Questions tagged [waf]
WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
138
questions
27
votes
7
answers
8k
views
What's wrong with the use of a WAF (Web Application Firewall)?
My SaaS company recently lost the bid for an enterprise software licensing deal.
One of the reasons the prospect gave for not choosing us as a vendor was:
the use of a WAF
I'm not an information ...
- 271
0
votes
1
answer
106
views
ModSecurity CRS, allow header `accept-charset`
I have ModSecurity v2 on apache with CRS v3.
Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
- 103
0
votes
1
answer
38
views
Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?
Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
- 101
0
votes
1
answer
25
views
Can Caching cause my WAF logged events to drop?
I've been using Ninjafirewall on WordPress websites for a while.
I recently installed a new caching plugin on my main website and I noticed the firewall log which usually has around 5000 blocked ...
- 719
0
votes
2
answers
321
views
What is Method Enforcement. How to simulate this attack?
I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules.
How to test this attack on magento website? What is security best practice to prevent this?
21
votes
2
answers
4k
views
Which IP address would be most safe and suitable to use as a placeholder in a live system?
Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?
e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
- 385
0
votes
0
answers
156
views
CVE-2021-22123 fortiweb bypass?
As a cybersecurity enthusiast, I tried to do the following exercise :
A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
0
votes
2
answers
90
views
Can a WAF transform HTTP response
I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
- 1,522
0
votes
2
answers
400
views
Check for special characters in request parameters
Our system is accepting requests including special characters, see parameter2.
Request [
{
"reqHeader": {
"parameter1": "abc",
"...
- 111
1
vote
0
answers
79
views
WAF checking username/password before passing to app [closed]
I want to protect a web app behind some other application.
This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it ...
- 119
1
vote
2
answers
1k
views
String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403
Details
I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
- 113
1
vote
0
answers
102
views
Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?
I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity.
Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.
The question here is ...
- 11
-1
votes
1
answer
745
views
Do WAFs block base64 encoded inputs?
Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually ...
- 13
1
vote
0
answers
1k
views
Bypass sql injection filtering (whitespace, /, *) [closed]
I want to bypass a sql injection waf that replaces /,* and whitespaces.
This is a payload I want use :
?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table--
But the ...
- 11
3
votes
1
answer
707
views
Bypassing "OR" SQLi filter
I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.
To get the OR keyword, I use ||.
...
- 178
1
vote
1
answer
114
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
1
vote
0
answers
498
views
Azure WAF support for OData
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. ...
- 111
1
vote
2
answers
1k
views
Bypass WAF to perform XSS?
I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed.
Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
- 111
11
votes
1
answer
2k
views
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
- 115
0
votes
1
answer
299
views
Why is my SecAction rule being ignored?
I'm trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
- 51
1
vote
3
answers
457
views
Port scanning against assets that are behind a WAF
I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web ...
- 11
1
vote
0
answers
159
views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
- 111
0
votes
0
answers
593
views
What will happen if https traffic goes through the WAF? [duplicate]
A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
- 101
1
vote
1
answer
3k
views
Can a firewall appliance block http requests? [closed]
Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this:
Internet > router > Firewall > webserver
Can the firewall act as a WAF and block ...
- 21
0
votes
1
answer
585
views
Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]
I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
1
answer
1k
views
Layer7 DDoS Protection vs WAF, which should I use?
I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;
...
- 113
1
vote
1
answer
282
views
Modsecurity CRS how to deal with field arrays
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
... ...
- 11
2
votes
1
answer
457
views
Custom response for Web Application Firewall (WAF)
What should be the custom response code when WAF blocks a request due to matched rules or policy violation.
We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
- 4,834
1
vote
1
answer
10k
views
Xss filter bypass ><script>alert(1);</script> [duplicate]
As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
- 13
2
votes
0
answers
291
views
Mod-security and WordPress WAF
On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence.
I was wondering if a better practice would be to replace them with a host-based ...
2
votes
3
answers
240
views
Stop User Enumeration requests on AJAX endpoints
I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
- 159
1
vote
1
answer
1k
views
XSS in a variable assignment when <>" are escaped
SCENARIO:
user input is reflected inside a variable.
For example
url.com/?a=hello
is reflected as shown below
var test="hello";
I tried to evade from the variable with payload like hello&...
- 567
0
votes
1
answer
189
views
How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]
I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases.
So the WAF thinks some ...
- 191
3
votes
1
answer
336
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
1
vote
0
answers
1k
views
Do we need SSL Certificate on both Firewall and WAF for inbound traffic?
We have a website hosted behind WAF(FortiWeb) and Firewall (FortiGate). The WAF already has the server valid SSL Certificate from public CA. Do we need to install SSL certificate on Firewall also for ...
- 11
0
votes
1
answer
303
views
Cloudflare Full Strict HTTPS flow
I would like to understand Cloudflare full(strict) SSL flow.
Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
- 113
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
- 11
1
vote
0
answers
92
views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
0
votes
0
answers
143
views
WAF really Needed?
I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local ...
0
votes
1
answer
204
views
How does Cloudflare firewall work?
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So ...
- 101
3
votes
1
answer
274
views
Sqlmap Manual Vulnerability Assessment
I am trying penetration testing for one of my clients.
The platform is Code ignitor.
There is an endpoint /find/1.
The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
- 43
0
votes
1
answer
150
views
Security for External Communication to an EC2 on AWS
I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me).
Currently the program performs no authentication, We install the ...
- 115
0
votes
1
answer
88
views
Back-end changing the url
We have a WAF in front of our environnement.
Let's say now
the client ask for example.com
The waf make a redirect (303) saying https://example.com
Now the communication is established between the ...
- 125
12
votes
2
answers
3k
views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
- 151
0
votes
0
answers
2k
views
Is this SQLMap query is correct?
I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
- 121
4
votes
1
answer
1k
views
Avoiding WAF with DirBuster
I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
- 345
1
vote
1
answer
478
views
Single and double Encoding of parameters to bypass security filters
I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.
How ...
- 11
0
votes
0
answers
545
views
Method to bypass \n in WAF (\n vulnerability)
I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this
{“message”: “hello\nmy name is andi”}
But the problem is the ...
1
vote
0
answers
284
views
FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]
I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
- 11
2
votes
1
answer
5k
views
Server returns 403 when I try SQL injection
I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.
Whenever I try very simple attacks ...
- 271