Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

-2
votes
0answers
40 views

How are Web application firewalls typically implemented?

How are WAFs typically implemented? I'm currently doing some research on this topic and found some sources that claim their ".htaccess" rules are used as a WAF. Q1: I was wondering if this method ...
0
votes
2answers
4k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
1
vote
1answer
122 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
4
votes
3answers
131 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
1
vote
0answers
58 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
0
votes
2answers
418 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
0answers
82 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
1answer
590 views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
35 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
28 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
2
votes
1answer
142 views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
1answer
24 views

Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP)

I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website. Now, using a WAF and setting x-forwarded-for I can get the IP of the ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
2
votes
3answers
60 views

Web Application Firewall with based on an external decision to detect anomaly

I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
5
votes
3answers
2k views

Reverse Proxy + WAF

AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF. The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
22
votes
1answer
6k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
0
votes
1answer
242 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
1
vote
1answer
463 views

Access denied after inserting reflected XSS payload in JavaScript

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src ...
0
votes
2answers
242 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
1answer
57 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
-1
votes
1answer
202 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
931 views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
-3
votes
1answer
103 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
1
vote
1answer
720 views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
2answers
2k views

Wordpress - blocked by firewall for Malicious File Upload

Our work website is getting flooded with these types of hacks: The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running ...
3
votes
1answer
195 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to whitelist all the APIs and static resources of an application. Although from the security ...
14
votes
3answers
4k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
1
vote
0answers
439 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
1
vote
0answers
72 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
-1
votes
2answers
114 views

WAF/IDS detection question

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT. The HTML always looks like this: <title>403 Forbidden</title> </head><...
0
votes
1answer
36 views

Internet traffic redirect from WAF to Cloud Network - Encrypted vs unencrypted

What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?
2
votes
1answer
177 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
0
votes
1answer
577 views

Trying to do a chunked multipart post request, nginx and php both returns 400 error

I'm trying to use chunked protocol and multipart protocol in a POST request, like this All new-line symbols are \r\n, e.g POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1 accept-language: * ...
2
votes
2answers
643 views

Protection against command injection with modsecurity

I want to know if modsecurity can protect against command injection and file inclusion. I tested modsecurity with free version and run dvwa which is vulnerable page . But command injection is possible ...
0
votes
1answer
232 views

WAFDetect Extension of Burpsuite

I am creating a list of tools for waf fingerprinting. I have installed waf-detect plugin from bapp store in burpsuite. This plugin runs in the background and create passive scanner issues when WAF ...
1
vote
1answer
471 views

Web application firewall using machine learning and how to implement it [closed]

I want to create a web application firewall from scratch. I am going to use machine learning to train it to classify malicious and clean queries. My dilemma is that I am a beginner and am unable to ...
29
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
2
votes
1answer
3k views

Does a Web Application Firewall only protect OSI layer 7?

Does a Web Application Firewall (WAF) that is protecting application layer 7, as well protect other layers of the The Open Systems Interconnection (OSI) model?
1
vote
1answer
370 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
0
votes
1answer
59 views

Is defending a server from BFA with 2 WAFs possible and common?

I am not of the IS field and hence reference this to the experts here - My question regards to defending a server from a Brute Force Attack (BFA) with 2 Web Application Firewalls (WAFs). The question ...
1
vote
2answers
222 views

WAF - How to tell what automated tool is causing alerts

When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site? What techniques can I use to narrow ...
1
vote
1answer
488 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
0
votes
2answers
11k views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
13
votes
1answer
469 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
2
votes
2answers
984 views

What is the best material for building an web application firewall? [closed]

I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application ...
4
votes
3answers
652 views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
1
vote
1answer
897 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
4
votes
2answers
1k views

Why can't persistence XSS be detected by a Web Application Firewall?

This OWASP article mentioned that "Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
1
vote
1answer
2k views

WAF SQL evasion using HPF technique

I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discusses two techniques HPP (HTTP parameter ...
10
votes
3answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?