Comments:"Untitled"
URL:http://www.scribd.com/vacuum?url=http://zeroscience.mk/files/wafreport2013.pdf
2
Summary
This document contains the results of a comparative penetration test conducted by a team of security specialists at ZeroScience Lab against three
‘leading’ web application firewall solutions. Our goal was to bypass security controls in place
,in any way we can, circumventing whatever filters they have. This report also outlines the setup and configurationprocess, as well as a detailed security assessment.
Zero Science Lab
CloudFlare$200/month ModSecurityFree Incapsula$59/month
Total SQL Injection Tests
54 54 54
SQL Injection Bypassed
54 0 1
SQL Injection Blocked
0 54 53
Total XSS Tests
46 46 46
XSS Bypassed
46 0 3
XSS Blocked
0 46 43
Total LFI/RFI Tests
23 23 23
LFI/RFI Bypassed
23 2 4
LFI/RFI Blocked
0 21 19
From the results table, we can see that ModSecurity has the highest block ratio for known vulnerabilities and attacks.CloudFlare blocked zero attacks when we attacked our website behind its proxies. Incapsula is more sophisticated in anoverall protecting and reporting capability, where we noticed zero false positives and much more control in securingyour web.On the other hand, mod_security, due to its design and working mechanism, showed more aggressive behavior andtherefore presented quite high number of false positives.