32
When deploying security, it is often a good idea to apply multiple layers. Just because you have a lock on your bedroom door doesn't mean you don't put one on the front door to your house. You may also apply a generic set of WAF rules in front of multiple applications.
A WAF may be part of a larger suite for IDS/IPS, it could also help with the performance ...
25
Blacklisting is good if you have omniscient knowledge of every single vulnerability that could ever exist for a single product. I am assuming you do not have infinite knowledge, so you'd be in a constant fight to blacklist the next threats.
A whitelist is good if you have the expected behaviour and inputs for a product. Eg. you expect users to visit the ...
19
HTTP/2 is a way more complex and new protocol than HTTP/1.x and thus bugs are at least initially more likely. In fact a simple search shows several implementation problems and also some new or updated attack vectors due to the changed design of HTTP/2.
The WAF might not work with HTTP2 because it doesn't support the protocol
This is probably less of a ...
19
From the perspective of the client, it does not matter where these headers are implemented; only whether they are implemented at all.
But, from the perspective of deployment, a WAF should be treated only as an additional line of defense and not as the single line of defense. This means that proper input checking should be done in the web application itself ...
15
It depends on your perspective.
If you are looking to it from the perspective of a website maintainer and caretaker, your two concerns are valid: HTTP/2 has been out less time than HTTP/1.1, and therefore software that speaks the protocol have had less time to mature. To the point, I would expect the combination of HTTP/2 and WAF is be a bumpy road at the ...
13
Your approach should be two-fold:
Technical:
Check for:
Various escape sequences (e.g. \x00, %s, \\, etc.)
Unicode tricks (e.g. multi-byte characters that end in 0x22 to produce a ")
Alternative XSS methods (e.g. <img src=0 onerror=alert(1) /> instead of <script>alert(1)</script>)
Various nasties (e.g. XSS, SQL injection) inside of ...
12
The Host-header is used by the client to indicate with which server name it wants to speak. Multiple websites may be served off from a single IP address.
In the HTTP protocol, data may be sent in multiple chunks. This is especially useful if the server does not know the size of the data before completing the request (e. g. a live stream or a web application ...
answered Aug 17 '12 at 20:16
Hendrik Brummermann
26.2k6 gold badges75 silver badges117 bronze badges
12
Check out Ivan Ristić's research. Snippets below from his post on the Qualys blog:
Today at Black Hat [2012] we are announcing a new research project on protocol-level evasion of web application firewalls. This type of evasion focuses on the low level operation of WAFs, aiming to exploit little differences in how WAFs see traffic and how backend web ...
12
It can be difficult to predict how a WAF will inspect traffic because WAF rules and methods are not standardized and work so high up the stack. Basically, you are looking for weaknesses in detection and/or to make it as difficult as possible for a WAF to properly interpret the communication sent to the target.
Some techniques that can be used:
mixed case ...
12
Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other.
An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...
10
Problems should be addressed at the root and not (insufficiently) taped over.
The root of the problem in your case (SQL injection) is that unexpected and unverified user input can be injected as SQL instructions into your SQL statements. This is due to concatenating strings with SQL instructions together with untrusted user input and treating the result as ...
9
There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave
Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...
9
A WAF applies filter rules on traffic at an "application" level (e.g. it tries to detect SQL injection attempts). This requires that the WAF sees the traffic, i.e. whatever SSL which may have happened on the client side must stop at the WAF. But you usually want some SSL to protect the traffic between the client and the WAF (in fact, you usually want it more ...
9
You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type ...
8
Read it as: & == ;
This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a given URL.
Consequently, the following URLs would be treated identically:
https://example.com/foo/bar?x=y&name=peter&debug=1
https://example.com/foo/bar?x=...
7
1.Are those three processes (in)appropriate or am I missing any step/process of the whole thing?
Do you have a need to inspect SSL encrypted traffic? Depending on where your WAF is positioned in your network, you may need a process to handle certificate provisioning and renewal with respect to how the WAFviews traffic.
I separate it into these areas:
...
7
Many organizations are saddled with legacy applications written by developers who are long since gone, WAFs are a way for that organization to protect itself from attacks against those applications.
WAFs are also much faster in deploying fixes. It can take weeks or months to update complex applications, WAFs often have their protection updated in hours.
...
6
There are three approaches to attacking a web application behind a Web Application Firewall (WAF). If you look at existing WAF bypass exploits you can see that they break down into two major categories. You can bypass a set of rules because it is overly restrictive or does not accurately match a real attack, or attack the pre-processor which will bypass ...
6
Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.
...
6
You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details.
In a typical web-application architecture, the WAF stands in front of your web-application, either in your network zone (e.g. DMZ) or within an external service provider network that filters the traffic for you. In case of a DDoS attack, the WAF will be ...
6
Due to architectural necessity, Web Application Firewalls (WAFs) protect against attacks at other layers as well. However, these protections are largely incidental and not comprehensive. Let me illustrate this with some examples:
Presentation Layer - let's assume that the application to be protected uses TLS. If so, the WAF device must by definition* ...
6
If you tightly adjust your WAF to your application so that it can fully distinguish valid from invalid input for specific input fields than you should be able to detect attempts to inject persistent XSS through the use of input fields.
But, usually WAF are not adapted that tightly to the specific application and in this case only employ some heuristics to ...
5
Here are some research papers that tackle this sort of problem and might interest you:
Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009.
Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...
5
Does order of Rules matter ?
Of course. It's mostly about performance.
Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort ...
5
No but only few applications are completely secure. A WAF is a way of mitigating attacks before they actually reach your application. Furthermore you can easily identify malicious users and automatically block them.
WAFs aren't meant to fix your application, they are there to prevent and sometimes mitigate attacks. If your application is secure, but the ...
5
From the SQLMap man pages:
--delay=DELAY Delay in seconds between each HTTP request
5
Just for some thoughts, without saying this is a proper recommendation:
Check which levels of flexibility you need - if some of these headers need to be set in special circumstances (eg. depending on the state of your application), you maybe have no chance but to keep them in the application.
If there are multiple apps behind the WAF, can you be sure that ...
4
To properly test your appliance and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules.
I would also make them test the application which you are protecting ...
4
The only generic approach to preventing SQL injection is to use parameterised queries, also known as prepared statements. These essentially separate out the data from the query language at the protocol level, so the DBMS software will not try to parse any query language from the parameters.
The mechanism you described looks like it's filtering requests with ...
4
I'm not sure that you understood the article. The article insists on writing rules according to the following rubric:
Enumerate all parameters.
For each parameter, determine how many times it can appear in the request.
For each parameter, confirm that the value conforms to the desired format.
Reject requests that contain unknown parameters.
...
Only top voted, non community-wiki answers of a minimum length are eligible
