The Wide World of WAF's

Architecture and Background

DEF CON 16 - Ben Feinstein: The Wide World of WAF's With webapp protection now mandated by the PCI standard, web-application firewalls (WAFs) have received newfound interest from both consumers of security technologies, as well as from security researchers and potential attackers. Now that WAFs are a PCI-approved substitute for code reviews, expect many vendors to opt for this potentially less costly route to compliance. Of course, security researchers and potential attacks will increasingly train their sights on this lucrative and expanding target. This talk will explore the ModSecurity Apache module and how it is being used as a WAF to meet the PCI 6.6 webapp protection requirement.

Vulnerability Analysis

The relative strengths and weaknesses of WAFs in general and ModSecurity in particular will be highlighted. Common deployment scenarios will be discussed, including both in-the-cloud, stand-alone and Apache server embedded deployments. The ModSecurity rules language will be covered and several ModSecurity Core Rules that are representative of its capabilities will be dissected in depth. Finally, some interesting uses of ModSecurity's content injection capabilities will be discussed.

Exploitation and Demonstrations

Anyone up for hacking the hacker via scripting injected into your webapp's response to an attempted attack? This talk will show you how! Ben Feinstein is a researcher on the Counter Threat Unit (CTU) at SecureWorks, working behind the scenes to support Agent Jack Bauer and the GWOT. He first became involved with information security in 2000 while working on a DARPA / USAF contract instead of going to his college classes.

Remediation and Defensive Strategies

Since then, Ben has worked designing and implementing security-related software and appliances at a series of since acquired or failed start-ups. In his spare time Ben authored RFC 4765 and RFC 4767. His experience is in the areas of IDS/IPS, digital forensics, next-gen firewall systems, log analysis and viz, secure messaging, security appliances, small caliber arms and right-wing rhetoric. Ben has presented at Black Hat USA, DEFCON, ACSAC and others. For copies of the slides and additional materials please see the DEF CON 16 Archive here: