Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

2
votes
3answers
47 views

Web Application Firewall with based on an external decision to detect anomaly

I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
3
votes
3answers
68 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
94 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
2answers
935 views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
-1
votes
1answer
132 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
417 views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
-3
votes
1answer
86 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
0
votes
1answer
55 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
0
votes
1answer
242 views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
2answers
269 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
154 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
1answer
1k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
316 views

Access denied after inserting reflected XSS payload in JavaScript

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src ...
1
vote
0answers
336 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
1
vote
0answers
59 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
-1
votes
2answers
76 views

WAF/IDS detection question

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT. The HTML always looks like this: <title>403 Forbidden</title> </head><...
0
votes
1answer
35 views

Internet traffic redirect from WAF to Cloud Network - Encrypted vs unencrypted

What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?
0
votes
1answer
439 views

Trying to do a chunked multipart post request, nginx and php both returns 400 error

I'm trying to use chunked protocol and multipart protocol in a POST request, like this All new-line symbols are \r\n, e.g POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1 accept-language: * ...
2
votes
1answer
168 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
0
votes
1answer
192 views

WAFDetect Extension of Burpsuite

I am creating a list of tools for waf fingerprinting. I have installed waf-detect plugin from bapp store in burpsuite. This plugin runs in the background and create passive scanner issues when WAF ...
1
vote
1answer
410 views

Web application firewall using machine learning and how to implement it [closed]

I want to create a web application firewall from scratch. I am going to use machine learning to train it to classify malicious and clean queries. My dilemma is that I am a beginner and am unable to ...
2
votes
2answers
488 views

Protection against command injection with modsecurity

I want to know if modsecurity can protect against command injection and file inclusion. I tested modsecurity with free version and run dvwa which is vulnerable page . But command injection is possible ...
29
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
0
votes
2answers
1k views

Wordpress - blocked by firewall for Malicious File Upload

Our work website is getting flooded with these types of hacks: The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running ...
0
votes
1answer
51 views

Is defending a server from BFA with 2 WAFs possible and common?

I am not of the IS field and hence reference this to the experts here - My question regards to defending a server from a Brute Force Attack (BFA) with 2 Web Application Firewalls (WAFs). The question ...
1
vote
1answer
308 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
1
vote
2answers
196 views

WAF - How to tell what automated tool is causing alerts

When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site? What techniques can I use to narrow ...
2
votes
2answers
771 views

What is the best material for building an web application firewall? [closed]

I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application ...
1
vote
1answer
748 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
4
votes
2answers
1k views

Why can't persistence XSS be detected by a Web Application Firewall?

This OWASP article mentioned that "Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
1
vote
0answers
40 views

Where should the SCEP requests be decrypted?

Let's say you provide a SCEP service available to the outside world, where should the SCEP requests be decrypted? At the load balancer, in the backend server, elsewhere? It doesn't look like there is ...
2
votes
1answer
3k views

Does a Web Application Firewall only protect OSI layer 7?

Does a Web Application Firewall (WAF) that is protecting application layer 7, as well protect other layers of the The Open Systems Interconnection (OSI) model?
4
votes
3answers
556 views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
3
votes
1answer
181 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to whitelist all the APIs and static resources of an application. Although from the security ...
5
votes
3answers
1k views

Reverse Proxy + WAF

AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF. The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
1
vote
1answer
95 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
1
vote
1answer
451 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
1
vote
1answer
169 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
5
votes
3answers
399 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
11
votes
4answers
2k views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
2
votes
3answers
6k views

What are the main reason to deploy Secure Web Gateway?

As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
1
vote
0answers
57 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
0
votes
2answers
10k views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
6
votes
2answers
5k views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
24
votes
9answers
6k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
7
votes
1answer
573 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
3
votes
2answers
4k views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
2
votes
1answer
2k views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
13
votes
1answer
453 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
12
votes
2answers
3k views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...