Working of WAF/IDS/IPS payload normalization schemes?

Question

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be

• base64Encode

• html EntityDecode

• url Encode
• Remove whitespaces

I want to know how WAF/IDS/IPS deals with payload transformation Pipelines. Such as when multiple/different payload transformation are performed on the payload. Whats WAF/IDS/IPD inherent behavior to deal with such transformation i.e. how many time "URL-decode" is performed for triple URL encoded string (' or 1=1 --). More ever if different different Payload transformation are applied then what will be the behavior of WAF/IPS/IDS?

Answer 1

That will depend on the WAF product.

However, if the string is double encoded, it will only be of risk to the application if it performs double decoding. That's an edge case. So I can imagine that most WAFs won't do multiple decodings.

You could test this for free by setting up mod_security by the way.