39
votes
Which IP address would be most safe and suitable to use as a placeholder in a live system?
I recommend using an address in one of the TEST-NET networks (192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24) documented in RFC 5737 and RFC 5735 (link below). Pay attention to the Operation ...
- 2,270
36
votes
What's wrong with the use of a WAF (Web Application Firewall)?
A WAF is fundamentally a MITM attack against your own web services. It intercepts, and, in the event that it has a vulnerability, backdoor, poor handling of data transmission or storage, etc., has the ...
31
votes
What's wrong with the use of a WAF (Web Application Firewall)?
One possible explanation would be that they think you rely on a WAF for your security, rather than using it as an additional security layer. I've met people who have very insecure legacy sites (full ...
- 16.7k
19
votes
What are possible security problems of enabling HTTP2?
HTTP/2 is a way more complex and new protocol than HTTP/1.x and thus bugs are at least initially more likely. In fact a simple search shows several implementation problems and also some new or updated ...
- 208k
19
votes
Secure HTTP Headers - where should be implemented, WAF or code level?
From the perspective of the client, it does not matter where these headers are implemented; only whether they are implemented at all.
But, from the perspective of deployment, a WAF should be treated ...
- 208k
15
votes
What are possible security problems of enabling HTTP2?
It depends on your perspective.
If you are looking to it from the perspective of a website maintainer and caretaker, your two concerns are valid: HTTP/2 has been out less time than HTTP/1.1, and ...
- 403
14
votes
Accepted
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
Yes, the configuration is as follows:
[client web browser] <--TLS--> [WAF] <--TLS--> [origin web server]
So, the WAF essentially has a 'man in the middle' (MITM) position between the ...
- 24.1k
9
votes
Accepted
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Problems should be addressed at the root and not (insufficiently) taped over.
The root of the problem in your case (SQL injection) is that unexpected and unverified user input can be injected as SQL ...
- 208k
8
votes
Accepted
What does `&==;` mean with regard to Python Django and bypassing WAFs?
Read it as: & == ;
This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
- 45.1k
8
votes
What's wrong with the use of a WAF (Web Application Firewall)?
One thing I can think of, and I don't know if this applies to you, is if a WAF has been used instead of fixing application vulnerabilities. Sometimes companies do this, especially when it's difficult ...
- 34.7k
7
votes
Accepted
How limit request rate of sqlmap?
From the SQLMap man pages:
--delay=DELAY Delay in seconds between each HTTP request
- 2,419
7
votes
Accepted
SAST vs WAF: What should I choose?
WAF (Web application firewall) is meant to protect an already deployed application independently of the underlying application.
SAST (Static Application Security Testing) is meant to scan your code ...
- 1,022
5
votes
Secure HTTP Headers - where should be implemented, WAF or code level?
Just for some thoughts, without saying this is a proper recommendation:
Check which levels of flexibility you need - if some of these headers need to be set in special circumstances (eg. depending on ...
- 151
4
votes
Accepted
Comparison between WAF and IPS/IDS
As @schroeder says, the largest difference is where they sit in the stack. Let's talk about that difference.
The Web Application Firewall works at the Application layer. That implies that it is ...
- 73.3k
4
votes
SAST vs WAF: What should I choose?
SAST has several advantages:
can be deployed quickly
requires little to no maintenance
remediations can be done faster
minimizes the need for post-release patches and security updates
has better ...
- 8,939
4
votes
How to protect Authentication API from a DDoS attacks?
I second @RaimondsLiepiņš; don't try to solve DDoS yourself, buy protection through your CDN.
At its core, a DDoS attack comes down to whether the attacker has a bigger firehose than you do; if they ...
- 59.3k
4
votes
Accepted
Xss filter bypass ><script>alert(1);</script>
There is no default way/trick to bypass this.
However you can try to identify if there is a regex in place that you can break.
Or if there are any normalization/decoding inconsistencies.
Some ideas:
...
4
votes
What's wrong with the use of a WAF (Web Application Firewall)?
You mentioned your product is implemented in an older programming language dating to 1990. This suggests Python, Haskell or something more obscure (and if so likely worse).
The customer's security ...
- 203
4
votes
What's wrong with the use of a WAF (Web Application Firewall)?
The reviewer deemed the WAF a negative, when combined with the other 2 reasons which are not provided here. Therefore we can't really answer the question, because seriously, in general (ie without ...
- 141
4
votes
Accepted
Is WAF fingerprinting a security threat, and can it be obfuscated?
Exposing the WAF shouldn't be a major security problem. If it is, then the system which uses the WAF relies on security through obscurity rather than the actual quality of the WAF.
The only reason for ...
- 23.3k
3
votes
Web Application Firewall with based on an external decision to detect anomaly
This may not be a popular opinion (cue comments), but I am not a fan of Machine Learning being used in the security industry.
I'm always skeptical when it seems like the approach is "We don't know ...
- 59.3k
3
votes
XSS with URL encoding
The answer depends on how the page renders your payload.
If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or ...
- 511
3
votes
How to protect Authentication API from a DDoS attacks?
Just use a CDN to deliver the webiste, that will be the best protection against a Distributed DOS attack.
- 1,022
3
votes
WAF really Needed?
The question here contains a fundamentally incorrect statement "...because AWS standard WAF only covers layer 3/4 attacks not layer 7".
AWS WAF covers layer 7 HTTP attacks (Shield is not ...
- 31
3
votes
Accepted
XSS in a variable assignment when <>" are escaped
No, not given the filter behavior you specified.
You need double quotes (") to exit the JS string context.
You need angle brackets (<>) to exit the <script> tag which I presume ...
- 45.1k
3
votes
Bypass WAF to perform XSS?
The source snippets you shared show that the application is properly encoding the brackets and other characters needed for this XSS attempt to work, so even though the keywords onerror and alert are ...
- 6,923
3
votes
Does geo blocking whole countries objectively increase security?
Generally speaking, geoblocking like this doesn't really do much to increase your security. Even leaving aside the issues with IPs that can't be easily linked to any one country or IPv6, it's usually ...
- 16.7k
2
votes
Reverse Proxy + WAF
You haven't defined the website/application.
Is it mutable? - if it's mostly static content then a few web-server rules could drop any malicious traffic.
If it's customer facing/dynamic... do you ...
- 166
2
votes
Protection against command injection with modsecurity
Check inside file: modsecurity_crs_40_generic_attacks.conf and if your WAF is properly configured than it should react when you try to trigger command injection.
#
# OS Command Injection Attacks
#
# -...
- 10.2k
2
votes
Accepted
WAF/IDS detection question
None of the above. It's a default Apache message for page security.
Source:
https://github.com/apache/httpd/blob/29ddc70d4aa6847c46d8b8659ff0fbfd39308382/modules/http/http_protocol.c#L991
- 132k
Only top scored, non community-wiki answers of a minimum length are eligible