If your organization has a web application, it’s a fair bet that it will suffer an attack sooner or later.
Anything on the web is fair game to attackers looking to scrape your information, steal your data, or gain access to your network.
To prevent unauthorized access, many organizations implement WAF (web application firewall) solutions.
While these solutions can be highly effective, attackers are becoming increasingly good at WAF evasion.
While there are ways to combat this, WAF evasion is an increasingly common problem for organizations.
What is WAF evasion?
With the advent of AI, attackers are improving their ability to create sophisticated bots, detect vulnerabilities in web applications, and evade attack detection by security systems.
However, not all of their advancements come from AI.
Security tools like WAFs rely on rules, as they always have, but they are increasingly using behavioral analysis to identify potential threats.
To get around this, attackers are treading more carefully when they make requests.
When they carefully craft requests to mimic the typical behavior of a user, they can more effectively evade the protections and rules built into WAFs.
For example, increasing the amount of time on a page or navigating an application in a logical pattern can resemble typical activity enough to bypass a WAF.
Evasion is even easier with less sophisticated WAFs. Some attackers can work around the firewall by making multiple requests containing pieces of code to be injected.
Others may tweak formatting or URL capitalization. Many WAF rules will also contain loopholes, and with enough studying, an attacker can exploit those loopholes.
Once past the WAF, the attacker can exploit the vulnerabilities in the underlying web app.
It’s nearly impossible to patch every vulnerability that pops up after development, so there are plenty of potential attack vectors available to the attacker.
Additionally, if your app is built on open-source code, the attacker may know its weaknesses better than you do.
How WAF evasion works
There are several common WAF evasion techniques that allow attackers to slip through undetected.
Some of these include:
- Directory traversal: When an application or website is set up incorrectly, it is possible for an attacker to view files that are not intended to be accessible. This allows the attacker to view files and data on the server that are typically sensitive or intended for back-end use.
- Wildcard obfuscation: By including special characters in queries, this technique prevents the WAF from recognizing a malicious payload. For example, an underscore typical to a particular SQL attack might be replaced with an asterisk or question mark.
- Case toggling: Another way to camouflage malicious payloads is by changing the case of the letters to make the code or URL less recognizable.
- URL encoding: By converting a code string into a URL format, an attacker can slip past the WAF, which typically does not filter out things that look like legitimate web addresses.
This is not a comprehensive list, but each WAF evasion technique follows a similar pattern.
By exploiting the predetermined rules and recognized patterns, an attacker can sneak past your WAF.
Most of the time, these attackers are looking to either establish a presence within your application or to exfiltrate data, so their goal will be to stay undetected as long as possible.
Unlike a ransomware attack, for example, attackers who are evading WAFs will not likely demand money from you directly. Their goals are often more long-term.
If the attacker can worm his way into your application and set up a way to receive sensitive data or consumer information, that is a more desirable outcome (for the attacker) than destroying your application or holding your data for ransom (in most cases).
In some cases, the attacker is one of your competitors.
Whether that person is interested in collecting all of your prices (probably via web scraping) or your trade secrets, he is unlikely to leave you alone after the first infiltration.
Once an attacker gets into your application for either of these reasons, any data you generate is another reason to stay.
Protecting against WAF evasion
None of these are good outcomes, so it’s important to ensure that you are using a WAF that can adapt to these types of evasions.
Using modern WAFs that have a higher probability of identifying and blocking these attacks will increase your odds of keeping your application and data secure.
When searching for a WAF solution, consider one that leverages AI and machine learning to adapt to new activity patterns in real time.
Although some attackers are learning to better imitate real, legitimate users, behavioral analysis is still an important component of an effective WAF.
However, because even the best WAF won’t catch every attacker, consider implementing an in-depth, application-level defense with RASP (runtime application self-protection).
By monitoring application activity and stopping executions that do not match appropriate or typical use, RASP augments WAF and can catch attacks that WAF misses.
Although attackers are learning to be subtle to evade detection, a modern, AI-driven WAF combined with RASP is a highly effective defense in most cases.
Traditional WAFs struggle to detect novel malicious activity patterns, but modern WAFs have a greater capacity to identify attack signatures rather than known patterns.
RASP then fills in the gaps within the application, keeping your data secure, your application safe, and attackers away from your infrastructure.