Quantcast
Channel: Hacker News 50
Viewing all articles
Browse latest Browse all 9433

Untitled

$
0
0

Comments:"Untitled"

URL:http://www.scribd.com/vacuum?url=http://zeroscience.mk/files/wafreport2013.pdf


 

2

Summary 

This document contains the results of a comparative penetration test conducted by a team of security specialists at ZeroScience Lab against three

‘leading’ web application firewall solutions. Our goal was to bypass security controls in place

,in any way we can, circumventing whatever filters they have. This report also outlines the setup and configurationprocess, as well as a detailed security assessment.

Zero Science Lab

is a Macedonian Information Security Research and Development laboratory that specializes ininformation security hardening, consulting, network security, vulnerability research, software and hardware assessment,penetration testing, forensics and much more - http://www.zeroscience.mk We've chosen to test three Web Application Firewall services offered by three different vendors including TrustwaveSpiderLabs ModSecurity, CloudFlare and Incapsula.Given that ModSecurity is free, we signed up for both CloudFlare and Incapsula paid Business plan. They havenoticeably different prices for their paid plans. CloudFlare Business Plan is $200/month (the WAF is also available in thePro Plan, for $20/month). Incapsula Business Plan is $59/month.Blackbox penetration test was conducted against the three services, applying known filter evasion techniques to bypasstheir web application firewall solution using real-life scenarios and variety of attacking vectors.The table below shows the overall statistics of the testing:
 

CloudFlare$200/month ModSecurityFree Incapsula$59/month 

Total SQL Injection Tests

54 54 54

SQL Injection Bypassed 

54 0 1

SQL Injection Blocked 

0 54 53

Total XSS Tests

46 46 46

XSS Bypassed 

46 0 3

XSS Blocked 

0 46 43

Total LFI/RFI Tests

23 23 23

LFI/RFI Bypassed 

23 2 4

LFI/RFI Blocked 

0 21 19

From the results table, we can see that ModSecurity has the highest block ratio for known vulnerabilities and attacks.CloudFlare blocked zero attacks when we attacked our website behind its proxies. Incapsula is more sophisticated in anoverall protecting and reporting capability, where we noticed zero false positives and much more control in securingyour web.On the other hand, mod_security, due to its design and working mechanism, showed more aggressive behavior andtherefore presented quite high number of false positives.


Viewing all articles
Browse latest Browse all 9433

Trending Articles