Abstract

Web applications are used to deploy services and products over the internet for easy accessibility. As a result, they have been a constant target for malicious actors to exfiltrate sensitive data leading to service distribution and financial loss. Web Application Firewall (WAF) has been a helpful tool in providing web applications with much-needed security. Nevertheless, attacks targeted against this insulated web application are still successful.

This MSc research investigates the factor that could be responsible for the reliability of WAF as a protection tool, illustrate the effectiveness of Application-level authentication to mitigate against WAF bypass, and also analyses the performance impact of WAF using Apache Bench, Jmeter, and Gatling.

The result from experiments shows that the configuration of the web server is a primary factor affecting the efficacy of WAF. Furthermore, the analysis reveals that WAF requests connection time increases as the number of concurrent users although the request transfer rate reduces which validates the advantages of the edge server used by most Cloud-based providers. Additionally, this study implements a proposed WAF-VERIFIER to mitigate against WAF bypass as illustrated in this study. It leverages the IP Whitelist approach and WAF footprints to inspect and ensure incoming request is proxied through WAF as intended.

The results show web application security was enhanced as the WAF-VERIFIER rejects bypassed requests. Scanning tools were also used to carry out web application vulnerability assessment and the results were mapped with OWASP's Top 10 most critical security risks. The results show that 85% of issues reported in the target system belong to the OWASP Top 10 even though these issues were categorised as Low or Info severity. Hence, this study recommends web application severity should be treated with the same precedence. WAF should be used as secondary protection layer with the primary protection implemented during the web application development and hardening of the web server, making the application more resilient.

Website Vulnerabilities and Web Application Firewall Protection Mechanism