Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
0
votes
0answers
40 views

Do we need SSL Certificate on both Firewall and WAF for inbound traffic?

We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
0
votes
1answer
50 views

Cloudflare Full Strict HTTPS flow

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
1
vote
0answers
39 views

OWASP CRS Anamoly scoring,, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines : setvar:'tx....
1
vote
0answers
38 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
0
votes
0answers
52 views

WAF really Needed?

I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
0
votes
1answer
84 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
3
votes
1answer
50 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
3
votes
1answer
131 views

How URL Encoding Works?

I am learning about web security but very confused about URL Encoding, it will be big help if anyone can help. On PortSwigger, I learned that url "http://127.0.0.1/admin" can be used as "http://127.0....
0
votes
1answer
49 views

Security for External Communication to an EC2 on AWS

I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me). Currently the program performs no authentication, We install the ...
0
votes
0answers
46 views

Insecurity through all the security. (Questions on infrastructure set up)

I've got an issue with a proposed infrastructure set up so I come to you for some enlightenment. The flow is: client --> fw--> waf--> api gw--> applications. Clients will communicate with us using ...
0
votes
1answer
35 views

Back-end changing the url

We have a WAF in front of our environnement. Let's say now the client ask for example.com The waf make a redirect (303) saying https://example.com Now the communication is established between the ...
12
votes
2answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
0
votes
0answers
141 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
1
vote
0answers
83 views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
0
votes
1answer
98 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
0
votes
0answers
92 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
0answers
95 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
2
votes
1answer
965 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
2
votes
2answers
321 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
-2
votes
1answer
60 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
-1
votes
3answers
279 views

Is a web application firewall enough to defend against sql injection? or should I use prepared statements?

Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques? During a conversation with a friend he said it is enough to use web ...
0
votes
1answer
86 views

What are the suggested way to protect content in mobile app

I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header ...
3
votes
2answers
446 views

SAST vs WAF: What should I choose?

Given the fact that I have a WAF already deployed, what is the benefit I could get by purchasing a SAST tool that would scan the engineers' code for security flaws? Does this also apply for SCA tools ...
0
votes
0answers
307 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
1
vote
0answers
84 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
1answer
279 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
0
votes
0answers
526 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
46 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
38 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
0
votes
1answer
7k views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
1
vote
1answer
489 views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
1answer
25 views

Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP)

I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website. Now, using a WAF and setting x-forwarded-for I can get the IP of the ...
2
votes
4answers
94 views

Web Application Firewall with based on an external decision to detect anomaly

I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
3
votes
3answers
311 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
506 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
2
votes
2answers
14k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
-1
votes
1answer
242 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
1answer
2k views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
-3
votes
1answer
138 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
0
votes
1answer
61 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
1
vote
1answer
3k views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
2answers
615 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
486 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
1k views

Access denied after inserting reflected XSS payload in JavaScript

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src ...
1
vote
0answers
664 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
1
vote
1answer
154 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
-1
votes
2answers
143 views

WAF/IDS detection question

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT. The HTML always looks like this: <title>403 Forbidden</title> </head><...
0
votes
1answer
39 views

Internet traffic redirect from WAF to Cloud Network - Encrypted vs unencrypted

What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?