Questions tagged [waf]
WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.
138
questions
28
votes
8
answers
9k
views
What's wrong with the use of a WAF (Web Application Firewall)?
My SaaS company recently lost the bid for an enterprise software licensing deal.
One of the reasons the prospect gave for not choosing us as a vendor was:
the use of a WAF
I'm not an information ...
- 281
28
votes
2
answers
5k
views
What are possible security problems of enabling HTTP2?
I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like:
HTTP2 implementations are maybe more error prone than mature ...
- 932
27
votes
9
answers
9k
views
Is a web application firewall necessary if the application is secure?
Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF.
However, a good application should already be ...
user42178
24
votes
1
answer
7k
views
What is a Web Application Firewall?
What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
- 1,277
21
votes
2
answers
4k
views
Which IP address would be most safe and suitable to use as a placeholder in a live system?
Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?
e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
- 385
16
votes
5
answers
3k
views
Application security training for developers [closed]
I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
16
votes
1
answer
2k
views
What is a "Trailing Host Header", and how can I test for it?
My team's been doing some research into WAF protections based upon a WAF testing tool released at Black Hat this year. In the tool, there's a list of hostname evasion tests - that are really just an ...
- 11.7k
15
votes
3
answers
5k
views
How do I get started using ESAPI WAF?
I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
- 351
13
votes
1
answer
543
views
WAF Process Creation for Integration of IT and Business
A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
- 4,257
12
votes
2
answers
3k
views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
- 151
12
votes
2
answers
5k
views
When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?
I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
- 3,474
11
votes
4
answers
3k
views
Why should I use whitelist on a WAF?
I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
- 111
11
votes
1
answer
2k
views
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
- 115
10
votes
3
answers
2k
views
Evasion techiques for WAFs
Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
- 4,834
10
votes
1
answer
597
views
Is there a web application firewall equivalent of virustotal?
I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
- 16.2k
7
votes
2
answers
10k
views
Is SSL required for sites hosted behind WAF?
We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
- 73
7
votes
1
answer
894
views
Isn't a HIDS, NIDS and WAF complementary?
Assume this scenario:
Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>
A HIDS would see this attempt in Apache's access log, a NIDS would ...
user15194
7
votes
5
answers
2k
views
Master thesis topic - mod_security
I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
- 173
7
votes
2
answers
6k
views
How web application firewalls protect application from DDoS attacks?
How to protect a web application from DDoS by the implementation of Web Application firewalls?
How effective is this method?
- 1,452
5
votes
3
answers
578
views
Cloud Based WAF
I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS.
I would prefer using a cloud based WAF (e.g. ...
- 189
5
votes
3
answers
6k
views
Reverse Proxy + WAF
AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF.
The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
- 71
4
votes
2
answers
2k
views
Why can't persistence XSS be detected by a Web Application Firewall?
This OWASP
article mentioned that
"Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
- 1,801
4
votes
4
answers
2k
views
Generic defense againt SQL injection
This is a little bit of a rant, but there's a real question at the end.
I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
- 2,006
4
votes
3
answers
2k
views
Security implications of WAF revealing internal IP addresses
What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world?
A specific example is with F5 products: They use a ...
- 1,297
4
votes
1
answer
3k
views
Securing a simple webservice against brute-force with mod-security
I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
- 203
4
votes
1
answer
1k
views
Avoiding WAF with DirBuster
I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
- 345
3
votes
2
answers
800
views
SAST vs WAF: What should I choose?
Given the fact that I have a WAF already deployed, what is the benefit I could get by purchasing a SAST tool that would scan the engineers' code for security flaws?
Does this also apply for SCA tools ...
- 329
3
votes
3
answers
8k
views
What are the main reason to deploy Secure Web Gateway?
As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
- 134
3
votes
1
answer
2k
views
How to filter https traffic in mod-security WAF?
I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
- 49
3
votes
1
answer
4k
views
Mod_security for Apache2 blocks cURL!
I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
- 141
3
votes
1
answer
717
views
Bypassing "OR" SQLi filter
I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.
To get the OR keyword, I use ||.
...
- 178
3
votes
1
answer
336
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
3
votes
1
answer
275
views
Sqlmap Manual Vulnerability Assessment
I am trying penetration testing for one of my clients.
The platform is Code ignitor.
There is an endpoint /find/1.
The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
- 43
3
votes
1
answer
610
views
IDS/WAF scenario for 2 web servers
I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
- 591
3
votes
3
answers
621
views
How useful is the default configuration of ModSecurity for a generic web application?
Scenario:
ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown)...
- 15.7k
2
votes
2
answers
363
views
ip-fragmentation and mod_security?
is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?
the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
- 513
2
votes
1
answer
253
views
What does `&==;` mean with regard to Python Django and bypassing WAFs?
I'm reading someone's slides on bypassing WAFs.
&==; : Python Django between parameters;
FooBar==POST verb : Apache with PHP;
<%I%M%U011e>==<IMG> : IIS ASP Classic;
;/path1 ...
- 2,057
2
votes
2
answers
518
views
Web Application Firewall Rules
For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
- 4,834
2
votes
2
answers
1k
views
How to protect Authentication API from a DDoS attacks?
After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
- 121
2
votes
1
answer
10k
views
How limit request rate of sqlmap?
How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
- 577
2
votes
1
answer
6k
views
Does a Web Application Firewall only protect OSI layer 7?
Does a Web Application Firewall (WAF) that is protecting application layer 7, as well protect other layers of the The Open Systems Interconnection (OSI) model?
- 6,661
2
votes
1
answer
2k
views
WAF testing frameworks
How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
- 4,834
2
votes
1
answer
5k
views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
- 213
2
votes
4
answers
212
views
Web Application Firewall with based on an external decision to detect anomaly
I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
2
votes
2
answers
42k
views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
- 61
2
votes
2
answers
2k
views
Protection against command injection with modsecurity
I want to know if modsecurity can protect against command injection and file inclusion.
I tested modsecurity with free version and run dvwa which is vulnerable page .
But command injection is possible ...
- 21
2
votes
3
answers
241
views
Stop User Enumeration requests on AJAX endpoints
I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
- 159
2
votes
1
answer
5k
views
Server returns 403 when I try SQL injection
I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.
Whenever I try very simple attacks ...
- 271
2
votes
2
answers
2k
views
What is the best material for building an web application firewall? [closed]
I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application ...
- 303
2
votes
2
answers
1k
views
Anomaly based web application Firewall
How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
- 4,834