Questions tagged [waf]

WAF stands for Web Application Layer Firewall. WAF is an application layer firewall that is meant to secure the back end web server by monitoring every HTTP request and response to and from the server.

Filter by
Sorted by
Tagged with
1 vote
1 answer
207 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
JinPangPang's user avatar
  • 1,951
1 vote
1 answer
815 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
Sarge's user avatar
  • 143
1 vote
1 answer
218 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
SSK's user avatar
  • 125
5 votes
3 answers
578 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
Thomas Hunziker's user avatar
11 votes
4 answers
3k views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
Quentin Mollard's user avatar
3 votes
3 answers
8k views

What are the main reason to deploy Secure Web Gateway?

As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
mau5's user avatar
  • 134
1 vote
0 answers
103 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
Anonymous Platypus's user avatar
0 votes
2 answers
13k views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
Anonymous Platypus's user avatar
7 votes
2 answers
6k views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
Anonymous Platypus's user avatar
27 votes
9 answers
9k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
user avatar
7 votes
1 answer
894 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
user avatar
7 votes
2 answers
10k views

Is SSL required for sites hosted behind WAF?

We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?
Arun's user avatar
  • 73
2 votes
1 answer
2k views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
Ali Ahmad's user avatar
  • 4,834
13 votes
1 answer
543 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
Lex's user avatar
  • 4,257
12 votes
2 answers
5k views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
that guy from over there's user avatar
1 vote
3 answers
12k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
Fredrik Johansson's user avatar
4 votes
4 answers
2k views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
ddyer's user avatar
  • 2,006
1 vote
1 answer
2k views

WAF SQL evasion using HPF technique

I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discusses two techniques HPP (HTTP parameter ...
Ali Ahmad's user avatar
  • 4,834
-1 votes
1 answer
437 views

Writing application specfic rules for WAF?

I was reading an article on "Protocol-Level Evasion of Web Application Firewalls" and the article insist on writing application specific rules in this manner: <Location /index.php> ...
Ali Ahmad's user avatar
  • 4,834
0 votes
1 answer
2k views

Using ModSecurity as transparent mode

I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not aware ...
Daniel Exar's user avatar
4 votes
1 answer
3k views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
Jakob's user avatar
  • 203
3 votes
1 answer
2k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
Daniel Exar's user avatar
1 vote
3 answers
2k views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
Ali Ahmad's user avatar
  • 4,834
16 votes
5 answers
3k views

Application security training for developers [closed]

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
Dimitrios Stergiou's user avatar
-4 votes
1 answer
272 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
Ali Ahmad's user avatar
  • 4,834
2 votes
2 answers
1k views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
Ali Ahmad's user avatar
  • 4,834
3 votes
1 answer
610 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
niklr's user avatar
  • 591
16 votes
1 answer
2k views

What is a "Trailing Host Header", and how can I test for it?

My team's been doing some research into WAF protections based upon a WAF testing tool released at Black Hat this year. In the tool, there's a list of hostname evasion tests - that are really just an ...
bethlakshmi's user avatar
  • 11.7k
10 votes
3 answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
Ali Ahmad's user avatar
  • 4,834
2 votes
2 answers
518 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
Ali Ahmad's user avatar
  • 4,834
1 vote
1 answer
528 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
Ali Ahmad's user avatar
  • 4,834
1 vote
1 answer
486 views

Working of WAF/IDS/IPS payload normalization schemes?

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be base64Encode html EntityDecode url Encode Remove whitespaces I want to know how WAF/IDS/IPS ...
Evilwill's user avatar
3 votes
1 answer
4k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
Neo's user avatar
  • 141
10 votes
1 answer
597 views

Is there a web application firewall equivalent of virustotal?

I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
Chris Dale's user avatar
  • 16.2k
2 votes
2 answers
363 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
baj's user avatar
  • 513
7 votes
5 answers
2k views

Master thesis topic - mod_security

I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
cradox23's user avatar
  • 173
24 votes
1 answer
7k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
Sim's user avatar
  • 1,277
15 votes
3 answers
5k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
Tim Troy's user avatar
  • 351

1 2
3