‎I suppose I'm stating the obvious, but if you are going to implement blocking schemes with either simple map matches or a full blown WAP like Naxsi, you will need a test suite. For a very simple website, you can just crawl it with wget and see what you broke. But if you have forms, databases, etc. you probably will have to resort to Selenium. And that just checks if you broke something, not if you stopped some exploit. 

There are enough Web testing companies that you can get an occasional demo. I used tinfoilsecurity.com and it found one mistake. Besides dotdotpwn, I don't know of any free exploit testers. Maybe the list can suggest a few.


  Original Message  
From: mex
Sent: Sunday, May 21, 2017 2:25 AM
To: nginx@nginx.org
Reply To: nginx@nginx.org
Subject: Re: WordPress pingback mitigation

pbooth Wrote:
-------------------------------------------------------
> Wow- I really like the sound of naxsi. In the past I've used F5's ASM,
> the WAF built on their big-ip platform. It was powerful though prone
> to false positives. I don't believe there are any real shortcuts that
> allow you to build an effective waf without understanding the details
> of your own website. These simply aren't build, deploy and forget
> devices. It sounds a if the creator of naxsi understands this.
>


hi,

naxsi-ssupporter and doxi-rules-maintainer here.

FPs are an issue for any blocking-mechanism.
what many people dont know: naxsi has an integrated whitelist-generator,
allowing you to tune your WAF against your own application. for people with
staging/deployment - envoriments you can run anxsi there in learning-mode,
generating all whitelists needed on-the-fly and deploying them during your
regular deployments.

maybe overdosed for smaller setups, but fitting perfectly into
bigger setups.


and yes, naxsi needs more documentation an beginner-based manuals.
maybe thios helps to understand the rules (and needs an update as well:)
https://zero.bs/naxis-rules-manual.html


regards,


mex

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,274339,274358#msg-274358

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx