Collaborate Disseminate
Various tools, such as WAFW00F, can be used to detect the presence, and often even the type, of WAF deployed on a website.
And according to this article:
[WAF fingerprinting] works by analysing the responses received from a target web app… Continue reading Is WAF fingerprinting a security threat, and can it be obfuscated?
In today’s digital world, protecting your online assets is more critical than ever. As cyber threats grow increasingly… Continue reading Risk Management Strategies: Incorporating Cloud WAFs into Your Plan
I am currently working on a security research project on WAF.
To understand the complete working of a WAF, I am planning to get started with Modsecurity WAF; its architecture and how it works to protect web servers. But all I can find is g… Continue reading Where can I learn the complete architecture of Modsecurity WAF and how it works in depth ? This is for a research on current WAF technologies [closed]
I’m playing with ModSecurity and need help. I’m trying to add a condition in the conf file where if there is specific header in the request then the SecRuleEngine should be On else it should be DetectionOnly. I tried the below condition in… Continue reading ModSecurity Condition Based Block Mode?
Okay so I’ve seen lot of articles & spent a pretty long while looking around, couldn’t find a straight answer for this.
Does Akmai WAF always protect against request smuggling attacks? can a user configure it in a way that makes it vul… Continue reading Akmai WAF protecting against request smuggling
What’s the most effective, up-to-date way to prevent SQL injection attacks through WAF (using signatures or other algorithms which can be equipped by a WAF)? It will be useful to implement for my project on WAF.
Continue reading Prevention of SQL injection through WAF [closed]
I was wondering should IP behind Traffic Manager treated like IP behind WAF (e.g Cloudflare). Is it okay if one were able to access that real IP directly?
Continue reading Should IP behind Azure Traffic Manager be treated as private?
I was wondering should IP behind Traffic Manager treated like IP behind WAF (e.g Cloudflare). Is it okay if one were able to access that real IP directly?
Continue reading Should IP behind Azure Traffic Manager be treated as private?
I have to build a web application firewall from scratch but most of resources available are either WAF marketing or too complex to understand . My goal is to understand deeply on web application firewall through this project as how WAF can… Continue reading How to develop a WAF ( Web application firewall ) from scratch ? and what are the tech stacks required? [closed]
We have 3rd-Party CDN in front of Financial/Banking APIs which involves sensitive data, login, access token, cookies, etc.
We would like to leverage WAF and SSL Inspection capability of CDN. This requires SSL Offloading at CDN.
How to avoi… Continue reading 3rd-Party CDN SSL Inspection for Financial/Banking API Traffics