Collaborate Disseminate
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any CRS rule work unproperly? really appre… Continue reading owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any CRS rule work unproperly? really appre… Continue reading owasp crs 3.0 rule functuonalityconsult
By Owais Sultan
Every so often, you hear in the news that a company’s website was down temporarily for several hours,…
This is a post from HackRead.com Read the original post: 3 ways to improve your website security
Continue reading 3 ways to improve your website security
If an api in aws api-gateway has a rate-limiting usage plan and a Web ACL WAF rate rule, which will be applied first?
Does a WAF rate rule provide additional protection that kicks in before the usage plan?
Continue reading aws api gateway – usage plan rate limiting vs WAF rate rule [closed]
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. Warning. Pattern match \"(^[\&quo… Continue reading Azure WAF support for OData
I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed.
Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and this one is not blocked:
<img src=d… Continue reading Bypass WAF to perform XSS?
Summary:
I have setup a basic WAF with mod-security and the OWASP coreruleset 3.3.2. When using the WAF I see lots of warnings in modsec_audit.log regarding the CONNECT method, which trigger crs rule 920100:
Message: Warning. Match of &qu… Continue reading OWASP corerulet warning "invalid http request line" triggered by CONNECT method [migrated]
I have a bot that logs into some service at www and performs some actions.
It worked for over one year and last time the Imperva Incapsula WAF was modified by the site owners and they probably detected the bot by its regular logins every f… Continue reading WAF blocked bot that enters login page at www [closed]
I’m trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg is not printed either on access.log or… Continue reading Why is my SecAction rule being ignored?
We are using a GIS Application hosted on Azure sat behind the Azure WAF. Whenever an Android device connects to the application, it allows access, but throws a http 403 response whenever the iOS device tries to connect.
I’ve been through … Continue reading Azure WAF not allowing iOS connections, but allowing Android [migrated]