How to Block OWASP Top 10 Attacks (Without Breaking Legitimate Traffic)

Описание и применение

Aegis использует накопительный подсчёт аномалий для блокировки реальных OWASP‑атак, уменьшая ложные срабатывания и позволяя легитимный трафик проходить.

Задача

Developers often disable WAFs due to false positives that block legitimate traffic such as normal text with quotes or HTML snippets.

Результат

Aegis with cumulative anomaly scoring blocks real OWASP Top 10 attacks while dramatically reducing false positives, allowing legitimate traffic to pass.

Рабочий процесс

• Open Aegis Admin Console at http://localhost:8081
• Navigate to WAF Core > CRS Settings and select a Paranoia Level
• Test SQLi defense by sending curl "http://localhost:8080/?id=1' OR 1=1--" and verify 403 with X-WAF-Rule-ID 942100
• Test XSS defense by sending curl -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>" and verify 403 with X-WAF-Rule-ID 941100
• If a legitimate request is blocked, view the Threat Inspection Log to find the Rule ID, then add an exclusion in WAF Core > Exclusions & Whitelists scoped to the specific URL path, which applies immediately without restart

Доказательства

Instead of hard-blocking on a single regex match, Aegis evaluates incoming requests across multiple detection vectors

Источник

Send an attack signature in the query string to verify that the WAF intercepts it: curl -i "http://localhost:8080/?id=1%27%20OR%201=1--"

Источник

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 942100 Access denied: This request was rejected by the application security layer.

Источник

Send a reflected script tag in a POST body: curl -i -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>"

Источник

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 941100

Источник