I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default setups for different WAFs will detect.

I know there is the ModSecurity site out there which I could set up myself and experiment on, but I'd like one that covers the commercial offerings so I can get some experience with the way they work.

Question taken from seclist.org

  • 1
    Can you clarify the legal and ethical aspects of copying this? E.g. is the original your question? copyrighted? licensed? encouraging cross-posting? And also clarify your terms for better SEO and to help newbies?
    – nealmcb
    Commented Jun 8, 2011 at 1:50
  • It is not my question. Does not look to be copyrighted. I'll work on clarifying the question later tonight when I got time. Feel free to contribute by editing.
    – Chris Dale
    Commented Jun 8, 2011 at 12:22
  • @Karrax, everything is copyrighted (by default), unless the author explicitly grants it to the public domain or takes some other similar action.
    – D.W.
    Commented Aug 12, 2011 at 3:24
  • @D.W. I thought it was the contriary :) Anything public on the internett is free unless stated otherwise hehe.
    – Chris Dale
    Commented Aug 12, 2011 at 12:05
  • @Karrax, no, that is not correct.
    – D.W.
    Commented Aug 12, 2011 at 19:11

1 Answer 1


I know of no such site. It's unlikely that such a site would exist, because WAF's don't block things on based on signatures like anti-virus.

WAFs must be configured to work properly. For each input field, you need to tell the WAF what that field can contain. Is it a number? An alpha field? Or can it contain arbitrary characters, including quotes, commas, dashes, semicolons?

One way of configuring a WAF is to put it into learning mode, so it can watch typical input fields. If it sees that only numbers are being sent in the "articleId=" field, then it knows it should probably filter out anything that isn't a number.

In other words, a "web application firewall" is a lot more like a "firewall" and a lot less like an "anti-virus" or "intrusion prevention system".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .