Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

Back-end changing the url

We have a WAF in front of our environnement. Let's say now the client ask for example.com The waf make a redirect (303) saying https://example.com Now the communication is established between the ...
12
votes
2answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
0
votes
0answers
61 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
1
vote
0answers
46 views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
0
votes
1answer
55 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
0
votes
0answers
53 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
0answers
39 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
2
votes
1answer
370 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
2
votes
2answers
191 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
-2
votes
1answer
56 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
-1
votes
3answers
266 views

Is a web application firewall enough to defend against sql injection? or should I use prepared statements?

Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques? During a conversation with a friend he said it is enough to use web ...
0
votes
1answer
77 views

What are the suggested way to protect content in mobile app

I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header ...
3
votes
2answers
409 views

SAST vs WAF: What should I choose?

Given the fact that I have a WAF already deployed, what is the benefit I could get by purchasing a SAST tool that would scan the engineers' code for security flaws? Does this also apply for SCA tools ...
0
votes
0answers
222 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
1
vote
0answers
75 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
1answer
211 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
0
votes
0answers
348 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
45 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
36 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
0
votes
1answer
5k views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
2
votes
1answer
328 views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
1answer
25 views

Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP)

I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website. Now, using a WAF and setting x-forwarded-for I can get the IP of the ...
2
votes
4answers
84 views

Web Application Firewall with based on an external decision to detect anomaly

I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
3
votes
3answers
264 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
411 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
2
votes
2answers
9k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
-1
votes
1answer
229 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
2k views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
-3
votes
1answer
129 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
0
votes
1answer
59 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
1
vote
1answer
2k views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
2answers
547 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
393 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
794 views

Access denied after inserting reflected XSS payload in JavaScript

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src ...
1
vote
0answers
622 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
1
vote
1answer
121 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
-1
votes
2answers
138 views

WAF/IDS detection question

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT. The HTML always looks like this: <title>403 Forbidden</title> </head><...
0
votes
1answer
37 views

Internet traffic redirect from WAF to Cloud Network - Encrypted vs unencrypted

What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?
0
votes
1answer
734 views

Trying to do a chunked multipart post request, nginx and php both returns 400 error

I'm trying to use chunked protocol and multipart protocol in a POST request, like this All new-line symbols are \r\n, e.g POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1 accept-language: * ...
2
votes
1answer
185 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
0
votes
1answer
318 views

WAFDetect Extension of Burpsuite

I am creating a list of tools for waf fingerprinting. I have installed waf-detect plugin from bapp store in burpsuite. This plugin runs in the background and create passive scanner issues when WAF ...
1
vote
1answer
544 views

Web application firewall using machine learning and how to implement it [closed]

I want to create a web application firewall from scratch. I am going to use machine learning to train it to classify malicious and clean queries. My dilemma is that I am a beginner and am unable to ...
2
votes
2answers
815 views

Protection against command injection with modsecurity

I want to know if modsecurity can protect against command injection and file inclusion. I tested modsecurity with free version and run dvwa which is vulnerable page . But command injection is possible ...
28
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
0
votes
2answers
2k views

Wordpress - blocked by firewall for Malicious File Upload

Our work website is getting flooded with these types of hacks: The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running ...
0
votes
1answer
64 views

Is defending a server from BFA with 2 WAFs possible and common?

I am not of the IS field and hence reference this to the experts here - My question regards to defending a server from a Brute Force Attack (BFA) with 2 Web Application Firewalls (WAFs). The question ...
1
vote
1answer
523 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
1
vote
2answers
252 views

WAF - How to tell what automated tool is causing alerts

When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site? What techniques can I use to narrow ...