On: Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

[simlevesque]

WAF has it's purpose but it's clearly not a silver bullet. Nothing is.

[nullwasamistake → simlevesque]

WAF is brittle and breaks more than it fixes IMO. It's just regex against URL's in 99% of cases. If you think you need one, you need to fix the app code, there will be more vulnerabilities it doesn't block

[simlevesque → nullwasamistake]

WAF provides a lot of other things, such as IP based filtering.

[DJBunnies → simlevesque]

If it's so easily circumvented I wonder if it's worth the costs.