How to Block OWASP Top 10 Attacks (Without Breaking Legitimate Traffic)

说明与用途

Aegis 通过累积异常评分来阻止真实的 OWASP 攻击，减少误报，使合法流量通过。

问题

Developers often disable WAFs due to false positives that block legitimate traffic such as normal text with quotes or HTML snippets.

结果

Aegis with cumulative anomaly scoring blocks real OWASP Top 10 attacks while dramatically reducing false positives, allowing legitimate traffic to pass.

工作流

• Open Aegis Admin Console at http://localhost:8081
• Navigate to WAF Core > CRS Settings and select a Paranoia Level
• Test SQLi defense by sending curl "http://localhost:8080/?id=1' OR 1=1--" and verify 403 with X-WAF-Rule-ID 942100
• Test XSS defense by sending curl -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>" and verify 403 with X-WAF-Rule-ID 941100
• If a legitimate request is blocked, view the Threat Inspection Log to find the Rule ID, then add an exclusion in WAF Core > Exclusions & Whitelists scoped to the specific URL path, which applies immediately without restart

证据

Instead of hard-blocking on a single regex match, Aegis evaluates incoming requests across multiple detection vectors

来源

Send an attack signature in the query string to verify that the WAF intercepts it: curl -i "http://localhost:8080/?id=1%27%20OR%201=1--"

来源

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 942100 Access denied: This request was rejected by the application security layer.

来源

Send a reflected script tag in a POST body: curl -i -X POST http://localhost:8080/submit -H "Content-Type: application/x-www-form-urlencoded" -d "comment=<script>alert('xss')</script>"

来源

Response: HTTP/1.1 403 Forbidden X-WAF-Rule-ID: 941100

来源