RESEARCH ON WEB APPLICATION FIREWALL BYPASS MECHANISMS

Abstract

The growing dependence of modern organizations on web applications has led to a significant increase in the number of cyberattacks aimed at disrupting their functionality, compromising data, or gaining unauthorized access to resources. Attackers actively exploit vulnerabilities in web applications to steal confidential information, manipulate databases, and undermine the integrity of services. In response to these threats, Web Application Firewalls (WAF) have become essential security elements, serving to filter and control traffic between web applications and the Internet. Traditional WAFs, which rely on signature-based detection, are effective against known threats but struggle to identify new types of network attacks, particularly zero-day attacks. To overcome these limitations, anomaly-based detection methods have emerged, allowing for the assessment of deviations in request behavior from the norm. Currently, WAFs that combine signature and anomaly detection methods are widely implemented, utilizing machine learning algorithms to adapt to new threats. Furthermore, WAFs incorporate Data Loss Prevention (DLP) methods to protect confidential information. To evaluate the effectiveness of WAFs, this study analyzes the impact of various attack types on web systems, including cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF). It also examines the main methods for bypassing WAFs. An experiment was conducted using a virtual machine with a web application designed for cybersecurity training and testing (DVWA), focusing on WAF bypass techniques with SQL Injection, XSS, and CSRF attacks. Malicious commands in the form of requests with pattern characters were used, which, even under correctly configured filtering rules, can prove to be an effective means of bypassing WAFs. To protect web applications from malicious requests, testing was conducted based on the ModSecurity firewall with policy levels PL1–3. Given that SQL injection attacks remain a serious threat, this research aims to study existing protection mechanisms, identify vulnerabilities, and provide recommendations for future improvements in this area.