Blog dedicado al estudio de la Seguridad de la Información - Privacidad - Seguridad Informatica - Auditoria informática.
(Recopilación de principales noticias, eventos, politicas de seguridad, guías de buenas practicas, normas, estándares, herramientas, otros)
martes, 9 de octubre de 2012
Protocol-level evasion of web application firewalls
Web application firewalls have come a long way from their modest
beginnings more than a decade ago. They are now an accepted security
best practice and have a significant role in compliance. But there is
still a lot left to do before they can unlock their full potential.
There is one aspect in particular that interests me a great deal, and
that is the ability of end users to verify the operation of WAFs and
measure their technical quality. Understandably, vendors are reluctant
to talk about the weaknesses in their products. However, understanding
the weak points is critical for effective deployments. We cannot claim
to have achieved any level of security otherwise. As always with these
things, we should assume that our adversaries already know about those
weaknesses; but how can we know too? Simple, by forcing the issue out in
Today at Black Hat we (Qualys) are announcing
a new research project on protocol-level evasion of web application
firewalls. This type of evasion focuses on the low level operation of
WAFs, aiming to exploit little differences in how WAFs see traffic and
how backend web servers and applications see it. If you get the WAF to
see something different from what the backend is seeing, you have an
evasion opportunity that could possibly be used to execute any attack
type, without detection.
I spent a great deal of effort on protocol-level evasion in my years
of working on ModSecurity (an open source web application firewall I
started in 2002, and worked on until 2009). I imagine all WAF
manufacturers spend a lot of effort in this area, yet this topic is
seldom discussed in public. It is our aim to change this. Our focus on
protocol-level evasion is part of our work on IronBee, a new open source web application firewall we are building at Qualys.
Attached to this post is our research paper that focuses on request
path, parameter, and multipart/form-data evasion. Also attached are the
Black Hat talk slides that introduce the research. he testing suite (a
sort of a research toolkit) is in the IronBee WAF Research repository on GitHub.