25
votes
Why should I use whitelist on a WAF?
Blacklisting is good if you have omniscient knowledge of every single vulnerability that could ever exist for a single product. I am assuming you do not have infinite knowledge, so you'd be in a ...
- 4,737
19
votes
What are possible security problems of enabling HTTP2?
HTTP/2 is a way more complex and new protocol than HTTP/1.x and thus bugs are at least initially more likely. In fact a simple search shows several implementation problems and also some new or updated ...
- 181k
19
votes
Secure HTTP Headers - where should be implemented, WAF or code level?
From the perspective of the client, it does not matter where these headers are implemented; only whether they are implemented at all.
But, from the perspective of deployment, a WAF should be treated ...
- 181k
15
votes
What are possible security problems of enabling HTTP2?
It depends on your perspective.
If you are looking to it from the perspective of a website maintainer and caretaker, your two concerns are valid: HTTP/2 has been out less time than HTTP/1.1, and ...
- 403
14
votes
Accepted
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
Yes, the configuration is as follows:
[client web browser] <--TLS--> [WAF] <--TLS--> [origin web server]
So, the WAF essentially has a 'man in the middle' (MITM) position between the ...
- 19.6k
12
votes
Accepted
What are the difference between IPS and WAF in terms of DDoS?
Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is ...
- 17.3k
9
votes
Accepted
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Problems should be addressed at the root and not (insufficiently) taped over.
The root of the problem in your case (SQL injection) is that unexpected and unverified user input can be injected as SQL ...
- 181k
8
votes
Accepted
What does `&==;` mean with regard to Python Django and bypassing WAFs?
Read it as: & == ;
This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
- 43.7k
7
votes
Accepted
How web application firewalls protect application from DDoS attacks?
You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details.
In a typical web-application architecture, the WAF stands in front of your web-application, ...
- 2,728
7
votes
Accepted
SAST vs WAF: What should I choose?
WAF (Web application firewall) is meant to protect an already deployed application independently of the underlying application.
SAST (Static Application Security Testing) is meant to scan your code ...
- 994
6
votes
Accepted
Why can't persistence XSS be detected by a Web Application Firewall?
If you tightly adjust your WAF to your application so that it can fully distinguish valid from invalid input for specific input fields than you should be able to detect attempts to inject persistent ...
- 181k
6
votes
Accepted
Does a Web Application Firewall only protect OSI layer 7?
Due to architectural necessity, Web Application Firewalls (WAFs) protect against attacks at other layers as well. However, these protections are largely incidental and not comprehensive. Let me ...
- 71.8k
6
votes
Accepted
How limit request rate of sqlmap?
From the SQLMap man pages:
--delay=DELAY Delay in seconds between each HTTP request
- 2,329
5
votes
Secure HTTP Headers - where should be implemented, WAF or code level?
Just for some thoughts, without saying this is a proper recommendation:
Check which levels of flexibility you need - if some of these headers need to be set in special circumstances (eg. depending on ...
- 151
4
votes
What are the difference between IPS and WAF in terms of DDoS?
So first lets look at these two. A Web Application Firewalls, as the name implies, work with web applications almost exclusively. Most WAF are often not best-of-breed traditional firewalls, and should ...
4
votes
Why can't persistence XSS be detected by a Web Application Firewall?
I think that the point isn't phrased ideally, as a WAF can indeed catch some persistent XSS attacks.
But there are at least two problems:
persistent XSS attacks do not just happen via web requests, ...
- 29k
4
votes
Accepted
Comparison between WAF and IPS/IDS
As @schroeder says, the largest difference is where they sit in the stack. Let's talk about that difference.
The Web Application Firewall works at the Application layer. That implies that it is ...
- 71.8k
4
votes
SAST vs WAF: What should I choose?
SAST has several advantages:
can be deployed quickly
requires little to no maintenance
remediations can be done faster
minimizes the need for post-release patches and security updates
has better ...
- 8,729
3
votes
Using user agent & inputs for SQL injection with ModSecurity WAF
The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid.
For example, maybe the SQL query is contructed like this:
UPDATE ...
- 28.6k
3
votes
Cloud Based WAF
I should think a QSA will be satisfied that IP addresses cannot be be spoofed in order to bypass a device that operates at the application layer.
As long as you can prove that access is properly ...
- 33.2k
3
votes
XSS with URL encoding
The answer depends on how the page renders your payload.
If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or ...
- 491
3
votes
Web Application Firewall with based on an external decision to detect anomaly
This may not be a popular opinion (cue comments), but I am not a fan of Machine Learning being used in the security industry.
I'm always skeptical when it seems like the approach is "We don't know ...
- 57.4k
3
votes
How to protect Authentication API from a DDoS attacks?
Just use a CDN to deliver the webiste, that will be the best protection against a Distributed DOS attack.
- 994
3
votes
How to protect Authentication API from a DDoS attacks?
I second @RaimondsLiepiņš; don't try to solve DDoS yourself, buy protection through your CDN.
At its core, a DDoS attack comes down to whether the attacker has a bigger firehose than you do; if they ...
- 57.4k
3
votes
Accepted
XSS in a variable assignment when <>" are escaped
No, not given the filter behavior you specified.
You need double quotes (") to exit the JS string context.
You need angle brackets (<>) to exit the <script> tag which I presume ...
- 43.7k
3
votes
Xss filter bypass ><script>alert(1);</script>
There is no default way/trick to bypass this.
However you can try to identify if there is a regex in place that you can break.
Or if there are any normalization/decoding inconsistencies.
Some ideas:
...
3
votes
Bypass WAF to perform XSS?
The source snippets you shared show that the application is properly encoding the brackets and other characters needed for this XSS attempt to work, so even though the keywords onerror and alert are ...
- 6,797
2
votes
Accepted
What are the main reason to deploy Secure Web Gateway?
What would be the protection that Secure Web Gateway only provides,
other appliances don't?
In your scenario, the answer is none.
Per Gartner's definition:
Secure Web Gateway
Secure Web gateway ...
- 3,923
2
votes
Cloud Based WAF
You may want to ask an expert in person, as PCI compliance is a specialty in and of itself, however at least Cloud Flare suggests that they are PCI compliant:
https://blog.cloudflare.com/cloudflare-...
- 2,010
2
votes
Why should I use whitelist on a WAF?
In this guest post on our blog by John Stauffacher, a world renowned expert in web application security, and the author of Web Application Firewalls: A Practical Approach... John recommends...
The ...
- 21
Only top scored, non community-wiki answers of a minimum length are eligible