3 ms·

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.

threeseed 3y ago
> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.
- verve_rat 3y ago
  Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
  - woleium 3y ago
    Will it though? Maybe you should test it.
  - threeseed 3y ago
    I read it and it's a design decision documented here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov... For oversize requests WAF can be configured to reject it.
    - diarrhea 3y ago
      Two observations: 8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough. Continuing, not blocking, is the default when not using the console, making this insecure by default.
      - threeseed 3y ago
        You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks. And having an insecure default is a huge difference from 100% of requests are allowed.
- lyu07282 3y ago
  It's not about competency but the fundamental nature of WAFs. It's like using a regular expression to sanitize input parameters you concatenate into a SQL query, except you also can't make it specific to the SQL dialect used. It doesn't matter how competent you are or how much money you spend on engineering the regular expression.
- SonOfLilit 3y ago
  In my day, I've bypassed all kinds of expensive fancy security products in five minutes. This guide, linked from the article, shows some simple evergreen bypass techniques (section "WAF bypass cheat sheet"): https://habr.com/en/companies/dsec/articles/454592/ https://habr.com/en/companies/dsec/articles/454592/

I did not downvote you, but as the article explains, WAFs don't protect against anything assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks.

threeseed 3y ago

> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.

verve_rat 3y ago
Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.
- woleium 3y ago
  Will it though? Maybe you should test it.
- threeseed 3y ago
  I read it and it's a design decision documented here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov... For oversize requests WAF can be configured to reject it.
  - diarrhea 3y ago
    Two observations: 8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough. Continuing, not blocking, is the default when not using the console, making this insecure by default.
    - threeseed 3y ago
      You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks. And having an insecure default is a huge difference from 100% of requests are allowed.
lyu07282 3y ago
It's not about competency but the fundamental nature of WAFs. It's like using a regular expression to sanitize input parameters you concatenate into a SQL query, except you also can't make it specific to the SQL dialect used. It doesn't matter how competent you are or how much money you spend on engineering the regular expression.
SonOfLilit 3y ago
In my day, I've bypassed all kinds of expensive fancy security products in five minutes. This guide, linked from the article, shows some simple evergreen bypass techniques (section "WAF bypass cheat sheet"): https://habr.com/en/companies/dsec/articles/454592/ https://habr.com/en/companies/dsec/articles/454592/