Web Application Firewalls: A False Sense of Security?
summary
Compares network firewalls to ModSecurity with CRS running on nginx and shows concrete failures: poorly written regex rules causing CPU spikes that took Cloudflare-like infrastructure down and legitimate users blocked for days, high false positive rates, and an example where WAF logging leaks or automated rule responses expose credentials. Demonstrates practical bypasses—encoding, comment insertion, wildcard abuses, regex-breaking payload permutations—and stresses that root causes are IDOR and race-condition logic bugs plus missing validation, so measure and fix the app before relying on a WAF.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:05Web vs network firewalls
- 3:39WAF performance impact
- 5:50Cloudflare misconfiguration
- 7:19Logic flaws bypass WAF
- 9:10Regex bypass techniques
- 10:32Payload obfuscation
- 11:55WAF limitations summary
- 12:47Conclusion and Q&A
related talks
40mWeb Application Firewalls: Analysis of Detection Logic
42mDon’t use a WAF, and when you should, anyway.
37mWeb Application Firewall Bypassing
38mWeb Application Firewalls Revisited
46mIt is rough without a WAF
27mSecuring Applications and Managing WAFs at a large scale
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection