📖 What is Web Application Firewall (WAF)?
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application. It operates at Layer 7 of the OSI model to protect against attacks like SQLi and XSS.
"When you encounter a WAF, your primary goal is 'WAF Bypass.' This often involves encoding payloads (e.g., URL encoding or Hex) to slip past the filter's signature-based detection."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Web Application Firewall (WAF)?
- ▸ Operates at Layer 7 of the OSI model, allowing it to inspect the actual content of HTTP/HTTPS requests for application-level attacks.
- ▸ Utilizes signature-based detection to match incoming traffic against a database of known attack patterns, such as common SQL injection strings.
- ▸ Employs either a positive security model (allow-listing known good traffic) or a negative security model (blocking known bad traffic patterns).
- ▸ Acts as a reverse proxy, sitting between the external client and the web server to filter malicious requests before they reach the application.
- ▸ Requires testers to use evasion techniques like URL encoding, case variation, or whitespace manipulation to bypass strict signature-based filtering rules.
🎯 How does Web Application Firewall (WAF) appear on the PT0-002 Exam?
You may be asked to identify a WAF's presence when your standard exploitation payloads consistently trigger 403 Forbidden or 406 Not Acceptable HTTP response codes. You must then determine the appropriate encoding or evasion technique to bypass the filter.
A scenario might describe a target environment where the application is vulnerable to SQLi, but the attack is blocked. You must select the best method to evade the WAF, such as using hex encoding or comment-based obfuscation.
Expect questions about the placement of a WAF in a network architecture, specifically its role as a reverse proxy to protect the web server from OWASP Top 10 threats.
❓ Frequently Asked Questions
How does a WAF differ from a standard network firewall?
Traditional firewalls operate at Layers 3 and 4, filtering traffic based on IP addresses and ports. WAFs operate at Layer 7, inspecting the payload of HTTP requests to block application-specific attacks like XSS.
Why is encoding used to bypass a WAF?
WAFs often look for specific keywords like 'UNION SELECT'. By encoding these characters into Hex or URL formats, the payload may bypass the signature check but still be decoded and executed by the backend server.