Wednesday, 8 August 2012« Understanding XSS (Cross-Site Scripting) Findings in SCA | Main | Blog moved »
In essence, for every piece of data in the request, a WAF has to decide if it let the data go through or not WITHOUT a clue where the data will be used. Common attack patterns are easy to spot, but when the data is encoded, encrypted, obfuscated and so on, a WAF will quickly miss something and that is exactly what Ivan is pointing out. It is so hard to know how to treat the data when it's not known how the data will be used in the application itself. By design, HP Fortify RTA does not have to go through the hassle of decrypting, decoding, normalizing and so on. RTA waits until the data is used in the application itself and will then interfere if the data is used in an inappropriate way. There is so much more context inside the application!