News for hackers. Stuff that matters.

A comment on Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF. Parent comment

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by nullwasamistake on Monday July 08, 2019 @05:19PM (#20386864)
Yes. Needing any of these to secure your application means the app code is broken.

Every WAF I've used breaks URL's randomly because they're just pattern matching against known attacks to a definitely broken system.

Any properly engineered system is invulnerable to all attacks a WAF would catch at the HTTP level

[ Parent | on HN ]
Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by cwojno on Monday July 08, 2019 @07:54PM (#20387839)
I also suspect this to be the case. However, the reason you get a WAF is because you either want a security blanket or don't have the resources to implement the service in a "good" or... even: "decent" language ;).
[ Parent | on HN ]