Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

How to develop a WAF ( Web application firewall ) from scratch ? and what are the tech stacks required? [closed]

I have to build a web application firewall from scratch but most of resources available are either WAF marketing or too complex to understand . My goal is to understand deeply on web application ...
whatisLimlee's user avatar
1 vote
0 answers
31 views

3rd-Party CDN SSL Inspection for Financial/Banking API Traffics

We have 3rd-Party CDN in front of Financial/Banking APIs which involves sensitive data, login, access token, cookies, etc. We would like to leverage WAF and SSL Inspection capability of CDN. This ...
bboy's user avatar
  • 13
0 votes
0 answers
40 views

WAF vs. Application Layer for Bot Mitigation

In a layered enterprise security architecture with a Web Application Firewall (WAF) deployed in the DMZ, should there be shared responsibility between the WAF and application layer/ microservices for ...
Fahim Farook's user avatar
0 votes
0 answers
45 views

How to add accounts management to a legacy blackbox application?

I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify ...
lalebarde's user avatar
  • 617
0 votes
1 answer
82 views

Can API Security/WAF tools decrypt "mirrored" traffic?

We're doing a PoC on a new API Security/WAF tool, and we're planning to place this solution out-of-ban rather than inline. So traffic wont go through the solution and we'll send the mirrored traffic ...
Sjomann's user avatar
0 votes
0 answers
74 views

Problem bypassing a PHP WAF for SQLi

I am working to bypass this WAF, but I have some problems. $args_arr=array( 'sql'=>"[^\\{\\s]{1}(\\s|\\b)+(?:select\\b|update\\b|insert(?:(\\/\\*.*?\\*\\/)|(\\s)|(\\+))+into\\b).+?...
Dinnerboard's user avatar
2 votes
1 answer
237 views

Modsecurity blocks blocks my legit XHR POST request (403 forbidden)

I'm new to modsecurity topic so maybe my question is stupid but... I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
Picard's user avatar
  • 121
3 votes
1 answer
348 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
James Nugent's user avatar
31 votes
8 answers
10k views

What's wrong with the use of a WAF (Web Application Firewall)?

My SaaS company recently lost the bid for an enterprise software licensing deal. One of the reasons the prospect gave for not choosing us as a vendor was: the use of a WAF I'm not an information ...
Anon's user avatar
  • 311
1 vote
1 answer
481 views

ModSecurity CRS, allow header `accept-charset`

I have ModSecurity v2 on apache with CRS v3. Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
nulll's user avatar
  • 113
1 vote
1 answer
90 views

Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?

Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
tanyehzheng's user avatar
0 votes
1 answer
66 views

Can Caching cause my WAF logged events to drop?

I've been using Ninjafirewall on WordPress websites for a while. I recently installed a new caching plugin on my main website and I noticed the firewall log which usually has around 5000 blocked ...
KnightHawk's user avatar
0 votes
2 answers
536 views

What is Method Enforcement. How to simulate this attack?

I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules. How to test this attack on magento website? What is security best practice to prevent this?
Mamta Singh's user avatar
21 votes
2 answers
5k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
BadHorsie's user avatar
  • 385
0 votes
2 answers
186 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
qre0ct's user avatar
  • 1,522
0 votes
2 answers
620 views

Check for special characters in request parameters

Our system is accepting requests including special characters, see parameter2. Request [ { "reqHeader": { "parameter1": "abc", "...
abc123's user avatar
  • 111
1 vote
0 answers
137 views

WAF checking username/password before passing to app [closed]

I want to protect a web app behind some other application. This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it ...
Alex's user avatar
  • 119
2 votes
2 answers
2k views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
FilBot3's user avatar
  • 123
1 vote
0 answers
186 views

Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag. The question here is ...
offsecgirl's user avatar
-1 votes
1 answer
1k views

Do WAFs block base64 encoded inputs?

Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually ...
hyogy's user avatar
  • 13
1 vote
0 answers
2k views

Bypass sql injection filtering (whitespace, /, *) [closed]

I want to bypass a sql injection waf that replaces /,* and whitespaces. This is a payload I want use : ?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table-- But the ...
Mahdi's user avatar
  • 11
3 votes
1 answer
923 views

Bypassing "OR" SQLi filter

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target. To get the OR keyword, I use ||. ...
Jeff Bencteux's user avatar
1 vote
1 answer
159 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
边明凯's user avatar
1 vote
0 answers
623 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
CuriousGuy's user avatar
1 vote
2 answers
2k views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
Qassam Mahmoud's user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
sxmad's user avatar
  • 115
0 votes
1 answer
380 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
Ronaldo's user avatar
  • 51
1 vote
3 answers
603 views

Port scanning against assets that are behind a WAF

I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
Sinatra's user avatar
  • 11
1 vote
0 answers
199 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
ankk98's user avatar
  • 111
0 votes
0 answers
810 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
FGH's user avatar
  • 101
1 vote
1 answer
3k views

Can a firewall appliance block http requests? [closed]

Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this: Internet > router > Firewall > webserver Can the firewall act as a WAF and block ...
Miky1992's user avatar
0 votes
1 answer
827 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
user2942358's user avatar
1 vote
1 answer
2k views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
banker's user avatar
  • 113
1 vote
1 answer
329 views

Modsecurity CRS how to deal with field arrays

I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following: ... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]" ... ...
Eddie4's user avatar
  • 11
2 votes
1 answer
671 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
Ali Ahmad's user avatar
  • 4,844
1 vote
1 answer
14k views

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt; [duplicate]

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
rei's user avatar
  • 13
2 votes
0 answers
400 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
Roberto Jobet's user avatar
2 votes
3 answers
279 views

Stop User Enumeration requests on AJAX endpoints

I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
Abhinav's user avatar
  • 179
1 vote
1 answer
2k views

XSS in a variable assignment when <>" are escaped

SCENARIO: user input is reflected inside a variable. For example url.com/?a=hello is reflected as shown below var test="hello"; I tried to evade from the variable with payload like hello&...
Maicake's user avatar
  • 567
0 votes
1 answer
234 views

How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]

I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases. So the WAF thinks some ...
Muhammad Gelbana's user avatar
3 votes
1 answer
395 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
Simon's user avatar
  • 153
1 vote
0 answers
2k views

Do we need SSL Certificate on both Firewall and WAF for inbound traffic?

We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
msalhi's user avatar
  • 11
0 votes
1 answer
350 views

Cloudflare Full Strict HTTPS flow

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
aze2201's user avatar
  • 113
1 vote
1 answer
1k views

OWASP CRS Anomaly scoring, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines: setvar:'tx....
Murad's user avatar
  • 11
1 vote
0 answers
113 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
Jason Rich Darmawan's user avatar
0 votes
0 answers
170 views

WAF really Needed?

I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
FaridHazan's user avatar
0 votes
1 answer
303 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
Emmanuel-Ab's user avatar
3 votes
1 answer
328 views

Sqlmap Manual Vulnerability Assessment

I am trying penetration testing for one of my clients. The platform is Code ignitor. There is an endpoint /find/1. The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
Badddy's user avatar
  • 53
0 votes
1 answer
181 views

Security for External Communication to an EC2 on AWS

I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me). Currently the program performs no authentication, We install the ...
Rilcon42's user avatar
  • 115
0 votes
1 answer
117 views

Back-end changing the url

We have a WAF in front of our environnement. Let's say now the client ask for example.com The waf make a redirect (303) saying https://example.com Now the communication is established between the ...
Warok's user avatar
  • 125