Questions tagged [waf]
WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
25
questions with no upvoted or accepted answers
4
votes
1
answer
1k
views
Avoiding WAF with DirBuster
I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
2
votes
0
answers
364
views
Mod-security and WordPress WAF
On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence.
I was wondering if a better practice would be to replace them with a host-based ...
2
votes
1
answer
695
views
Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?
For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER.
I wanted to find out if there are any benefits of placing WAF ...
2
votes
1
answer
163
views
Modsecurity blocks blocks my legit XHR POST request (403 forbidden)
I'm new to modsecurity topic so maybe my question is stupid but...
I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
1
vote
1
answer
73
views
Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?
Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
1
vote
0
answers
157
views
Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?
I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity.
Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.
The question here is ...
1
vote
0
answers
583
views
Azure WAF support for OData
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. ...
1
vote
0
answers
184
views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
1
vote
1
answer
307
views
Modsecurity CRS how to deal with field arrays
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
... ...
1
vote
0
answers
1k
views
Do we need SSL Certificate on both Firewall and WAF for inbound traffic?
We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
1
vote
0
answers
106
views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
0
answers
109
views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
1
vote
0
answers
190
views
WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?
I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
0
answers
122
views
Where should the SCEP requests be decrypted?
Let's say you provide a SCEP service available to the outside world, where should the SCEP requests be decrypted? At the load balancer, in the backend server, elsewhere?
It doesn't look like there is ...
1
vote
0
answers
114
views
Compatibility issue if two wordpress security plugins are used together
My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues?
I have this doubt because ...
1
vote
3
answers
538
views
Port scanning against assets that are behind a WAF
I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
0
votes
0
answers
247
views
CVE-2021-22123 fortiweb bypass?
As a cybersecurity enthusiast, I tried to do the following exercise :
A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
0
votes
0
answers
161
views
WAF really Needed?
I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
0
votes
0
answers
2k
views
Is this SQLMap query is correct?
I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
0
votes
0
answers
622
views
Method to bypass \n in WAF (\n vulnerability)
I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this
{“message”: “hello\nmy name is andi”}
But the problem is the ...
0
votes
0
answers
975
views
Requests logged in Cloudflare as "XSS, HTML Injection - Body"
Rule name: XSS, HTML Injection - Body
Rule: 100096BHTML
Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
0
votes
1
answer
2k
views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0
answers
109
views
WAF tuning for SQLi
We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign.
At the ...
0
votes
0
answers
103
views
How to deploy your web server's Web Application Firewall while limiting false positives
For objective discussion:
We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...