The Three Main Components: the planes
The Three Main Components Every WAF consists of three primary modules that work together and compose the WAF products or service: the planes Data Plane (Data Path) The Data Plane…
Normalization Techniques Checklist- Base
Normalization is the preprocessing step performed by Web Application Firewalls (WAFs) to decode and transform incoming HTTP requests before applying security logic like signature inspection or rule-based checks. Attackers often…
Unified Exploit Classification Matrix
Entity AV Type Risk Detection Type Example Param Value SQLi Specific Signature id=1' or '1'='1 matches CVE signature Header Value RFI General Meta Characters User-Agent: php://input with path traversal marker…
Entities (E1–E4)
Code Name Focus Used In E1 Request Input Entities User input, payload Signatures, Restrictions E2 Source & Frequency IP, Geo, Sessions, RPS Anomalies, Rate Limiting E3 Protocol & RFC Behavior…
Signature Testing – Web Exploit Sub-Classification
WAFScan tests your WAF’s ability to detect and respond to a wide range of signature-based web exploits, each classified by their specificity, purpose, and detection scope. These are divided into…
Signature / Attack signature / Pattern matching
Pattern matching is a fundamental concept in computer science involving checking a sequence of tokens or data against a defined pattern, and potentially extracting data from it. It’s a more…
D1. Signatures – Exploit Detection Based on Patterns and Payloads
D1. Signatures – Exploit Detection Based on Patterns and Payloads ID Name Description / Sub-elements S1 RCE AV Remote Command Execution detection via signature matching. S2 SQLi SQL Injection detection.…
Understanding WAF Scoring & Security Exposure
What is WAF Scoring? To truly understand your web application’s defense posture, you need to evaluate the WAF itself — not just the app. WAF scoring does exactly that. WAF…
Web Exploits (CAV – Common Attack Vectors)
Injection Attacks SQL Injection (SQLi) OS Command Injection (RCE) XML External Entity (XXE) Server-Side Template Injection (SSTI) LDAP Injection Expression Language Injection (EL Injection) Cross-Site Attacks Cross-Site Scripting (XSS) –…
WAF Scanning Strategy – Finding the Right Balance
Before diving into scan frequency or cost, it’s important to understand the strategic role of WAF scanning.Scanning is about validating the actual protection level of your WAF. Too little scanning…