Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by tptacek on Monday July 08, 2019 @05:01PM (#20386725)

I like Signal Science just as a product in general, and have used it to accomplish a variety of security tasks for clients. I am not sold on the core promise of WAF/RASP, where you front an insecure application with a middlebox that resolves security problems for you, and I think I'm squarely in the mainstream of security industry opinion on that.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by glenjamin on Monday July 08, 2019 @05:05PM (#20386747)

In a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense.

In the situation I hope many people are in, where they have a production application they own that they can quicky continuously deploy to - what's the WAF for?

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by ownagefool on Monday July 08, 2019 @05:14PM (#20386822)

There's a concept that you should use several products in highly secure environments.

For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like https://github.com/nbs-system/naxsi. The way, neither just a PHP bug nor a lua bug should defeat you.

In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation.

But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by tptacek on Monday July 08, 2019 @05:18PM (#20386859)

This is usually a better way to get multiple single points of failure than it is to get a more resilient system.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by ownagefool on Monday July 08, 2019 @05:25PM (#20386912)

True @tptacek, but we're talking about systems where you'd rather the system fail closed than leak anything. Not something one would really normally consider for their uber for hedgehogs app.

Personally, I'm not really a big fan of the baseline for the guidence being behind closed doors, I prefer to be able to read said validation, but the guidence does exist and is parroted around the industry occasionally.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by pvg on Monday July 08, 2019 @08:41PM (#20388036)

You can click on the timestamp of a comment and reply to it there so you don't have to @ people like a barbarian.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by posix_me_less on Tuesday July 09, 2019 @11:13AM (#20392556)

You can give the usability information about this website without calling a group of people barbarians.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by pvg on Tuesday July 09, 2019 @11:20AM (#20392636)

I jokingly compared a single person to a barbarian without calling anyone a barbarian, like a barbarian.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by arpa on Wednesday July 10, 2019 @12:25AM (#20399143)

Then again, we are in discussion regarding PHP, so someone's bound to point out we're a bunch of neanthardal barbarians just because of that. So it could have been just a kneejerk reaction.

[ Parent | on HN ]