Web Application Firewalls: Analysis of Detection Logic
summary
Analysis inspects detection logic of six open‑source WAFs (ModSecurity/CRS 2,3, Comodo, PHPIDS, QuickDefense, Libinjection), reports over 300 potential regex weaknesses and details more than 15 new bypasses. A static regex analyzer and a released SAST tool flag issues like missing case modifiers, flawed quantifiers, blacklists, and ReDoS; fuzzing against MySQL/MSSQL/Oracle yields clustered lookup tables of allowed characters and a published regex security cheatsheet with concrete payloads that bypass many rules.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:05Agenda and goals
- 2:57Attacker vs defender mindset
- 4:29WAF operational stages
- 5:53Regex detection research
- 8:31Regex bypass examples
- 11:21Advanced regex flaws
- 14:18Regex cheat sheet tool
- 16:04Tool demo and case study
- 19:15Bypassing major WAFs
- 23:00Browser filter bypass
- 24:34Root cause analysis
- 27:44Logical bypass methods
- 29:52Unexpected logic bypass
- 32:37Libinjection analysis
- 35:00Fuzzing results table
- 37:10Conclusion and future work
related talks
14mWeb Application Firewalls: A False Sense of Security?
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
37mWeb Application Firewall Bypassing
46mIt is rough without a WAF
42mDon’t use a WAF, and when you should, anyway.
43m Web Application Vulnerability Scanners: An Intro & Discussion
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)