Hot answers tagged

25 votes

Why should I use whitelist on a WAF?

Blacklisting is good if you have omniscient knowledge of every single vulnerability that could ever exist for a single product. I am assuming you do not have infinite knowledge, so you'd be in a ...
user avatar
  • 4,737
19 votes

What are possible security problems of enabling HTTP2?

HTTP/2 is a way more complex and new protocol than HTTP/1.x and thus bugs are at least initially more likely. In fact a simple search shows several implementation problems and also some new or updated ...
user avatar
19 votes

Secure HTTP Headers - where should be implemented, WAF or code level?

From the perspective of the client, it does not matter where these headers are implemented; only whether they are implemented at all. But, from the perspective of deployment, a WAF should be treated ...
user avatar
15 votes

What are possible security problems of enabling HTTP2?

It depends on your perspective. If you are looking to it from the perspective of a website maintainer and caretaker, your two concerns are valid: HTTP/2 has been out less time than HTTP/1.1, and ...
user avatar
  • 403
14 votes
Accepted

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

Yes, the configuration is as follows: [client web browser] <--TLS--> [WAF] <--TLS--> [origin web server] So, the WAF essentially has a 'man in the middle' (MITM) position between the ...
user avatar
  • 19.6k
12 votes
Accepted

What are the difference between IPS and WAF in terms of DDoS?

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is ...
user avatar
  • 17.3k
9 votes
Accepted

Is a web application firewall enough to defend against sql injection? or should I use prepared statements?

Problems should be addressed at the root and not (insufficiently) taped over. The root of the problem in your case (SQL injection) is that unexpected and unverified user input can be injected as SQL ...
user avatar
8 votes
Accepted

What does `&==;` mean with regard to Python Django and bypassing WAFs?

Read it as: & == ; This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
user avatar
  • 43.7k
7 votes
Accepted

How web application firewalls protect application from DDoS attacks?

You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details. In a typical web-application architecture, the WAF stands in front of your web-application, ...
user avatar
  • 2,728
7 votes
Accepted

SAST vs WAF: What should I choose?

WAF (Web application firewall) is meant to protect an already deployed application independently of the underlying application. SAST (Static Application Security Testing) is meant to scan your code ...
user avatar
6 votes
Accepted

Why can't persistence XSS be detected by a Web Application Firewall?

If you tightly adjust your WAF to your application so that it can fully distinguish valid from invalid input for specific input fields than you should be able to detect attempts to inject persistent ...
user avatar
6 votes
Accepted

Does a Web Application Firewall only protect OSI layer 7?

Due to architectural necessity, Web Application Firewalls (WAFs) protect against attacks at other layers as well. However, these protections are largely incidental and not comprehensive. Let me ...
user avatar
  • 71.8k
6 votes
Accepted

How limit request rate of sqlmap?

From the SQLMap man pages: --delay=DELAY Delay in seconds between each HTTP request
user avatar
  • 2,329
5 votes

Secure HTTP Headers - where should be implemented, WAF or code level?

Just for some thoughts, without saying this is a proper recommendation: Check which levels of flexibility you need - if some of these headers need to be set in special circumstances (eg. depending on ...
user avatar
4 votes

What are the difference between IPS and WAF in terms of DDoS?

So first lets look at these two. A Web Application Firewalls, as the name implies, work with web applications almost exclusively. Most WAF are often not best-of-breed traditional firewalls, and should ...
user avatar
4 votes

Why can't persistence XSS be detected by a Web Application Firewall?

I think that the point isn't phrased ideally, as a WAF can indeed catch some persistent XSS attacks. But there are at least two problems: persistent XSS attacks do not just happen via web requests, ...
user avatar
  • 29k
4 votes
Accepted

Comparison between WAF and IPS/IDS

As @schroeder says, the largest difference is where they sit in the stack. Let's talk about that difference. The Web Application Firewall works at the Application layer. That implies that it is ...
user avatar
  • 71.8k
4 votes

SAST vs WAF: What should I choose?

SAST has several advantages: can be deployed quickly requires little to no maintenance remediations can be done faster minimizes the need for post-release patches and security updates has better ...
user avatar
  • 8,729
3 votes

Using user agent & inputs for SQL injection with ModSecurity WAF

The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid. For example, maybe the SQL query is contructed like this: UPDATE ...
user avatar
  • 28.6k
3 votes

Cloud Based WAF

I should think a QSA will be satisfied that IP addresses cannot be be spoofed in order to bypass a device that operates at the application layer. As long as you can prove that access is properly ...
user avatar
3 votes

XSS with URL encoding

The answer depends on how the page renders your payload. If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or ...
user avatar
  • 491
3 votes

Web Application Firewall with based on an external decision to detect anomaly

This may not be a popular opinion (cue comments), but I am not a fan of Machine Learning being used in the security industry. I'm always skeptical when it seems like the approach is "We don't know ...
user avatar
3 votes

How to protect Authentication API from a DDoS attacks?

Just use a CDN to deliver the webiste, that will be the best protection against a Distributed DOS attack.
user avatar
3 votes

How to protect Authentication API from a DDoS attacks?

I second @RaimondsLiepiņš; don't try to solve DDoS yourself, buy protection through your CDN. At its core, a DDoS attack comes down to whether the attacker has a bigger firehose than you do; if they ...
user avatar
3 votes
Accepted

XSS in a variable assignment when <>" are escaped

No, not given the filter behavior you specified. You need double quotes (") to exit the JS string context. You need angle brackets (<>) to exit the <script> tag which I presume ...
user avatar
  • 43.7k
3 votes

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt;

There is no default way/trick to bypass this. However you can try to identify if there is a regex in place that you can break. Or if there are any normalization/decoding inconsistencies. Some ideas: ...
user avatar
3 votes

Bypass WAF to perform XSS?

The source snippets you shared show that the application is properly encoding the brackets and other characters needed for this XSS attempt to work, so even though the keywords onerror and alert are ...
user avatar
  • 6,797
2 votes
Accepted

What are the main reason to deploy Secure Web Gateway?

What would be the protection that Secure Web Gateway only provides, other appliances don't? In your scenario, the answer is none. Per Gartner's definition: Secure Web Gateway Secure Web gateway ...
user avatar
  • 3,923
2 votes

Cloud Based WAF

You may want to ask an expert in person, as PCI compliance is a specialty in and of itself, however at least Cloud Flare suggests that they are PCI compliant: https://blog.cloudflare.com/cloudflare-...
user avatar
  • 2,010
2 votes

Why should I use whitelist on a WAF?

In this guest post on our blog by John Stauffacher, a world renowned expert in web application security, and the author of Web Application Firewalls: A Practical Approach... John recommends... The ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible