Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

4
votes
3answers
134 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
2answers
420 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
1
vote
1answer
123 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
1
vote
0answers
58 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
0answers
72 views

Do I need a WAF in front of an API exposed by Google Cloud Endpoint

I have a backend API exposed to the internet by GCP's Google Cloud Endpoint (Extensible Service Proxy). Cloud Endpoint allows us to control which other backend services can access the API and block ...
1
vote
0answers
43 views

Where should the SCEP requests be decrypted?

Let's say you provide a SCEP service available to the outside world, where should the SCEP requests be decrypted? At the load balancer, in the backend server, elsewhere? It doesn't look like there is ...
1
vote
0answers
57 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
0
votes
0answers
82 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
35 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
28 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
-2
votes
0answers
40 views

How are Web application firewalls typically implemented?

How are WAFs typically implemented? I'm currently doing some research on this topic and found some sources that claim their ".htaccess" rules are used as a WAF. Q1: I was wondering if this method ...