![Title of Presentation,[object Object],Name,[object Object],Title,[object Object],Company Name,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-1-2048.jpg?cb=1668300661)
![OWASP ESAPI WAF,[object Object],Developed by Arshan Dabirsiaghi (w/ Jeff Williams),[object Object],A sub-project under the ESAPI umbrella,[object Object],The Star Trek: TNG of WAFs,[object Object],Robust,[object Object],Usable,[object Object],Free,[object Object],Open Source,[object Object],Performant,[object Object],Pragmatic,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-2-2048.jpg?cb=1668300661)
![“Yeah, well I hate WAFs”,[object Object],Perfect! Me too.,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-3-2048.jpg?cb=1668300661)
![WAFs were for Federalists (part 1),[object Object],Development Team A,[object Object],Development Team B,[object Object],Security Team,[object Object],Development Team C,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-4-2048.jpg?cb=1668300661)
![WAFs were for Federalists (part 2),[object Object],Development Team A,[object Object],Development Team B,[object Object],Development Team C,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-5-2048.jpg?cb=1668300661)
![Why fix in ESAPI WAF vs. fix in code?,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-6-2048.jpg?cb=1668300661)
![Why fix in ESAPI WAF vs. fix in code?,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-7-2048.jpg?cb=1668300661)
![Advantages of Application-Layer WAFs,[object Object],Performance – only your rules are checked, plus state is already managed by the app server,[object Object],Capability – being closer to the app lets us do more and I can’t wait to tell you about it,[object Object],Process – rules are closer to application owner, shortening discovery-to-patch time, also fix-to-patch-removal time,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-8-2048.jpg?cb=1668300661)
![Principle: Make common tasks easy, uncommon tasks possible,[object Object],Easy!,[object Object],<virtual-patches>,[object Object], <virtual-patch ,[object Object], id=“bugtracker-id-1234" ,[object Object], path="/vulnerable.do" ,[object Object], variable="request.parameters.bar",[object Object],pattern="[0-9a-zA-Z]*" ,[object Object],message="zmg attax" />,[object Object],</virtual-patches>,[object Object],Possible… still easy!,[object Object],<bean-shell-rules>,[object Object], <bean-shell-script ,[object Object], id=“user-lockout-rule" ,[object Object], file=“/enforce_user_lockout.bsh" ,[object Object], stage="before-request-body"/>,[object Object],</bean-shell-rules>,[object Object],import org.acme.user.*;,[object Object],User user = session.getAttribute(“u”);,[object Object],If ( user.isLocked() ),[object Object], action = new RedirectAction();,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-9-2048.jpg?cb=1668300661)
![Fixing Injection Flaws,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-10-2048.jpg?cb=1668300661)
![Business Logic Flaws,[object Object],/viewAccount?id=1826,[object Object],/admin/shutdown,[object Object],/ws/ImptWebService.rest,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-11-2048.jpg?cb=1668300661)
![Adding “Outbound” Security,[object Object],[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-12-2048.jpg?cb=1668300661)
![Set uniform content-type,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-13-2048.jpg?cb=1668300661)
![Meet JForum 2.1.8,[object Object],Awesome, free, fully featured,[object Object],forum software.,[object Object],4 hours of code review/pen testing:,[object Object],10 findings,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-14-2048.jpg?cb=1668300661)
![<virtual-patch/>,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-18-2048.jpg?cb=1668300661)
![<virtual-patch/>,[object Object],<virtual-patch/>,[object Object],<add-http-only-flag>,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-19-2048.jpg?cb=1668300661)
![<virtual-patch/>,[object Object],<add-http-only-flag>,[object Object],<add-header/>,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-20-2048.jpg?cb=1668300661)
![<virtual-patch/>,[object Object],<add-http-only-flag>,[object Object],<add-header/>,[object Object],<bean-shell-rule/>,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-21-2048.jpg?cb=1668300661)
![http://owasp-esapi-java.googlecode.com/svn/trunk_doc/2.0-rc3/index.html,[object Object],JavaDocs,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-22-2048.jpg?cb=1668300661)
![http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20WAF%20Configuration%20Guide.pdf,[object Object],Policy file specification,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-23-2048.jpg?cb=1668300661)
![OWASP ESAPI WAF,[object Object],AVAILABLE NOW!,[object Object],$0,[object Object],Arshan Dabirsiaghi,[object Object],Director of Research, Aspect Security,[object Object],@nahsra, i8<messiah>.com,[object Object],http://www.aspectsecurity.com/,[object Object]](https://image.slidesharecdn.com/owaspesapiwaf-appsecdc2009-091116093010-phpapp02/75/owasp-esapi-waf-appsec-dc-2009-24-2048.jpg?cb=1668300661)
OWASP ESAPI WAF AppSec DC 2009
•2 likes•3,796 views
Report
Share
Download to read offline
A presentation and demo of the ESAPI web application firewall component released at OWASP AppSec DC 2009.
A presentation and demo of the ESAPI web application firewall component released at OWASP AppSec DC 2009.
