Questions tagged [waf]
WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
10
questions
2
votes
2
answers
41k
views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
- 61
3
votes
1
answer
2k
views
How to filter https traffic in mod-security WAF?
I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
- 49
10
votes
3
answers
2k
views
Evasion techiques for WAFs
Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
- 4,834
7
votes
2
answers
10k
views
Is SSL required for sites hosted behind WAF?
We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
- 73
24
votes
1
answer
7k
views
What is a Web Application Firewall?
What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
- 1,277
12
votes
2
answers
3k
views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
- 151
11
votes
4
answers
3k
views
Why should I use whitelist on a WAF?
I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
- 111
4
votes
3
answers
2k
views
Security implications of WAF revealing internal IP addresses
What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world?
A specific example is with F5 products: They use a ...
- 1,297
3
votes
3
answers
619
views
How useful is the default configuration of ModSecurity for a generic web application?
Scenario:
ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown)...
- 15.7k
1
vote
3
answers
12k
views
ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET
I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week.
It’s filled with error messages related to Mod Security.
...
