Tag Info

A Web Application Firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. By making use of the rules many attacks such as Cross-site scripting (XSS) and SQL Injection, can be detected and blocked. For a more depth description see the OWASP Website and Wikipedia. When it comes to choosing a Web ...

The Host-header is used by the client to indicate with which server name it wants to speak. Multiple websites may be served off from a single IP address. In the HTTP protocol, data may be sent in multiple chunks. This is especially useful if the server does not know the size of the data before completing the request (e. g. a live stream or a web application ...

Check out Ivan Ristić's research. Snippets below from his post on the Qualys blog: Today at Black Hat [2012] we are announcing a new research project on protocol-level evasion of web application firewalls. This type of evasion focuses on the low level operation of WAFs, aiming to exploit little differences in how WAFs see traffic and how backend web ...

It can be difficult to predict how a WAF will inspect traffic because WAF rules and methods are not standardized and work so high up the stack. Basically, you are looking for weaknesses in detection and/or to make it as difficult as possible for a WAF to properly interpret the communication sent to the target. Some techniques that can be used: mixed case ...

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...

Here are some research papers that tackle this sort of problem and might interest you: Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009. Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...

I know of no such site. It's unlikely that such a site would exist, because WAF's don't block things on based on signatures like anti-virus. WAFs must be configured to work properly. For each input field, you need to tell the WAF what that field can contain. Is it a number? An alpha field? Or can it contain arbitrary characters, including quotes, commas, ...

AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where ...

To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security. Essentially mod_security is simply a plugin to the webserver, and does not handle any IP stuff on it's own. What it receives is always just a complete HTTP request. As such, the simple answer would be "No". However. If you take your evasion concept ...

Does order of Rules matter ? Of course. It's mostly about performance. Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the ...

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...

I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion: Does order of Rules matter ? @symcbean said it all. How inconsistent rules are handle. If you are referring to a scenario in which several ...

I recommend looking at Microsoft's Security Development Lifecycle (SDL). They have a lot of great resources. Also look at BSIMM and OpenSAMM. Some related questions and information: Secure Software Development Reading about security by design? How and where to begin on the Return of Web Application Security Investment? What is considered the simplest ...

Maybe look into creating or applying advanced analytics to web application activity to profile users for the purpose of identifying potential bad activity. Build on top of what ModSecurity outputs and test algorithms/models that make it easier for a security operations team to quickly understand what activity a particular user is doing and why it may be ...

You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect. Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If ...

If you can provide the lines in your log file showing what rule is causing the block it would be helpful. An option would be to use SecRuleRemoveByID to disable the rule that is causing your block. Alternatively you can white list IP address using a number of different techniches which are listed here

Check out Safelight Security. They are focused on application security training have an entire curriculum for developers. Full disclosure - I work for Safelight! If you want to get information, you can request it directly from Larry Gorkun lgorkun@safelightsecurity.com.

It's pretty well explained in this blog post how it works. In essence, if you can construct such a URL query to split individual parts of a subsequent SQL query in more query parameters (thus the fragmentation part of it's name), the WAF (Web Application Firewall) might have problems determining it's supposed to drop the request, or whatever it's setup to do ...

I'm not sure that you understood the article. The article insists on writing rules according to the following rubric: Enumerate all parameters. For each parameter, determine how many times it can appear in the request. For each parameter, confirm that the value conforms to the desired format. Reject requests that contain unknown parameters. ...

ModSecurity is just a module for apache web server and we need to to add Modsecurity module in the apache configuration for the modsecurity to work. In order for the modsecurity to work we need to configure modsecurity as a reverse proxy we need to configure apache configuration like an example. For the understanding of basic reverse proxy configuration i ...

There are rate-limiting rule set in ModSecurity CRS that does not directly correlate whether the authentication attempt was successful or not. Following is one of the Rule SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}" "phase:5,id:'981042',t:none,nolog,pass,t:none, setvar:ip.brute_force_burst_counter=+1, ...

Try checking Big-IP from F5... used by Facebook, BoA and other companies.. http://news.netcraft.com/archives/2009/05/29/f5_bigip_hosts_10_million_sites.html It is the ASM (Application Security Manager) that handles the web attack protection... http://www.f5.com/products/big-ip/

Well, the way I read the difference between those two regular expressions, \bgetparentfolder\b \bonmousedown\b\W*?\= is that the first one is just matching the string "getparentfolder", while the second one is matching the string "onmousedown" appended with anything but letters, digits, and underscores, lazily matching the previous item (the appended ...

Start by reading through the academic literature in this area, to understand the work that has been done so far and where the state-of-the-art stands. You might start by looking through the proceedings of RAID, DIMVA, and Usenix Security to find papers that sound relevant to your interest. Read those papers, the papers they cite (if they sound relevant), ...

My answer goes in line with AviD: what would be interesting (for me at least :D) is to show whether mod_security has any added value when the actual exploit is not as an input parameter but rather inputted through a file. For instance a txt file that contains malicious javascript. IE browsers (certain versions) try to execute it regardless of the ...

Maybe, instead of only looking at what it does and what it prevents, consider taking a look at what it does not do, and what it cannot prevent. From that point, you might want to consider generically looking at all web application firewalls, and what is possible (and what is not) to block using current technologies, maybe broken down according to the ...