Hacker News Reader

Comment by threeseed | Hacker News Reader

> assuming the attacker bothers to spend five minutes bypassing them with one of a thousand well-known tricks

I didn't realise AWS, Cloudflare etc were so incompetent that their product can be bypassed in 5 minutes. I assume you have an example of this.

View on HN

It's not about competency but the fundamental nature of WAFs. It's like using a regular expression to sanitize input parameters you concatenate into a SQL query, except you also can't make it specific to the SQL dialect used. It doesn't matter how competent you are or how much money you spend on engineering the regular expression.

In my day, I've bypassed all kinds of expensive fancy security products in five minutes.

This guide, linked from the article, shows some simple evergreen bypass techniques (section "WAF bypass cheat sheet"):

https://habr.com/en/companies/dsec/articles/454592/

Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article.

Maybe you should read it.

I read it and it's a design decision documented here:

https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov...

For oversize requests WAF can be configured to reject it.

Two observations:

8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough.

Continuing, not blocking, is the default when not using the console, making this insecure by default.

You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks.

And having an insecure default is a huge difference from 100% of requests are allowed.

Will it though? Maybe you should test it.

Reply on news.ycombinator.com