Last year, we released Nemesida WAF Free — a dynamic module for NGINX that blocks attacks on web applications. Unlike the commercial version, which is based on machine learning, the free version analyzes requests only by signature method.
Features of the Nemesida WAF 4.0.129 release
Until the current release, the Nemesida WAF dynamic module supported only Nginx Stable 1.12, 1.14, and 1.16. The new release adds support for Nginx Mainline, starting from 1.17, and Nginx Plus, starting from 1.15.10 (R18).
Why make another WAF?
NAXSI and mod_security are probably the most popular free WAF modules, with mod_security being actively promoted by Nginx, although it was originally used only in Apache2. Both solutions are free, open-source, and have many users worldwide. For mod_security, there are free and commercial signature sets available for $500 a year, while NAXSI offers a free 'out of the box' signature set, and additional rule sets can be found, such as doxsi.
This year, we conducted a test comparing NAXSI and Nemesida WAF Free. To summarize the results:
- NAXSI does not perform double URL-decode in cookies
- NAXSI is very difficult to configure — by default, the default rule settings will block most requests when working with a web application (authorization, editing profiles or materials, participating in surveys, etc.), and it is necessary to generate exception lists, which negatively impacts security. In contrast, Nemesida WAF Free did not produce a single false positive with default settings while working on the site.
- the number of attack bypasses with NAXSI is significantly higher, etc.
Despite its drawbacks, NAXSI and mod_security have at least two advantages — open source and a large user base. We support the idea of open-sourcing, but we are unable to do so at this time due to potential issues with 'piracy' of the commercial version; however, to compensate for this drawback, we fully disclose the content of the signature set. We value privacy and offer you to verify this yourself through a proxy.server.
Features of Nemesida WAF Free:
- a high-quality signature base with a minimal number of False Positives and False Negatives.
- installation and updates from the repository (it's fast and convenient);
- simple and clear incident events, not a 'mess' like in NAXSI;
- completely free, with no limits on traffic, virtual hosts, etc.
In conclusion, here are several requests to assess the WAF performance (recommended for use in each area: URL, ARGS, Headers & Body):
')) un","ion se","lect 1,2,3,4,5,6,7,8,9,0,11#"]
')) union/**/select/**/1/**/2/**/3/**/4/**/5/**/6/**/7/**/8/**/9/**/'some_text',/**/11#"]
union(select(1),2,3,4,5,6,7,8,9,0x70656e746573746974,11)#"]
')) union+/*!select*/ (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"]
')) /*!uion*/ /*!seect*/ (1),(2),(3),(4),(5),(6),(7),(8),(9.),(0x70656e746573746974),(11)#"]
')) **union**select (1),(2),(3),(4),(5),(6),(7),(8),(9),(0x70656e746573746974),(11)#"]
1807182982union
select123456789%2some_text11
cat /et?/pa?swd
cat /et'c/pa'ss'wd
cat /et*/pa**wd
e'c'ho 'swd test pentest' |awk '{print "cat /etc/pas"$1}' |bas'h
cat /etc/passwd
cat$u+/etc$u/passwd$u
<svg/onload=alert()//
If the requests are not blocked, it is likely that the WAF will also allow a real attack. Before using the examples, make sure that the WAF does not block legitimate requests.
Source: habr.com
