Yeah, I guess the way I would envision it going would be:
1) web app scanner sees XSS vuln on /path/to/foo.php
2) my integration ties that web app scan into a format to pass to WAF
3) WAF sets up anti-xss rules on /path/to/foo.php (we had to actually
create a static mapping for this step)
4) measure how many hits the waf blocks to that endpoint for the XSS
John
On Mon, Jul 13, 2020 at 10:46 AM Rafal Los <Rafal(a)ishackingyou.com> wrote:
**** CAUTION: This email was sent from an EXTERNAL
source. Think before
clicking links or opening attachments. ****
------------------------------
John,
Can you expand on #2? How do you measure the number of attacks stifled?
_
*-- **Rafal*
*_Mobile:*
* (404) 606-6056 **_Email**: Rafal.Los(a)Seventy7.Consulting
<Rafal.Los(a)Seventy7.Consulting>*
*From: *John Lampe via Dailydave <dailydave(a)lists.aitelfoundation.org>
*Reply-To: *John Lampe <jlampe(a)tenable.com>
*Date: *Saturday, July 11, 2020 at 9:52 PM
*To: *Dave Aitel <dave.aitel(a)gmail.com>
*Cc: *"dailydave(a)lists.aitelfoundation.org" <
dailydave(a)lists.aitelfoundation.org>
*Subject: *[Dailydave] Re: [EXTERNAL] WAF Metrics
So, I recently did an integration for a company that took their web app
scanner results and mapped those to existing WAF rules. I can think of 2
metrics based off that
1) How many real-world vulns have a corresponding check in the WAF? and
2) Once the WAF rules have been put in place to protect
actually-vulnerable endpoints, how many attacks were actually stifled?
John
On Sat, Jul 11, 2020 at 12:51 PM Dave Aitel via Dailydave <
dailydave(a)lists.aitelfoundation.org> wrote:
*** CAUTION: This email was sent from an EXTERNAL source. Think before
clicking links or opening attachments. ***
------------------------------
So I'm making a video on metrics, of all things, and I wanted to post both this
question <https://twitter.com/daveaitel/status/1281629327776522242?s=20>and
the best answer so far to the list to see if anyone had any other ideas or
followups.
-dave
_______________________________________________
Dailydave mailing list -- dailydave(a)lists.aitelfoundation.org
To unsubscribe send an email to dailydave-leave(a)lists.aitelfoundation.org