [duplicate]

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
2 votes
0 answers
357 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
2 votes
3 answers
265 views

Stop User Enumeration requests on AJAX endpoints

I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
1 vote
1 answer
2k views

XSS in a variable assignment when <>" are escaped

SCENARIO: user input is reflected inside a variable. For example url.com/?a=hello is reflected as shown below var test="hello"; I tried to evade from the variable with payload like hello&...
0 votes
1 answer
218 views

How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]

I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases. So the WAF thinks some ...
0 votes
1 answer
254 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
1 vote
0 answers
1k views

Do we need SSL Certificate on both Firewall and WAF for inbound traffic?

We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
0 votes
1 answer
337 views

Cloudflare Full Strict HTTPS flow

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...