WAF stands for Web Application Layer Firewall. WAF is a application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

learn more… | top users | synonyms

8
votes
3answers
2k views

Evasion techiques for WAFs

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
17
votes
1answer
3k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
11
votes
4answers
1k views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
3
votes
2answers
696 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
1
vote
2answers
694 views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
1
vote
3answers
3k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...