How to Block OWASP Top 10 Attacks (Without Breaking Legitimate Traffic)

Description and use

Aegis uses cumulative anomaly scoring to block real OWASP attacks while reducing false positives, allowing legitimate traffic to pass.

Problem

Developers often disable WAFs due to false positives that block legitimate traffic such as normal text with quotes or HTML snippets.

Outcome

Aegis with cumulative anomaly scoring blocks real OWASP Top 10 attacks while dramatically reducing false positives, allowing legitimate traffic to pass.

Workflow

• Open Aegis Admin Console at http://localhost:8081
• Navigate to WAF Core > CRS Settings and select a Paranoia Level
• Test SQLi defense by sending curl "http://localhost:8080/?id=1' OR 1=1--" and verify 403 with X-WAF-Rule-ID 942100
• Test XSS defense by sending curl -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>" and verify 403 with X-WAF-Rule-ID 941100
• If a legitimate request is blocked, view the Threat Inspection Log to find the Rule ID, then add an exclusion in WAF Core > Exclusions & Whitelists scoped to the specific URL path, which applies immediately without restart

Evidence

Instead of hard-blocking on a single regex match, Aegis evaluates incoming requests across multiple detection vectors

Source

Send an attack signature in the query string to verify that the WAF intercepts it: curl -i "http://localhost:8080/?id=1%27%20OR%201=1--"

Source

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 942100 Access denied: This request was rejected by the application security layer.

Source

Send a reflected script tag in a POST body: curl -i -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>"

Source

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 941100

Source