4 ms·

And this is a good reason why most HTTP servers need a web application firewall. Either try mod_security or use reverse cloud proxy like Cloudflare, AWS, etc. O

And this is a good reason why most HTTP servers need a web application firewall. Either try mod_security or use reverse cloud proxy like Cloudflare, AWS, etc. Of course, writing clean and secure code should not be ignored even if you use WAF. At least read owasp https://owasp.org/www-community/attacks/ https://owasp.org/www-community/attacks/ It saved me so much time :)

bastawhiz 4y ago
I've had very bad experiences with mod_security. One client had a page refuse to load because the URL contained the word "DELETE". Unless they've cleaned it up a lot in recent years, I'd never recommend it to anyone.
- hsbauauvhabzb 4y ago
  This, I’d rather not use a waf and focus on making sure that application security is good. A waf is at best as good as AV, good as a catch all, but it won’t catch highly targeted stuff, and isn’t even a defensible boundary to protect the former.
  - chrisshroba 4y ago
    What does AV mean in this context?
    - deleted 4y ago
      [deleted]
    - ShowalkKama 4y ago
      antivirus
  - brodock 4y ago
    WAF is mandatory in some certifications.
    - hsbauauvhabzb 4y ago
      Yes but so safe lots of silly controls. The best part of a waf is the ability to add custom rules at runtime which can assist in blocking known vulnerabilities until they are remediated correctly. I don’t think generic sql or XSS injection rules are at all effective not stop many real world attacks. I’ve also seen wafs create both an availability failure point, dos choke point, and be the most vulnerable product in the tool chain (see F5 code exec vulns).
- sschueller 4y ago
  Sadly nothing open source comes close and because of the uptick in commercial service likes AWS and cloudflare mod_security has memory leaks and other issues.
  - knodi 4y ago
    Yes, AWS and Cloudflare are better but not without their own problems. WAF is something you evolve over time to correct the false positive which may have been observed. AWS WAF would trigger a false SQL injection attack if the URL contains two "+" chars and the word "and". Or if you have a cookie with JSON in it would trigger the XSS attack rule. Highly recommend setting up WAF logs to output some logs aggression tool (e.g Splunk) and create reports, dashboard, and alerts about WAF trigger rules & request HTTP code over a span to time and see what is going on with your requests and how WAF is evaluating the requests. 1% of WAF blocks were real attacks, my experience is with a site that had 25 million unique visitors a month (no user content). i'm not saying you shouldn't have WAF, i'm saying nothing beats good visibitily into WAF to correct it behavior over time.
    - gingerlime 4y ago
      Do AWS and Cloudflare allow you to correct their false-positives? any other 3rd party WAFs worth considering?
      - knodi 4y ago
        Sadly no, you can disable an AWS provided rule but that may have other issues like you lose all detection for that attack vector. With AWS WAFv2 you can have custom rules with logic that lives in lambdas, the lambda is invoked every WAF request for evaluation based on the logic in the lambda. There are few options on AWS marketplace such as Fortinet and F5 WAF rules. Fortinet is the better of the 2 and newer.
- technion 4y ago
  I keep telling the story of attempting to buy some enterprise routers. I would logon to my distributor's website, click on the CISCO SELECT range, and get blocked from the site for an attempted SQL injection ("SELECT" in the query string). On the topic of mod_security in general, something like half of these are .php urls, and there's a good chance many readers aren't even running a php interpreter. Somewhere, there's a person attempting to convince the reader that that is exactly the sort of malicious traffic you need a WAF for.
  - ynbl_ 4y ago
    this. so much this. its like when i tried to view a site but i was using tor and not a mainstream web browser so i had to solve 2 captchas to proceed (one for the main domain, and one for the cdn) but the captcha also takes 3 minutes to solve because its over tor and it doesnt like the speed i moved the mouse at
- elric 4y ago
  We had to modify an application we built for a bank. Stuff could be deleted using HTTP DELETE (after authentication & authorization, of course), which was very much Verboten by their "security" policy. Instead we had to delete using HTTP GET or POST.
  - sam_lowry_ 4y ago
    I recently came across a Hashcash implementation which used sha-256 instead of sha-1 because of "corporate security" forbidding sha-1.
elric 4y ago
I'm not seeing the immediate value here. If your application is vulnerable to unauthenticated DELETE requests randomly deleting stuff, no amount of application firewalling is going to protect you, because I guarantee that whoever built the original application had no clue what they were doing.
- nickjj 4y ago
  > I'm not seeing the immediate value here. The parent comment might have been coming at it from the angle of having a firewall in front of your web app is helpful because it blocks a whole bunch of bad actor traffic from ever touching your app's servers. Of which I would agree with too. A decently popular site could end up having at least 10% of its traffic being malicious. Let your app servers worry about the legit traffic and filter the rest beforehand.
- thakoppno 4y ago
  The DELETE one appears the least sophisticated. Does any framework deploy out of the box with DELETE being enabled to the extent it deletes hypertext resources?

