News for hackers. Stuff that matters.

A comment on Stop deploying web application firewalls. Parent comment

Re:Stop deploying web application firewalls by verve_rat on Monday November 13, 2023 @05:12PM (#38256091)
Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article.

Maybe you should read it.

[ Parent | on HN ]
Re:Stop deploying web application firewalls by woleium on Monday November 13, 2023 @05:36PM (#38256329)
Will it though? Maybe you should test it.
[ Parent | on HN ]
Re:Stop deploying web application firewalls by threeseed on Monday November 13, 2023 @06:16PM (#38256676)
I read it and it's a design decision documented here:

https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov...

For oversize requests WAF can be configured to reject it.

[ Parent | on HN ]
Re:Stop deploying web application firewalls by diarrhea on Monday November 13, 2023 @06:31PM (#38256804)
Two observations:

8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough.

Continuing, not blocking, is the default when not using the console, making this insecure by default.

[ Parent | on HN ]
Re:Stop deploying web application firewalls by threeseed on Monday November 13, 2023 @07:47PM (#38257387)
You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks.

And having an insecure default is a huge difference from 100% of requests are allowed.

[ Parent | on HN ]