Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi?

If so is a WAF considered a redundant defence measure?

  • 5
    Even a "well configured" WAF may not be a perfectly performing WAF. There are often ways to evade blacklist filters, whereas whitelisting might be more foolproof. It is still hard to make the claim that there is no possibility of successful exploitation, but I can't say that it is redundant either. – multithr3at3d Jun 11 '18 at 22:46
  • It will depend on your definition of "well-configured". Do you mean that the WAF is perfectly configured and is perfectly updated to a perfect configuration when the application of threats change? – schroeder Aug 15 '18 at 19:11

Absolutely, there are not perfect protections so there are new ways to do injection appearing from time to time and often there will be a windows of opportunity between when that new type of attacks is published and when it gets fixed or patched.

Many WAF's can do positive security which is a very strong protection against yet unknown attacks in many cases, that would require more configuration and maintenance but it can be very good for security.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.