WAF stands for Web Application Layer Firewall. WAF is a application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

learn more… | top users | synonyms

9
votes
3answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
17
votes
1answer
4k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
11
votes
4answers
1k views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
2
votes
2answers
896 views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
1
vote
3answers
4k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...