Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks.

We know each web application has a number of input parameters. I think these input parameters and their associated valid values can be possibly extracted by code analysis tool.

Now, my question is that can we use code analysis tools and pass their results to the WAF to detect some logical attacks such as an example which has been described in this page: Logical and Technical Vulnerabilities?

Besides, I would like to know what are the advantages of using code analysis with WAF?

I googled and I couldn't find any WAF which uses code analysis for generating its rules or increasing its performance and decreasing false positives.

• In theory, yes, but it would depend on the WAF tool you are using. You could do an analysis of traffic sent or of A/B testing with fuzzing and find logical flow. If the application is unit tested they likely have cases to cover unexpected inputs. It may be possible to write an algorithm that could take these inputs and react based upon logical activity that should never occur. – Eric G Jan 18 '18 at 2:56
• So you think using code analysis is useless for increasing WAF performance as well as decreasing false positives? @EricG – Patris Jan 20 '18 at 21:06

If you can actually determine the valid input values from static analysis, you can use that to guide proper input validation in your application. However, with that lack of input validation, most static analysis tools would not be able to determine the appropriate answers. Web Application Firewalls are used to defend against the unknown vulnerabilities and common patterns (e.g., XSS and SQLi mostly).

• So you say that using code analysis is useless for detecting logical attacks like manipulating URLs such as CSRF? What is your idea for decreasing false positives? Actually I want to know if using code analysis can decrease false positives, why popular WAFs don't use this method? – Patris Jan 20 '18 at 20:46

Modern web application firewalls have the capability to enforce the application logic by studying and training on the valid execution paths of the application and blocking any request which doesn't follow it. For example, suppose an application logic have the following operations in the order below:

1. Choose item
2. Perform payment

WAFs can enforce that the above three steps are performed in the order as given above. This means that if an attack attempts to performs the following:

1. Choose item
• What about If the WAF uses the results of source code analysis? In this situation, does it able to detect some logical like manipulating URLs such as CSRF or changing user's password? – Patris Jan 20 '18 at 20:56