What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved by deleting many of the rules from the core ruleset. Now that i have deleted some problematic rules how can i now make sure that my configuration is still secure.


Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.

So you need to have an idea of what attacks you're trying to prevent so that you can test those. Are you attempting to guard against malformed HTTP requests? Try some. Are you trying to counter invalid UTF-8 sequences? Test it. Is there are a specific application vulnerability that you're trying to block at the WAF as a temporary measure because you can't get the application fixed yet? (This is what WAFs are really good for.)

(Are you trying to guard against application-level SQL injection by filtering out the word 'SELECT'? Then you're pretty much wasting your time. There are a lot of rules like this in the mod_security CRS which are pretty much entirely bogus.)

  • 2
    +1 WAF needs training and tuning over time and should be specifically configured for the app its protecting. External rulesets help you think about ways to write your own rules. – schroeder Nov 1 '12 at 16:05

You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect.

Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If configuring the WAF is too complex or time consuming I'd recommend looking at Cloud based WAF solutions like Incapsula or CloudFlare.


One simple way may be to use readily available testing tools such as sqlmap, sqlninja for SQL Injections and XSSer for XSS attack vectors. If any of the vectors weren't caught by the updated ruleset, then you are in trouble. Fix the ruleset accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.