-1

Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually block/trigger some alerts?

Improve this question

1 Answer 1

Reset to default
2

That depends entirely on how the WAF is configured.

When you ask "Do WAFs do this thing?", you speak of them as if there were one and only one way to implement them.

In general, a WAF has to be configured for the application in question. For example, a WAF may be configured to block as soon as it sees bits of SQL syntax, as it may be indicative of attempted SQL injection.

This would be terrible in an SQL administration tool, which is used to configure queries in a database. But from the point of view of the WAF, both are just "SQL syntax in a POST request".

So the WAF needs to be configured for what is legitimate and what is not. If your application regularly transmits base64-encoded data, then that is legitimate and will likely not trigger an alert. If it doesn't then it might trigger one.

Improve this answer
2
  • Thanks for your answer! Is it affected also the response from the web application? I mean, webapp X usually does not respond with anything in base64, could it trigger the WAF which protects that webapp?
    – hyogy
    Commented Mar 24, 2022 at 11:39
  • Usually, WAF only blocks in terms of requests, not responses.
    – user163495
    Commented Mar 24, 2022 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .