Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a question about XSS and SQL-injection attacks. All of the prevention methods against these attacks that I've read about rely on changing the application itself. Validating, filtering and encoding input/output, in the case of SQL injection using parameterized statements etc.
Are there any methods that could be applied on the environment level (network, server, OS, web server, SQL database server) that could help protect against such attacks?
As Arminius mentioned, a web application firewall (WAF) (https://en.wikipedia.org/wiki/Web_application_firewall) is a service which sits in between the client and your server which attempts to filter out bad traffic. The issue with WAFs is that they are prone to false negatives (permitting malicious traffic). For example, a WAF may be able to block a SQL injection attempt for ' OR 1=1; --' but allow ' OR 3<4; --'
I recommend people view them as bandaids, rather than a final solution. Use them to provide an extra layer of defense while you work on patching the application itself.
As @Arminius mentioned in a comment, there are products (software or hardware) called "Web application firewalls" (WAFs) what inspect network traffic before it hits your web server process. Unfortunately, they're really not reliable. Not only are there commonly-known bypasses to some kinds of WAF, the protection they provide is inherently a matter of blocking stuff that might be harmful, without knowing how it will be used, which means they usually need to be configured somewhat conservatively to prevent false positives. They also tend not to be updated as quickly as new vulnerabilities are discovered; they're reactive to known threat patterns, but aren't generally proactive. They also can't protect against all potential ways to screw up a web application even within the context of XSS and SQLi; I've seen sites vulnerable to XSS via crazy things like "if parameter A evaluates to true, parameter B will get passed to eval", which was very stupid on the developer's part but isn't something a WAF could ever catch.
As part of a defense-in-depth strategy, WAFs have their place, much like antivirus software. They're not suitable as an alternative to a proper security review, though. In addition to their weaknesses to some XSS or SQLi vectors, they are also totally incapable of preventing other classic web app vulns like CSRF, clickjacking, or session fixation, and are not particularly likely to catch things like arbitrary file include, arbitrary file upload, or OS command injection.
Spend your money on getting somebody who knows web app security to review your site long before you bother looking at WAFs.
