Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
0 votes
0 answers
30 views

Writing effective UFW & IpTable rules

I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
user avatar
  • 197
1 vote
0 answers
29 views

Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag. The question here is ...
user avatar
0 votes
1 answer
62 views

Do WAFs block base64 encoded inputs?

Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually ...
user avatar
  • 13
1 vote
0 answers
159 views

Bypass sql injection filtering (whitespace, /, *) [closed]

I want to bypass a sql injection waf that replaces /,* and whitespaces. This is a payload I want use : ?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table-- But the ...
user avatar
  • 11
3 votes
1 answer
86 views

Bypassing "OR" SQLi filter

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target. To get the OR keyword, I use ||. ...
user avatar
1 vote
1 answer
46 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
user avatar
0 votes
0 answers
116 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
user avatar
1 vote
2 answers
331 views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
user avatar
  • 113
0 votes
1 answer
167 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
user avatar
  • 51
0 votes
2 answers
131 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
user avatar
1 vote
0 answers
130 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
user avatar
  • 11
0 votes
0 answers
147 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
user avatar
  • 101
0 votes
1 answer
747 views

Can a firewall appliance block http requests? [closed]

Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this: Internet > router > Firewall > webserver Can the firewall act as a WAF and block ...
user avatar
0 votes
1 answer
171 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
user avatar
1 vote
1 answer
412 views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
user avatar
  • 113
0 votes
1 answer
166 views

Modsecurity CRS how to deal with field arrays

I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following: ... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]" ... ...
user avatar
  • 1
1 vote
1 answer
129 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
user avatar
  • 4,754
0 votes
1 answer
1k views

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt; [duplicate]

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
user avatar
  • 1
1 vote
0 answers
116 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
user avatar
2 votes
3 answers
125 views

Stop User Enumeration requests on AJAX endpoints

I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
user avatar
  • 149
1 vote
1 answer
393 views

XSS in a variable assignment when <>" are escaped

SCENARIO: user input is reflected inside a variable. For example url.com/?a=hello is reflected as shown below var test="hello"; I tried to evade from the variable with payload like hello&...
user avatar
  • 477
0 votes
1 answer
114 views

How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]

I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases. So the WAF thinks some ...
user avatar
3 votes
1 answer
175 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
user avatar
  • 153
1 vote
0 answers
601 views

Do we need SSL Certificate on both Firewall and WAF for inbound traffic?

We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
user avatar
  • 11
0 votes
1 answer
174 views

Cloudflare Full Strict HTTPS flow

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
user avatar
  • 113
1 vote
1 answer
531 views

OWASP CRS Anomaly scoring,, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines : setvar:'tx....
user avatar
  • 11
1 vote
0 answers
81 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
user avatar
0 votes
0 answers
120 views

WAF really Needed?

I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
user avatar
0 votes
1 answer
157 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
user avatar
3 votes
1 answer
193 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
user avatar
  • 43
0 votes
1 answer
112 views

Security for External Communication to an EC2 on AWS

I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me). Currently the program performs no authentication, We install the ...
user avatar
  • 115
0 votes
1 answer
78 views

Back-end changing the url

We have a WAF in front of our environnement. Let's say now the client ask for example.com The waf make a redirect (303) saying https://example.com Now the communication is established between the ...
user avatar
  • 125
12 votes
2 answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
user avatar
  • 151
0 votes
0 answers
1k views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
user avatar
  • 121
3 votes
1 answer
505 views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
user avatar
  • 335
0 votes
1 answer
276 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
user avatar
  • 1
0 votes
0 answers
319 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
user avatar
1 vote
0 answers
258 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
user avatar
  • 11
2 votes
1 answer
3k views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
user avatar
2 votes
2 answers
760 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
user avatar
1 vote
0 answers
89 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
user avatar
-2 votes
1 answer
101 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
user avatar
-1 votes
3 answers
494 views

Is a web application firewall enough to defend against sql injection? or should I use prepared statements?

Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques? During a conversation with a friend he said it is enough to use web ...
user avatar
0 votes
1 answer
129 views

What are the suggested way to protect content in mobile app

I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header ...
user avatar
  • 101
3 votes
2 answers
670 views

SAST vs WAF: What should I choose?

Given the fact that I have a WAF already deployed, what is the benefit I could get by purchasing a SAST tool that would scan the engineers' code for security flaws? Does this also apply for SCA tools ...
user avatar
  • 329
0 votes
0 answers
586 views

Requests logged in Cloudflare as "XSS, HTML Injection - Body"

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
user avatar
  • 111
1 vote
0 answers
148 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
user avatar
1 vote
1 answer
554 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
user avatar
  • 11
0 votes
0 answers
1k views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
user avatar