I was reading an article on "Protocol-Level Evasion of Web Application Firewalls" and the article insist on writing application specific rules in this manner:

<Location /index.php>
SecDefaultAction phase:2,t:none,log,deny
# Validate parameter names
SecRule ARGS_NAMES "!^(articleid)$" \
"msg:'Unknown parameter: %{MATCHED_VAR_NAME}'"
# Expecting articleid only once
SecRule &ARGS:articleid "!@eq 1" \
"msg:'Parameter articleid seen more than once'"
# Validate parameter articleid
SecRule ARGS:articleid "!^[0-9]{1,10}$" \
"msg:'Invalid parameter articleid'"

The idea is to enumerate all the parameters against the web resource and filter them as shown in the rules above. My question is what other sort of application specific tuning is further required for WAF rules.

  • I'm not sure that you will get any answers to this. A WAF is application-specific. You need to tune it to your application. If you have access to the original developers of the application, you can enlist their help in coming up with the rules you need. – schroeder Mar 12 '13 at 14:43

I'm not sure that you understood the article. The article insists on writing rules according to the following rubric:

  1. Enumerate all parameters.
  2. For each parameter, determine how many times it can appear in the request.
  3. For each parameter, confirm that the value conforms to the desired format.
  4. Reject requests that contain unknown parameters.
  5. Reject requests that use invalid encoding.

These are the very basic guidelines for writing any WAF rulesets i.e. filter out what does not fit the quantity, content, or encoding of the expected data.

The details of what that should look like for any specific application is entirely up to the application itself. Look at the code or ask the developer of the application what the expected and valid parameters are.

Once you have done that, you need to update the rules if the application is updated, and you need to constantly monitor and tune the WAF according to what is sent to the application.

  • Agreed this is very basic application specific tuning to validate application input. My question is there any further application specific information i need to acquire from the developer? – Ali Ahmad Mar 13 '13 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.