News for hackers. Stuff that matters.

A comment on Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF. Parent comment

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by aventrix on Monday July 08, 2019 @03:49PM (#20386117)
Disagree. This just reinforces the point that best security is multi-layered.
[ Parent | on HN ]
Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by tptacek on Monday July 08, 2019 @05:13PM (#20386814)
That's an apology every crappy security add-on has always made. We shouldn't be happy about applying layer after layer of faulty controls, let alone applauding that as some kind of defense-in-depth best practice.
[ Parent | on HN ]
Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by nullwasamistake on Monday July 08, 2019 @05:32PM (#20386966)
WAF are basically all HTTP proxies. If you app has a non-broken HTTP implementation they're useless.
[ Parent | on HN ]
Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by sytringy05 on Monday July 08, 2019 @06:11PM (#20387268)
yup, WAFs, IDS and IPS prevent protocol abuse. Everything else is the development teams problem
[ Parent | on HN ]