Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
31 votes
8 answers
10k views

What's wrong with the use of a WAF (Web Application Firewall)?

My SaaS company recently lost the bid for an enterprise software licensing deal. One of the reasons the prospect gave for not choosing us as a vendor was: the use of a WAF I'm not an information ...
Anon's user avatar
  • 311
28 votes
2 answers
5k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
40F4's user avatar
  • 922
27 votes
9 answers
10k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
user avatar
24 votes
1 answer
7k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
Sim's user avatar
  • 1,277
21 votes
2 answers
5k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
BadHorsie's user avatar
  • 385
16 votes
5 answers
3k views

Application security training for developers [closed]

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
Dimitrios Stergiou's user avatar
16 votes
1 answer
2k views

What is a "Trailing Host Header", and how can I test for it?

My team's been doing some research into WAF protections based upon a WAF testing tool released at Black Hat this year. In the tool, there's a list of hostname evasion tests - that are really just an ...
bethlakshmi's user avatar
  • 11.7k
15 votes
3 answers
5k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
Tim Troy's user avatar
  • 351
13 votes
1 answer
561 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
Lex's user avatar
  • 4,277
12 votes
2 answers
3k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
Mathev's user avatar
  • 151
12 votes
2 answers
5k views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
that guy from over there's user avatar
11 votes
4 answers
3k views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
Quentin Mollard's user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
sxmad's user avatar
  • 115
10 votes
3 answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
Ali Ahmad's user avatar
  • 4,844
10 votes
1 answer
614 views

Is there a web application firewall equivalent of virustotal?

I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
Chris Dale's user avatar
  • 16.2k
7 votes
2 answers
10k views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
Arun's user avatar
  • 73
7 votes
1 answer
932 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
user avatar
7 votes
5 answers
2k views

Master thesis topic - mod_security

I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
cradox23's user avatar
  • 173
7 votes
2 answers
6k views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
Anonymous Platypus's user avatar
5 votes
3 answers
623 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
Thomas Hunziker's user avatar
5 votes
3 answers
7k views

Reverse Proxy + WAF

AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF. The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
user3853149's user avatar
5 votes
1 answer
1k views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
ma77c's user avatar
  • 355
4 votes
2 answers
2k views

Why can't persistence XSS be detected by a Web Application Firewall?

This OWASP article mentioned that "Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
one's user avatar
  • 1,831
4 votes
4 answers
2k views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
ddyer's user avatar
  • 2,006
4 votes
3 answers
2k views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
just some user's user avatar
4 votes
1 answer
3k views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
Jakob's user avatar
  • 223
3 votes
2 answers
847 views

SAST vs WAF: What should I choose?

Given the fact that I have a WAF already deployed, what is the benefit I could get by purchasing a SAST tool that would scan the engineers' code for security flaws? Does this also apply for SCA tools ...
elli's user avatar
  • 339
3 votes
2 answers
2k views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
Vijayendra's user avatar
3 votes
3 answers
8k views

What are the main reason to deploy Secure Web Gateway?

As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
mau5's user avatar
  • 134
3 votes
1 answer
2k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
Daniel Exar's user avatar
3 votes
1 answer
4k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
Neo's user avatar
  • 141
3 votes
1 answer
454 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
James Nugent's user avatar
3 votes
1 answer
968 views

Bypassing "OR" SQLi filter

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target. To get the OR keyword, I use ||. ...
Jeff Bencteux's user avatar
3 votes
1 answer
416 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
Simon's user avatar
  • 153
3 votes
1 answer
342 views

Sqlmap Manual Vulnerability Assessment

I am trying penetration testing for one of my clients. The platform is Code ignitor. There is an endpoint /find/1. The function queries from the vehicle table where vehicle ID is 1 with no sanity ...
Badddy's user avatar
  • 53
3 votes
1 answer
630 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
niklr's user avatar
  • 591
3 votes
3 answers
692 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
reed's user avatar
  • 15.8k
2 votes
2 answers
376 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
baj's user avatar
  • 513
2 votes
1 answer
274 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
daisy's user avatar
  • 2,077
2 votes
2 answers
538 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
Ali Ahmad's user avatar
  • 4,844
2 votes
1 answer
11k views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
Aayush's user avatar
  • 577
2 votes
1 answer
7k views

Does a Web Application Firewall only protect OSI layer 7?

Does a Web Application Firewall (WAF) that is protecting application layer 7, as well protect other layers of the The Open Systems Interconnection (OSI) model?
Bob Ortiz's user avatar
  • 6,715
2 votes
1 answer
2k views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
Ali Ahmad's user avatar
  • 4,844
2 votes
1 answer
6k views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
Fanar AL HAYALI's user avatar
2 votes
4 answers
250 views

Web Application Firewall with based on an external decision to detect anomaly

I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external ...
Alexandre Barreiro Neto's user avatar
2 votes
2 answers
47k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
Rifat Shommo's user avatar
2 votes
2 answers
2k views

Protection against command injection with modsecurity

I want to know if modsecurity can protect against command injection and file inclusion. I tested modsecurity with free version and run dvwa which is vulnerable page . But command injection is possible ...
joker's user avatar
  • 21
2 votes
2 answers
2k views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
FilBot3's user avatar
  • 123
2 votes
3 answers
287 views

Stop User Enumeration requests on AJAX endpoints

I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
Abhinav's user avatar
  • 179
2 votes
1 answer
6k views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
Mohammad Ali's user avatar