We all know that whitelisting is not always possib...

2009-06-18T03:01:59.949-07:00

We all know that whitelisting is not always possible due to time/money constraints, even if it’s the best way to protect our applications. Unfortunately, WAFs are very commonly used as out of the box solutions, using generic rules and blacklists.

Anyway, I see your point and I frankly support the idea of providing multiple lines of defense.

Cheers. Luca.

As written in the whitepaper the best practice to ...

2009-06-18T00:24:25.355-07:00

As written in the whitepaper the best practice to deliver protection from RFI attack is having 2 levels:
* zero-day protection
* positive security protection

The zero-day protection rules can be bypassed by the HPP but the positive security protection contains rules that can detect the example that you gave in your blog.

ModSecurity RFI positive security rule would say – if value in parameter “par” is not from allowed predefined values and value is URL - trigger RFI attack.

e.g. ‘par’ allows 1-4 digits

SecRule "ARGS:par" !^\d{1,4}$ "chain,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,deny,phase:2,msg:'Remote File Inclusion' "
SecRule "ARGS:par" (ht|f)tps?://

Or Katz

Comments on Nibble Security: HPP and WAF

We all know that whitelisting is not always possib...

As written in the whitepaper the best practice to ...