Introduction of WebWall
Traditional security infrastructure technologies such
as network firewalls, deep inspection firewalls and intrusion prevention
systems do not protect against the most serious attacks threatening
application data centers today. Firewalls are designed to allow traffic
intended for the web server to flow through to its destination with
minimal scrutiny. IDS solutions detect and block attacks based on known
attack signatures, yet are helpless in the face of new web-specific
attacks.
Feebe WebWall, a Web Application Firewall, is a new class of software
that protects applications from hackers and other malicious attacks.
It enforces granular security policies to protect web applications as
well as confidential information from both random and targeted application
security attacks. Feebe WebWall is based on a positive security model
that ensures correct application behavior. Because it understands good
application behavior, the positive security model does not require attack
signatures or pattern matching techniques to detect and block attacks,
Feebe WebWall is able to filter all application requests and deny anything
that is not legitimate user activity. On the other hand, Feebe WebWall
support negative security mode that can filtering known attack including
SQL injection, Buffer overflow attacks, worms and so on.
System requirements
Microsoft Windows 98/NT/2000/XP/2003 Operation System
Hardware should run those operation system
10MB free disk space for install Feebe WebWall
Enough free disk space for store Feebe WebWall
image file
Attack defend
Feebe WebWall application firewall employ a positive
security model to protect against attacks exploiting any application
vulnerabilities including:
Buffer Overflow Exploits: A common type
of input validation attack that overflows a buffer with excessive
data. Successfully executed, the hacker can run a remote shell on
the machine and gain the same system privileges granted to the application
being attacked.
CGI-BIN Parameter Manipulation: An input
validation attack that illegally modifies data that is passed to a
server-side script. Without proper validation of query parameters
passed to CGI scripts, a hacker can gain unauthorized system privileges
allowing him to modify files, run commands, and execute other operations.
Form/Hidden Field Manipulation: Modifying
the contents of a hidden field in an attempt to trick the application
into accepting invalid data.
Forceful Browsing(Knows as Google Hacking):
Access of unauthorized and unadvertised URLs to gain access to the
root directory of a web server, or other areas which should be off
limits.
Cookie/Session Poisoning: Reverse engineering
weak cookies to steal a user's session or impersonate a legitimate
user of an application.
Broken ACLs/Weak Passwords: Circumventing
an application's access control system by requesting resources for
which the user should not have access.
Cross-Site Scripting (XSS): Attacking
the trust relationship between a user and a web application. Tricking
the user or the user's browser into sending an attacker confidential
information that can be used to steal that user's identity.
Command Injection: Cleverly inserting
system commands in program variables like form fields that get inadvertently
executed on the server.
SQL Injection: An input validation attack
that sends SQL commands to a web application, which are then passed
to a back-end database. Successfully executed, the hacker can gain
access to a sensitive information store.
Error Triggering Sensitive Information Leaks:
Feeding malformed, illegitimate data to an application with the goal
of generating errors and gaining sensitive information about the application
environment.
Server Misconfiguration: Exploiting server
misconfigurations, including the failure to fully lock down or harden
the web server, disable default accounts and services, or remove unnecessary
functionality.
Back Doors and Debug Options: Exploiting
application back doors or debug code on production systems.
Web Site Defacement: Malicious modification
of web pages.
Buffer Overflow: Buffer Overflow is an
attack that overruns the memory allocated to interpret a given parameter
in an application. This can result in a core dump, which reveals information
about the memory of the Web Server (previous transaction, SSL private
key information, Database information and so on).
Well-known Platform Vulnerabilities:
Exploiting unpatched vulnerabilities of web servers or operating systems
to gain unauthorized access to an application.
|
