We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign.

At the moment we have tuned chars out to let the traffic flow through. I have requested to create an alert only rule to keep visibility over white listed traffic, however, it requires a lot of manual auditing and I am not comfortable with this approach long term.

Any ideas how rules can be tuned without such an impact of SQLi detection?

  • 1
    This really depends on the WAF you are using. Commercial WAFs usually have something called "Learning mode" where it tries to learn all the valid inputs to the application and based on those, the rules are configured automatically. Open source WAFs don't have such capability and you will have to configure it in detection only mode while analyzing the logs and perform the tuning manually. However, even in case of commercial WAFs, you will have to put in a lot of effort in order to remove the false positive and false negatives as every application is different. – void_in Feb 12 at 15:00
  • Can your WAF ingest something like a Swagger/OpenAPI doc? Usually, fields are going to fall into one of two categories - restricted by the domain type, or (almost) anything goes. Note the specific characters you mention are more widely applicable than you might realize - names, possibly phone numbers, addresses, email addresses... If a field isn't a number, artificially alpha-numeric-only (usernames on some sites - but not here), or an enum (limited choice of values), it's probably more common that any character should be valid. – Clockwork-Muse Feb 12 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.