Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

JeremyBanks wrote: post #3

chx wrote: post #2

Hrm... the solution is to keep your PHP codebase up to date...?

The solution is to throw out your WAF.

Disagree. This just reinforces the point that best security is multi-layered.

Re: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

#6

Post by simlevesque » Mon, Jul 08, 2019, 8:08 PM UTC

JeremyBanks wrote: post #3

chx wrote: post #2

Hrm... the solution is to keep your PHP codebase up to date...?

The solution is to throw out your WAF.

WAF has it's purpose but it's clearly not a silver bullet. Nothing is.

Re: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

#7

Post by cortesoft » Mon, Jul 08, 2019, 8:46 PM UTC

tptacek wrote: post #4

Or, "why you shouldn't rely on IDS, IPS, and WAF".

For anything?

Re: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

#8

Post by DJBunnies » Mon, Jul 08, 2019, 8:49 PM UTC

simlevesque wrote: post #6

JeremyBanks wrote: post #3

Earlier quoted context omitted.

The solution is to throw out your WAF.

WAF has it's purpose but it's clearly not a silver bullet. Nothing is.

If it's so easily circumvented I wonder if it's worth the costs.

Re: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

#9

Post by tptacek » Mon, Jul 08, 2019, 9:01 PM UTC

cortesoft wrote: post #7

tptacek wrote: post #4

Or, "why you shouldn't rely on IDS, IPS, and WAF".

For anything?

I like Signal Science just as a product in general, and have used it to accomplish a variety of security tasks for clients. I am not sold on the core promise of WAF/RASP, where you front an insecure application with a middlebox that resolves security problems for you, and I think I'm squarely in the mainstream of security industry opinion on that.

Re: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

#10

Post by glenjamin » Mon, Jul 08, 2019, 9:05 PM UTC

tptacek wrote: post #9

cortesoft wrote: post #7

Earlier quoted context omitted.

For anything?

I like Signal Science just as a product in general, and have used it to accomplish a variety of security tasks for clients. I am not sold on the core promise of WAF/RASP, where you front an insecure application with a middlebox that resolves security problems for you, and I think I'm squarely in the mainstream of security industry opinion on that.

In a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense.

In the situation I hope many people are in, where they have a production application they own that they can quicky continuously deploy to - what's the WAF for?