Tag Info

Hot answers tagged

26

When deploying security, it is often a good idea to apply multiple layers. Just because you have a lock on your bedroom door doesn't mean you don't put one on the front door to your house. You may also apply a generic set of WAF rules in front of multiple applications. A WAF may be part of a larger suite for IDS/IPS, it could also help with the performance ...


14

A Web Application Firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. By making use of the rules many attacks such as Cross-site scripting (XSS) and SQL Injection, can be detected and blocked. For a more depth description see the OWASP Website and Wikipedia. When it comes to choosing a Web ...


12

Your approach should be two-fold: Technical: Check for: Various escape sequences (e.g. \x00, %s, \\, etc.) Unicode tricks (e.g. multi-byte characters that end in 0x22 to produce a ") Alternative XSS methods (e.g. <img src=0 onerror=alert(1) /> instead of <script>alert(1)</script>) Various nasties (e.g. XSS, SQL injection) inside of ...


11

The Host-header is used by the client to indicate with which server name it wants to speak. Multiple websites may be served off from a single IP address. In the HTTP protocol, data may be sent in multiple chunks. This is especially useful if the server does not know the size of the data before completing the request (e. g. a live stream or a web application ...


10

Check out Ivan Ristić's research. Snippets below from his post on the Qualys blog: Today at Black Hat [2012] we are announcing a new research project on protocol-level evasion of web application firewalls. This type of evasion focuses on the low level operation of WAFs, aiming to exploit little differences in how WAFs see traffic and how backend web ...


10

It can be difficult to predict how a WAF will inspect traffic because WAF rules and methods are not standardized and work so high up the stack. Basically, you are looking for weaknesses in detection and/or to make it as difficult as possible for a WAF to properly interpret the communication sent to the target. Some techniques that can be used: mixed case ...


8

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...


8

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type ...


8

Many organizations are saddled with legacy applications written by developers who are long since gone, WAFs are a way for that organization to protect itself from attacks against those applications. WAFs are also much faster in deploying fixes. It can take weeks or months to update complex applications, WAFs often have their protection updated in hours. ...


7

1.Are those three processes (in)appropriate or am I missing any step/process of the whole thing? Do you have a need to inspect SSL encrypted traffic? Depending on where your WAF is positioned in your network, you may need a process to handle certificate provisioning and renewal with respect to how the WAFviews traffic. I separate it into these areas: ...


6

There are three approaches to attacking a web application behind a Web Application Firewall (WAF). If you look at existing WAF bypass exploits you can see that they break down into two major categories. You can bypass a set of rules because it is overly restrictive or does not accurately match a real attack, or attack the pre-processor which will bypass ...


5

Here are some research papers that tackle this sort of problem and might interest you: Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009. Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...


5

I know of no such site. It's unlikely that such a site would exist, because WAF's don't block things on based on signatures like anti-virus. WAFs must be configured to work properly. For each input field, you need to tell the WAF what that field can contain. Is it a number? An alpha field? Or can it contain arbitrary characters, including quotes, commas, ...


5

No but only few applications are completely secure. A WAF is a way of mitigating attacks before they actually reach your application. Furthermore you can easily identify malicious users and automatically block them. WAFs aren't meant to fix your application, they are there to prevent and sometimes mitigate attacks. If your application is secure, but the ...


4

AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where ...


4

To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security. Essentially mod_security is simply a plugin to the webserver, and does not handle any IP stuff on it's own. What it receives is always just a complete HTTP request. As such, the simple answer would be "No". However. If you take your evasion concept ...


4

Does order of Rules matter ? Of course. It's mostly about performance. Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the ...


4

The only generic approach to preventing SQL injection is to use parameterised queries, also known as prepared statements. These essentially separate out the data from the query language at the protocol level, so the DBMS software will not try to parse any query language from the parameters. The mechanism you described looks like it's filtering requests with ...


4

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


4

Organizations have to look at the capabilities WAFs can provide that traditional web applications do not provide (or, are generally not coded to provide). For example, WAFs generally have some type of "response" mechanism built-in. In the event of an attack, they can automatically respond to protect the application. This can include brute-force ...


3

I'm not sure that you understood the article. The article insists on writing rules according to the following rubric: Enumerate all parameters. For each parameter, determine how many times it can appear in the request. For each parameter, confirm that the value conforms to the desired format. Reject requests that contain unknown parameters. ...


3

I recommend looking at Microsoft's Security Development Lifecycle (SDL). They have a lot of great resources. Also look at BSIMM and OpenSAMM. Some related questions and information: Secure Software Development Reading about security by design? How and where to begin on the Return of Web Application Security Investment? What is considered the simplest ...


3

I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion: Does order of Rules matter ? @symcbean said it all. How inconsistent rules are handle. If you are referring to a scenario in which several ...


3

To properly test your appliance and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules. I would also make them test the application which you are protecting ...


3

A WAF applies filter rules on traffic at an "application" level (e.g. it tries to detect SQL injection attempts). This requires that the WAF sees the traffic, i.e. whatever SSL which may have happened on the client side must stop at the WAF. But you usually want some SSL to protect the traffic between the client and the WAF (in fact, you usually want it more ...


3

WAFs are a reaction to the irresponsibility of allowing everything to be done at a web level. Put it this way: previously we had services running in different ports. Soon enough there was a need to create firewalls to block certain services from being indiscriminately open to anyone who wished to probe it. So services were being filtered and the only thing ...


2

If you can provide the lines in your log file showing what rule is causing the block it would be helpful. An option would be to use SecRuleRemoveByID to disable the rule that is causing your block. Alternatively you can white list IP address using a number of different techniches which are listed here


2

Maybe look into creating or applying advanced analytics to web application activity to profile users for the purpose of identifying potential bad activity. Build on top of what ModSecurity outputs and test algorithms/models that make it easier for a security operations team to quickly understand what activity a particular user is doing and why it may be ...


2

Check out Safelight Security. They are focused on application security training have an entire curriculum for developers. Full disclosure - I work for Safelight! If you want to get information, you can request it directly from Larry Gorkun lgorkun@safelightsecurity.com.


2

There are rate-limiting rule set in ModSecurity CRS that does not directly correlate whether the authentication attempt was successful or not. Following is one of the Rule SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}" "phase:5,id:'981042',t:none,nolog,pass,t:none, setvar:ip.brute_force_burst_counter=+1, ...



Only top voted, non community-wiki answers of a minimum length are eligible