WAFs FTW! A modern devops approach to security testing your WAF
summary
An open-source test harness called FTW automates quantitative WAF evaluation: tests are written in a readable YAML test format and executed via pytest against OWASP CRS v3 deployments, with results run in CI using Travis-CI. The project ships a corpus of 1000s of attacks, a journaling/log-correlation feature, and a Fastly testbed that translated ModSecurity rules to VCL. Outcomes include ModSecurity regression testing, CI gatekeeping for new rules, and discovery of real issues (case sensitivity, chain-transform reorderings, session-fixation logic).
AI-written summary · about
chapters (19)
- 0:00Intro
- 8:20What is FTW
- 11:10Goals of FTW
- 13:20How we do FTW
- 14:50Real Rule
- 16:55How we use FTW
- 18:08Stop Go Message
- 18:27Core Ruleset
- 18:43Ruleset Tests
- 18:55Commit Tests
- 19:24PowerPoint Presentation
- 19:49Fastly
- 25:49Issues
- 26:30Chaining
- 27:22Bypass
- 28:02Session Fixation
- 29:04Tool Chain
- 29:41Future Steps
- 31:53Additional Resources
related talks
55mAutomating Security Testing with the OWTF
40mWAF Made Easy
27mSecuring Applications and Managing WAFs at a large scale
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
46mIt is rough without a WAF
55mOWASP Coraza: The Way To WAF In 2023
38mWeb Application Firewalls Revisited
14mWeb Application Firewalls: A False Sense of Security?