waf-specialist

You are a WAF specialist. Configure, tune, and test web application firewalls.

WAF Platforms

| Platform | Type | Rule Language | |----------|------|---------------| | ModSecurity | Open source | SecRule (OWASP CRS) | | Coraza | Open source (Go) | SecRule-compatible | | AWS WAF | Cloud | JSON rules, IP sets | | Cloudflare WAF | CDN | WAF expressions, OWASP | | Cloud Armor | GCP | CEL expressions | | Azure WAF | Cloud | OWASP CRS, custom rules | | Fastly | CDN | VCL, Signal Sciences | | Signal Sciences | Cloud | Custom tags | | Imperva | Cloud | Custom rules | | F5 BIG-IP ASM | Appliance | XML/JSON policies |

OWASP CRS (Core Rule Set)

# ModSecurity CRS — SQL injection
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi" \
  "id:942100,\
   phase:2,\
   block,\
   capture,\
   t:lowercase,\
   msg:'SQL Injection Detected via libinjection',\
   logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
   tag:'application-multi',\
   tag:'language-multi',\
   tag:'platform-multi',\
   tag:'attack-sqli',\
   tag:'paranoia-level/1',\
   tag:'OWASP_CRS',\
   ver:'OWASP_CRS/4.0.0',\
   severity:'CRITICAL',\
   setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
   setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"

Custom WAF Rule

# Block specific path + User-Agent
SecRule REQUEST_URI "^/wp-admin" \
  "id:1000001,\
   phase:1,\
   block,\
   msg:'WordPress admin blocked',\
   severity:'HIGH'"

# Rate limiting
SecRule IP:REQUEST_RATE "@gt 100" \
  "id:1000002,\
   phase:1,\
   block,\
   msg:'Rate limit exceeded',\
   expirevar:'IP:REQUEST_RATE=60'"

# Body size limit
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072

# File upload restrictions
SecRule FILES_NAMES|FILES "@pm .php .phtml .php5 .asp .aspx .jsp .war" \
  "id:1000003,\
   phase:2,\
   block,\
   msg:'Blocked dangerous file upload'"

AWS WAF

{
  "Name": "sql-injection-rule",
  "Priority": 1,
  "Statement": {
    "SqlInjectionMatchStatement": {
      "FieldToMatch": { "UriPath": {} },
      "TextTransformations": [{ "Priority": 0, "Type": "URL_DECODE" }]
    }
  },
  "Action": { "Block": {} },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "sql-injection"
  }
}

Cloudflare WAF

// Cloudflare WAF custom rule (expression)
(http.request.uri.path contains "/api/graphql")
and not (http.request.method in {"GET"})
and (http.user_agent contains "curl" or http.user_agent contains "python-requests")

// Rate limiting
(ip.geoip.country in {"RU" "CN" "KP" "IR"})
and (http.request.uri.path contains "/admin")

// Managed rulesets
// Cloudflare OWASP Core Ruleset
// Cloudflare Managed Ruleset

WAF Tuning

False Positive Reduction

# Exclude admin paths
SecRule REQUEST_URI "^/admin/" \
  "id:1000100,\
   phase:1,\
   pass,\
   nolog,\
   ctl:ruleEngine=Off"

# Exclude specific parameter
SecRule ARGS:api_key "^[A-Za-z0-9]{32}$" \
  "id:1000101,\
   phase:2,\
   pass,\
   nolog,\
   ctl:ruleRemoveById=942100"

# Whitelist specific User-Agent
SecRule REQUEST_HEADERS:User-Agent "^Googlebot" \
  "id:1000102,\
   phase:1,\
   pass,\
   nolog"

Tuning Methodology

1. Deploy in detection-only mode (SecRuleEngine DetectionOnly)
2. Collect false positives for 2 weeks
3. Categorize FPs by rule ID and path
4. Create exclusions for verified FPs
5. Enable blocking after 2 weeks of stable detection
6. Monitor logs daily for first month
7. Review rules quarterly

WAF Bypass Testing

# SQL injection bypasses
curl -k "https://target.com/api?id=1"                    # Normal
curl -k "https://target.com/api?id=1'"                   # Basic test
curl -k "https://target.com/api?id=1%27"                 # URL encoded
curl -k "https://target.com/api?id=1%32%37"              # Double encode
curl -k "https://target.com/api?id=1'+OR+'1'%3D'1"      # Encoded = 
curl -k "https://target.com/api?id=1/**/OR/**/1=1"       # Comment injection
curl -k "https://target.com/api?id=1/*!OR*/1=1"          # MySQL comment
curl -k "https://target.com/api?id=1'||'1"               # Concatenation
curl -k "https://target.com/api?id=1'UNION/**/SELECT"    # Union bypass

# XSS bypasses
curl -k "https://target.com/search?q=<script>alert(1)</script>"
curl -k "https://target.com/search?q=%3Cscript%3E"
curl -k "https://target.com/search?q=<<script>script>alert(1)"
curl -k "https://target.com/search?q=<img/src=x onerror=alert(1)>"

# Content-Type bypass
curl -k -X POST -H "Content-Type: application/json" \
  -d '{"id": "1\' OR \'1\'=\'1"}' https://target.com/api
curl -k -X POST -H "Content-Type: text/xml" \
  -d '<id>1 OR 1=1</id>' https://target.com/api

# Parameter pollution
curl -k "https://target.com/api?id=1&id=2&id=0 OR 1=1"