bastawhiz 4y ago

I've had very bad experiences with mod_security. One client had a page refuse to load because the URL contained the word "DELETE". Unless they've cleaned it up a lot in recent years, I'd never recommend it to anyone.

hsbauauvhabzb 4y ago
This, I’d rather not use a waf and focus on making sure that application security is good. A waf is at best as good as AV, good as a catch all, but it won’t catch highly targeted stuff, and isn’t even a defensible boundary to protect the former.
- chrisshroba 4y ago
  What does AV mean in this context?
  - deleted 4y ago
    [deleted]
  - ShowalkKama 4y ago
    antivirus
- brodock 4y ago
  WAF is mandatory in some certifications.
  - hsbauauvhabzb 4y ago
    Yes but so safe lots of silly controls. The best part of a waf is the ability to add custom rules at runtime which can assist in blocking known vulnerabilities until they are remediated correctly. I don’t think generic sql or XSS injection rules are at all effective not stop many real world attacks. I’ve also seen wafs create both an availability failure point, dos choke point, and be the most vulnerable product in the tool chain (see F5 code exec vulns).
sschueller 4y ago
Sadly nothing open source comes close and because of the uptick in commercial service likes AWS and cloudflare mod_security has memory leaks and other issues.
- knodi 4y ago
  Yes, AWS and Cloudflare are better but not without their own problems. WAF is something you evolve over time to correct the false positive which may have been observed. AWS WAF would trigger a false SQL injection attack if the URL contains two "+" chars and the word "and". Or if you have a cookie with JSON in it would trigger the XSS attack rule. Highly recommend setting up WAF logs to output some logs aggression tool (e.g Splunk) and create reports, dashboard, and alerts about WAF trigger rules & request HTTP code over a span to time and see what is going on with your requests and how WAF is evaluating the requests. 1% of WAF blocks were real attacks, my experience is with a site that had 25 million unique visitors a month (no user content). i'm not saying you shouldn't have WAF, i'm saying nothing beats good visibitily into WAF to correct it behavior over time.
  - gingerlime 4y ago
    Do AWS and Cloudflare allow you to correct their false-positives? any other 3rd party WAFs worth considering?
    - knodi 4y ago
      Sadly no, you can disable an AWS provided rule but that may have other issues like you lose all detection for that attack vector. With AWS WAFv2 you can have custom rules with logic that lives in lambdas, the lambda is invoked every WAF request for evaluation based on the logic in the lambda. There are few options on AWS marketplace such as Fortinet and F5 WAF rules. Fortinet is the better of the 2 and newer.
technion 4y ago
I keep telling the story of attempting to buy some enterprise routers. I would logon to my distributor's website, click on the CISCO SELECT range, and get blocked from the site for an attempted SQL injection ("SELECT" in the query string). On the topic of mod_security in general, something like half of these are .php urls, and there's a good chance many readers aren't even running a php interpreter. Somewhere, there's a person attempting to convince the reader that that is exactly the sort of malicious traffic you need a WAF for.
- ynbl_ 4y ago
  this. so much this. its like when i tried to view a site but i was using tor and not a mainstream web browser so i had to solve 2 captchas to proceed (one for the main domain, and one for the cdn) but the captcha also takes 3 minutes to solve because its over tor and it doesnt like the speed i moved the mouse at
elric 4y ago
We had to modify an application we built for a bank. Stuff could be deleted using HTTP DELETE (after authentication & authorization, of course), which was very much Verboten by their "security" policy. Instead we had to delete using HTTP GET or POST.
- sam_lowry_ 4y ago
  I recently came across a Hashcash implementation which used sha-256 instead of sha-1 because of "corporate security" forbidding sha-1.

elric 4y ago

I'm not seeing the immediate value here. If your application is vulnerable to unauthenticated DELETE requests randomly deleting stuff, no amount of application firewalling is going to protect you, because I guarantee that whoever built the original application had no clue what they were doing.

nickjj 4y ago
> I'm not seeing the immediate value here. The parent comment might have been coming at it from the angle of having a firewall in front of your web app is helpful because it blocks a whole bunch of bad actor traffic from ever touching your app's servers. Of which I would agree with too. A decently popular site could end up having at least 10% of its traffic being malicious. Let your app servers worry about the legit traffic and filter the rest beforehand.
thakoppno 4y ago
The DELETE one appears the least sophisticated. Does any framework deploy out of the box with DELETE being enabled to the extent it deletes hypertext resources?