WAFCheck: uma ferramenta para auxiliar na avaliação de Web Application Firewalls (WAFs)

Abstract

Security breaches in web systems are dangerous and recurring. Statistics indicate that up to 90% of applications on the Internet may have software vulnerabilities. Ensuring the security of these online systems is crucial and can help prevent financial loss and data leakage. This issue deserves special attention with the enforcement of laws such as the General Data Protection Law (LGPD). However, protecting online applications is not an easy task. Studies indicate that software development frameworks can help protect systems against attacks exploring up to 60% of the most frequent vulnerabilities on the web. Similarly, statistics also suggest that a Web Application Firewall (WAF) can contribute to mitigating the exploitation of more than 70% of vulnerabilities in web systems. In this work, we propose the WAFCheck tool to assist in the latency, load, and accuracy detection tests for WAFs. The tool allows the insertion and evaluation of different sets of payloads, which are used to exploit vulnerabilities in web systems. Using WAFCheck and payloads of the ten most recurring vulnerabilities according to OWASP, we evaluated four free WAFs, namely, ModSecurity, Naxsi, ShadowD, and xWAF. Our findings suggest that free WAFs, in standard configuration, achieve a nearly 70% detection rate. However, a large number of active rules in the WAF can greatly impact (e.g., increase by more than 2685%) the latency of requests to web systems.